[+]d'ZheNwaY's Blog[+]: Fixes in the Works For SSL Attack, But ...

id='post-body-865207864838393674'>

With the release of the BEAST SSL attack research due tomorrow, researchers are beginning to take note of potential fixes and mitigations for the attack. One of the possibilities is moving to newer versions of TLS that are not vulnerable to the attack, but the problem is that there is precious little adoption of those newer versions.

Some of the browser vendors have been looking at possible remedies for the attack on TLS developed by Juliano Rizzo and Thai Duong, and Opera was the first to develop a fix for it. The company initially implemented the fix in its browser, but then discovered that it broke a small percentage of sites and did not push the fix into the final version of Opera. The default configuration of Opera isn't vulnerable to the new attack, but if users change some settings, the browser can become susceptible to the attack.

Rizzo and Duong's attack, which Rizzo will present at the Ekoparty conference on Friday, is aimed at TLS 1.0, which is an older version of the protocol, and the newer versions are not vulnerable. However, as Opera's own research found, the adoption of TLS 1.1 and 1.2 among Web sites is far too low to just make the switch in the browser. Opera found that just 0.25 percent of sites supports TLS 1.1 and 0.02 percent support version 1.2. TLS 1.0 is quite an old standard, and even versions 1.1 and 1.2 have been approved for several years now, but many of the more recent versions of the major browsers don't support the newer releases of TLS, which presents a problem for site operators who would like to upgrade. If their users can't handle TLS 1.1 or 1.2, upgrading could cost them customers.

For example, the latest version of Mozilla Firefox has the boxes for SSL 3.0 and TLS 1.0 checked by default and there is no option for users to enable support for newer versions of TLS. Internet Explorer 9 gives users the ability to enable support for TLS 1.1 and 1.2 in Internet Options under the Advanced tab. But, unless the site on the other end of the connection is using a newer version of the protocol as well, that doesn't do the user much good.

Opera isn't the only vendor who is working on a fix. Google also has been preparing a patch for its Chrome browser and the company has pushed that fix to its development channel already, officials say. The company is hoping to have the fix go through the typical process of moving to the beta channel and then the stable channel without having to push it out as an emergency fix.

A new report by security researcher Thierry Zoller that looked at browser support for various versions of the TLS protocol found that support for anything newer than TLS 1.0 is quite spotty. Also in the report, Zoller recommends that sites that use SSL drop support for SSL 2.0 and 3.0 and only support TLS 1.0 and later.

nb : threatpost

Source: http://dzhenway.blogspot.com/2011/09/fixes-in-works-for-ssl-attack-but.html

»»  read more

Opera vs. Sports

Fall is approaching quicker than I'd like it to.  But while Fall means shorter days and the inevitable snow season *shudder*, Fall brings with it two good things:  the start of the University of Utah football season (Go Utes!) and the start of the symphony/opera season.  While the two activities are very different from each other, it's fun to be so dedicated to both.  (I have season tickets to both!) 

Danny & Kelli at the Utah Symphony Vivace afterparty.  (March 2009)

So in honor of the new seasons of my favorite Fall activities, I thought I'd post a portion of a fun article called, If Opera Were Sports, on the Operation Opera blog.  The author, Dr. Glenn Winters, starts out with this:

 

When I talk about opera to people who don’t like it, one point I try to make is the effect you get when words are sung instead of spoken; music makes words and emotions and personalities larger than life. And most of us spend our waking hours searching for those larger-than-life moments, don’t we? Isn't that really why we like rock music and movies and sports? A Hail-Mary touchdown pass with time running out has a real operatic feel to it. 

 

I couldn't agree more!  Dr. Winters goes on to compare different types of art and sports.  He compares ballet to soccer ("Americans are bored by it, but they love to sign up their children to do it."), symphony concerts to baseball ("Slow moving and too long, but who wants a world without them?"),  and opera to pro hockey ("Appeals to a small group of crazed aficionados who mostly like the violence.").  The whole list is on Operation Opera here. 

Kelli & Danny tailgating at the U of U game.  (November 2009)

Now that I think about it, football season and symphony season do have some similarities.  Both require special outfits (all-red outfits and formal attire), both involve drinking (ok, so maybe not everyone would agree, but I sure think so), both have at least a half day's worth of pre-activity beforehand (tailgating for football games and pre-symphony dinner outings), both are great places to people-watch (crazy drunk people at one and the 60 and older crowd at the other), and both leave me completely satisfied at the end (unless the Utes lose to BYU, since that's the only game that really matters). 

Danny, Kelli, Nic and Chris at Fiddler's Elbow watching the Utah Game. (November 2009)

So bring on Fall!  We're in for a good season of football!  Check out the Utes' schedule here.  Not to be beat by the world of sports, the symphony has an impressive season planned too.  Utah Symphony/Utah Opera's line up is here.  Go Utes!  (And ... go, uh, Utah Opera?!)

Source: http://randomactsofkelliness.blogspot.com/2010/08/opera-vs-sports.html

»»  read more