All posts by FreeNews

New Zealand: Otago Central Lakes Deal Signed To Back Growth

The Government has signed a City and Regional Deal with Otago Central Lakes councils, establishing a 10-year partnership to support housing, infrastructure and economic growth in one of New Zealand’s fastest-growing regions, Infrastructure Minister Chris Bishop and Local Government Minister Simon Watts say. The Deal brings together the Government, Queenstown Lakes District Council, Central Otago […]

United States: DHS Issues Statement After Two Illegal Aliens Stab Off-Duty NYPD Detective; Suspects Remain At-Large

The United States Department of Homeland Security (DHS) released the following statement after two illegal aliens were accused of stabbing an off-duty New York Police Department (NYPD) detective, with both suspects remaining at-large. According to local reporting, the incident occurred on October 2 in the Bronx. The two suspects approached the detective and attempted to […]

United States: Systems Selected for JIATF 401 Directed-Energy Counter-Drone Pilot Program

The Department of War announced the directed-energy systems selected following the Joint Interagency Task Force 401’s (JIATF-401) counter-unmanned aircraft systems (UAS) directed energy pilot program, marking the next phase of efforts to expand the operational use of high-energy laser (HEL) and high-powered microwave (HPM) capabilities across the homeland. Systems selected for the pilot include: AeroVironment […]

United States: U.S. Department of Education Launches Multiple Investigations Based on Reports of Staff-on-Student Sexual Misconduct

As part of its nationwide initiative to crack down on “Pass the Trash” practices, the U.S. Department of Education’s Office for Civil Rights (OCR) today opened investigations into various school districts based on allegations of staff-on-student sexual misconduct. OCR will determine whether the districts’ handling of alleged sexual harassment, including sexual assault, by district teachers, […]

Hackers obtain counterfeit TLS certificates for Google and other large services

Attackers hijacked three top-level domains and used their control to mint counterfeit TLS certificates for Google and other large organizations, Google said Tuesday.

The attackers launched a series of attacks on the .gh, .sl, and .as country code top-level domains (ccTLDs) and then modified the DNS records for selected domains the registries issued. With the ability to receive and send traffic from those domains, the attackers created unauthorized certificates for “several Google domains” and “several leading global brands and widely used online services.” Google said it updated Chrome to block all certificates it has identified as counterfeit and worked with other certificate authorities to ensure other browsers did the same.

Certificate issuance: The weak link in the chain

TLS certificates are the cryptographic credentials that underpin authentication and encryption protections for websites, mail servers, and other Internet infrastructure. These x.509 certificates use a digital signature to bind an identity, such as Google, to a public key. The certificate is also bound to a specific domain belonging to the identity. The public key is publicly available, while the private key is held only by the website operator. When a connection shows that the keys match, the visiting party knows it’s connected to the authentic site rather than an impostor. Possession of unauthorized certificates allows attackers to cryptographically impersonate the affected infrastructure.

Read full article

Comments