Posts

Due minuti e mezzo per mezzanotte

Image
Venerdi scorso, 27 Gennaio 2017, il Bulletin of the Atomic Scientists ha annunciato lo spostamento in avanti di 30 secondi del Doomsday Clock . Mancano 2 minuti e mezzo per mezzanotte. Quella che segue è una traduzione del testo integrale . Bollettino  degli Scienziati  Atomici Mancano due minuti e mezzo per mezzanotte Comunicato dal Doomsday Clock * 2017 Comitato per la Scienza e Sicurezza Bollettino degli Scienziati Atomici Direttore Responsabile, John Mecklin (*) Doomsday Clock: un orologio metaforico che indica quanto la civiltà sia vicina ad una possibile fine del mondo, pubblicato  negli ultimi settant’anni  con il bollettino annuale degli Scienziati Atomici; tra i membri, quindici premi Nobel. IT IS TWO AND A HALF MINUTES TO MIDNIGHT© Premessa del direttore  Quest’anno segna il 70mo anniversario del Doomsday Clock , una rappresentazione grafica apparsa sulla prima copertina del Bollettino degli Scienziati Atomici nella sua transizione d
Post a Comment
Read more

Het is moeilijk mensen te vertrouwen in een monetair systeem

Image
Aan de Raad voor Accreditatie Is het erger dat een webwinkel met een " F " score op SSL Labs ( geen veiligheid van de verbinding tussen consument en webwinkel) een keuring toont van een Webshop Keurmerk of dat deze Keurmerk "een 10 heeft gekregen voor de betrouwbaarheid door de Raad voor Accreditatie " met name over "de manier waarop de keurmerk wordt verleend"? De webwinkel www.destofzuigerzak.nl is een van de vele online winkels van Nederland. Het menu  Informatie , hoofdstuk  Veilig winkelen  verklaart: "U kunt bij ons met een gerust hart winkelen. Wij zijn gecertificeerd door Webshop Keurmerk, hét toonaangevende door de overheid erkende keurmerk voor kopen op afstand . Daarnaast worden uw gegevens vertrouwelijk behandeld (zie ons Privacy beleid) en worden alle gegevens die u tijdens uw bestelling invoert, versleuteld/beveiligd verstuurd middels een SSL-verbinding . Wij zijn hiervoor officieel gecertificeerd door Safe2Shop met
Post a Comment
Read more

SSLLabs SSL Test on 716 .gov https sites

Image
716 .gov https sites (thanks to @hackertarget dnsdumpster) 328 " F " (45,81%) 178 " A " (24,86%) (one IP address per subdomain unless multiple scores) 2016/03/02 18:12:18 a068-acswebsrv.nyc.gov 167.153.11.46: F 2016/03/02 18:12:29 ace.cbp.dhs.gov 216.81.83.93: F 2016/03/02 18:12:29 accela1.howardcountymd.gov 167.102.191.83: F 2016/03/02 18:12:35 1click.dhsoha.oregon.gov 170.104.63.76: A- 2016/03/02 18:12:38 adfs.txdot.gov 168.58.229.156: C 2016/03/02 18:12:42 adfg.alaska.gov 146.63.61.200: C 2016/03/02 18:12:52 aip.medi-cal.ca.gov 12.9.80.162: F 2016/03/02 18:13:02 ac.ninds.nih.gov 156.40.215.10: A 2016/03/02 18:13:06 adhimmreglive.arkansas.gov 170.94.17.67: A 2016/03/02 18:13:09 adherave.arkansas.gov 170.94.15.181: B 2016/03/02 18:13:24 alerts.rochestermn.gov 12.184.36.207: A 2016/03/02 18:13:24 airmobile.house.gov 143.228.131.184: F 2016/03/02 18:13:32 aoprals.state.gov 169.253.204.152: B 2016/03/02 18
Post a Comment
Read more

The majority of DHS subdomains vulnerable to Man in The Middle attacks

Image
On 17th september there were 18 .dhs.gov entries in badssl , 11 of which vulnerable to Man in The Middle attacks and 4 to Poodle (TLS ) attack; United States Government Accountability Office has meanwhile found other issues which are probably bigger(?) than that, as the $6B firewall which seems hitting an impressive 6% of the total vulnerabilities selected for review: More specifically, for the five client applications we reviewed (Adobe Acrobat, Flash, Internet Explorer, Java, and Microsoft office), the NCPS intrusion detection signatures provided some degree of coverage for approximately 6 percent of the total vulnerabilities selected for review. ...by the way, here are the (SSL/TLS) facts about DHS as of today:
Post a Comment
Read more

Is DHS running honeypots?

Image
When in September 2015 DHS published its own Security Audit Report , I was rather speechless I could not find any mention of "SSL" or "TLS" in the text, but apparently DHS has been aware of Transport Layer Security earlier than that. Today KrebsOnSecurity published a post titled DHS Giving Firms Free Penetration Tests  containing a link to a document which include the  status update about the ongoing cyber programs and efforts underway at the Department of Homeland Security (DHS) National Cybersecurity and Communications Integration Center (NCCIC) . In a rather confusing timeline, we read first about a DHS ignoring SSL/TLS during its own Security Audit Report (Sept. 2015) and today about how SSL (TLS) related vulnerabilities occupy 5/5 of the Top 5 (Occurring) Vulnerabilities list in the DHS NCATS Year-Engagement Report 2014 (which indeed might have more conveniently be published at an earlier date). The reason for this post is not the confusing orde
Post a Comment
Read more