Uhhhhhh. Did you hear the news out of Wales?

A gov contractor left a user account called test2 with the password of Password1 in a prod system.

France biggest Isp break 3/4 of it's network

In Chinese 4 sounds like death, and I think that's beautiful.

Your meme is already out of date.

GitLab just announced a CVSS 10.0 unauthenticated RCE: https://docs.gitlab.com/releases/patches/patch-release-gitlab-19-5-1-released/

fuck

Including the AfD email leak, too?

I'm tired of this grandpa

That's too damn bad! You keep patching!

AGAIN?! That’s the third one in two months.

Yeah, but that's a good thing.

Cap'n its wednesday

Ffs (boyo)

Normal leak: This is does not spark joy.

AfD leak: This sparks joy.

Japanese too!

I give him credit for the one. I never would have guessed that by brute force.

Oh for sure; just…. a lot of infosec news in general this week

japanese 4 is just chinese 4 with extra steps

shi---

One thing I don't understand...

So if a bad actor gets access to one of the intermediate CA certificates they can run all sorts of MITM attacks, right? What are the chances that government agencies don't have a bunch of private keys from CA that are not obviously wrong? 0, right? So we should just assume that government agencies can do MITM whenever they want?

Cloudflare is the largest MITM hiding in plain sight.

It's actually possible to prevent impersonation:

In theory all the generated keys are added to a public certificate transparancy log. Browsers should check that the key is there (but your http client library probably doesn't - and this is why these compromised keys are a problem).

Website owners should also check that there are no other certificates in there, and if they see an extra misissued certificate something went really wrong at a CA and that CA would probably lose all the credibility and trust.

Also when you request a certificate the CA doesn't get your private keys, so they can't reuse your cert.

Example: https://ctlogs.dev/search?q=Programming.dev

Yeah, but it's my Friday. It couldn't wait until Monday? Eugh.

Yeah what the hell is happening here?

Ant info?

Maybe a little cathartic brute force, then?

Yes, but if it's not used for a website but VPN for example. If NSA got a private key from some compromised CA and did MITM on some VPN users, would anyone notice?

I wonder about one thing, if somebody can perform MITM on arbitrary domains, is there something like certificate pinning to stop impersonating the authorities used for things like this? I remember OCSP being something like that (if I'm not butchering the initialism), where the browser requests confirmation the certificate is currently valid, and the server can pre-fetch this confirmation to send to the client.

Man I miss tintin, ima go look for more memes

You mean I have to do it myself? UGGHHHH.

Also, Crimestoppers just announced that the database of all tipsters and tips for the past 25 years has been leaked.

Certificate transparency means that all certificates have to be publically logged.

Yes, government agencies can do MITM whenever they want.

Also, take a look at the remote management functionality of your computer.

I guess go back to pencil, paper, and cash in hand.

And everyone gives them voluntarily their private keys.

Okay, but how do you verify that? In order to check if the certificate was logged, you need to access the log; if somebody can fake certificates and intercept your requests, can they also impersonate the certificate log and fake an entry there? Or is it secured in some additional way?

WebPKI (the term for certificates used for web browser as opposed to the general usage of certificates outside of the web) requires that all certificates now be included in a public, widely used certificate transparency log. That fact gets included in the certificate delivered to your browser. Your browser will reject any certificate* that was not included in a certificate transparency log.

Take your instance discuss.tchncs.de for example, we can see all the certificates here. If you looked at that list, do you see anything wrong? Probably not.

But you're on to something. A malicious certificate is minted and it's in the CT log, so what? I don't check the CT log every time I go to a new webpage. Instead, CT logs are more able giving information to security organizations and companies to detect violations under their own properties. A company like amazon or google would setup CT log monitors to continually monitor for certificates issued for their domains. If they detect one, and they didn't request it, they can flag it to the cert authority board and it can get CAs pulled from the root trust stores. I can (and probably should find time to) setup certspotter on my own domains.