WebApp Sec mailing list archives
Re: keyloggers? - dont doit
From: "lyal.collins" <lyal.collins () key2it com au>
Date: Thu, 07 Apr 2005 13:37:55 +1000
SSL falls to spoofed certs/trust lists and or DNS poisoning to create MITM attacks. Cybercafes can run their own DNS and routing mechanisms, enabling the latter. They run and manage their own browsers and trusted cert lists, enabing a fake 'root CA" cert to be laoded into browsers, enabing the former. SSL is a dead duck in every environment unless DNS is known to be 100% accurate, and no ARP sppofing tricks are happening. yal
On Apr 6, 2005 7:23 AM, Alvin Oga <alvin.sec () virtual linux-consulting com> wrote:- anything sent over the internet is sniffable from anywhere in the worldDelurking just to mention that this isn't correct. Online banking (and other security-sensitive activities) aren't a good idea from shared sites like a cybercafe for all the reasons others have mentioned, but this isn't it. From my desktop here, I almost certainly have no way of sniffing your traffic to your bank, unless I happen to be somewhere along your path. I'd also like to know about SSL being broken. I think you mean one of the common ciphers is broken, which would be substantial news indeed. Your conclusion is right but your reasoning is completely wrong AFAICT. -- Kyle Maxwell [krmaxwell () gmail com]
--
Current thread:
- Re: keyloggers? - dont doit lyal.collins (Apr 06)
- <Possible follow-ups>
- Re: keyloggers? - dont doit James . Barkley (Apr 06)