Ethical Hacking

Learn to find vulnerabilities before the bad guys do! Gain real world hands on hacking experience in our state of the art hacking lab. Course designed and taught by expert instructors with years of penetration testing experience. 12 student maximum in every class. Certification attempt included in every package.
Computer Forensics Training at InfoSec Institute

Gain the in-demand skills of a certified computer examiner, learn to recover trace data left behind by fraud, theft, and cybercrime perpetrators. Discover the source of computer crime and abuse at your organization so that it never happens again. All of our class sizes are guaranteed to be 12 students or less to facilitate one-on-one interaction with one of our expert instructors.




Network Security FullDisclosure
[Top] [All Lists]
<prev [Date] next>
[Advanced]
 <prev [Thread] next>

Re: [Full-Disclosure] Looking for some input

from [Valdis . Kletnieks] Network Security [Permanent Link]
Subject: Re: [Full-Disclosure] Looking for some input
Date: Thu, 27 May 2004 14:17:48 -0400 
On Thu, 27 May 2004 10:40:17 MDT, Shannon Johnston <sjohnston@libertysite.com>  
said:


The institution where I do my banking has a login to an internet banking
page. While the login goes to an SSL enabled site, the login page is on
a non-SSL site. My question is: Doesn't this leave the members of the
institution open to phishing via DNS cache poisoning? Doesn't this
defeat the endpoint verification piece of an SSL certificate?


Contemplate the real-world usefulness of an SSL cert.

No, seriously - consider Matt Blaze's comment that "A CA can protect you
against anybody they're not accepting money from" - then go read the chapter in
Schneier's "Secrets and Lies" about it.

Or as a faster check - how many people actually click on that little padlock,
read the "This site has correctly identified itself" blurb, and then go the
extra step of actually looking at the certificate to ensure it's not a spoofed
site that's correctly identified itself under the spoofed site name? (Hint -
would you notice if it said "The website www.g00gle.com has correctly
identified itself"?)  Oh - and do that for *every* encrypted page? ;)

If I can hijack your connection to your bank by poisoning your ISP's DNS cache,
I can do the exact same thing to hijack you to a typosquatter site that
correctly identifies itself as the typosquatter site....

Attachment: pgpEfZbDsb7uU.pgp
Description: PGP signature

[More with this subject...]




<Prev in Thread] Current Thread [Next in Thread>
Previous by Date:  RE: [Full-Disclosure] IDS WIth TCP Reset and SPAN, Robert MacDonald
Next by Date:  Re: [Full-Disclosure] iDEFENSE Security Advisory 05.27.04: 3Com OfficeConnect Remote 812 ADSL Router Authentication Bypass Vulnerability, Seth Alan Woolley
Previous by Thread:  [Full-Disclosure] Looking for some input, Shannon Johnston
Next by Thread:  [Full-Disclosure] The Dangers of Cross-Site-Scripting: Rogers Hi-Speed Internet Network [Canada], http-equiv@excite.com
Indexes:  [Date] [Thread] [Top] [All Lists]