Change to One Year TLS/SSL Validity

Monday, August 10th, 2020 | Mark Bedford | Comments Off on Change to One Year TLS/SSL Validity

Due to changes in browser requirements, QuoVadis will change to 397 day maximum validity for public TLS/SSL on August 27, 2020 at 23:59 UTC. 397 days equates to one year validity plus limited time to accommodate early renewals. After the change, the new policies will be automatically available for provisioning.

  • This change affects all CAs industry-wide. It applies to Business SSL (OV), EV, and Qualified Web Authentication certificates.
  • Two-year certificates issued before the August 27 changeover will continue to work in browsers.
  • This change does not affect other certificate types including code signing, document signing, client, S/MIME certificates, or private TLS/SSL.

COVID-19 Related Cyber Attacks

Wednesday, March 25th, 2020 | Mark Bedford | Comments Off on COVID-19 Related Cyber Attacks

While it is unfortunate and tasteless in the light of COVID-19’s impact on the world, we are seeing that criminals are using the pandemic as an opportunity to exploit peoples goodwill and need for information or help.

Our wider cyber security community is reporting campaigns using the following propagation methods,often endeavoring to gain the trust of victims using branding associated with the U.S. Centres for Disease Control and Prevention (CDC) and the World Health Organization (WHO), as well as country-specific health agencies such as the Public Health Centre of the Ministry of Health of Ukraine and China’s Ministry of Health, and companies such as FedEx. Examples include:

Emails

There are a range of emails using COVID-19 to grab peoples interest. Examples include:

  • working from home statements from supervisors/managers (Director of Milan University)
  • requesting donation to fake WHO COVID-19 response fund
  • recommendations to avoid infection
  • blackmailing people to pay ransom or risk family member being infected
  • statements from health authorities (WHO, CDC, MoH, etc)

Often these will include attachments with malware or links that take you to a website or file download or ask you to login.

Phone

Receiving phone calls

  • Impersonating an authority to carry out a variety of scams, from gaining access to your account to phony donation requests and spreading of malware.
  • pretending to be a hospital looking for payment for treatment of a friend or relative
  • scams similar to the previously seen “microsoft” calling to clean a virus off your computer.

Receiving TXT message

  • text messages that have a link that claims to direct people to testing facilities. This link is not legitimate and instead may install malicious software on your device that’s designed to steal your personal information, such as banking details

Web Sites

Criminals are cloning or crafting websites to facilitate their scams

  • Fake anti-virus website promising coronavirus protection is actually delivering malware
  • fake shops, websites, social media accounts, and email addresses claiming to sell medical supplies currently in high demand, such as surgical masks.
  • clone of the (legitimate) Johns Hopkins University coronavirus map used to spread malware.
  • offering to sell or provide fake cures, vaccines, and advice on unproven treatments for COVID-19

Please be careful about which websites you go to. Our advice is to to only use trusted and verified information sources from government and research institution’s websites. Ideally by going directly to them rather then clicking off links in unsolicited emails.

Social Media Sites

  • Be cautious of legitimate fundraising sites like GoFundMe that are used to solicit donations as this is a common tactic of criminals
  • Watch for fake investment schemes using stocks being promoted via social media where there is a claim about having a product or service that is able to prevent or treat COVID-19
  • the obvious stupid or fake ‘trolls’ trying to get social attention by offering potentially dangerous advice
  • offering to sell or provide fake cures, vaccines, and advice on unproven treatments for COVID-19

Malware and Mobile Apps

Criminals are associating branding from authoritative sources or creating apps that provide coronavirus information to get people to install apps that include malware / spyware on mobile devices.

  • Coronavirus tracking apps like ‘corona live 1.1’ includes spyware that gives to attacker remote control over your device and the data it has access to.
  • COVID19 tracker – another tracking app that includes ransomware and encrypts the users devices demanding bitcoin.

Think carefully about whether you really need an app, especially where you have no idea that it will actually provide accurate information. Please ensure that you download apps only from official app store for your phone and always check the permissions apps request on your device make sense.

Summary

Expect to see a wide range of COVID-19 related phishing emails, text messages, dodgy apps and fake web sites. These scams will likely focus on the our interest in COVID-19 virus spreading by informing of infections in your local area, vaccine and treatment offers, and supply shortages that have become critical.

If you are unsure about the website, do not proceed with any login procedures. If there is some general information that can be found searching through an online search, do that instead of clicking the link from a suspicious sender.

If there is any doubt to a received item, then you should contact AskOtago like normal.

Firefox and Safari Leading in Website Security

Thursday, March 12th, 2020 | Mark Bedford | Comments Off on Firefox and Safari Leading in Website Security

Firefox

With TLS 1.0 and TLS 1.1 considered vulnerable to various types of attacks, including BEAST, CRIME and POODLE, Mozilla last month announced plans to disable them in its popular browser and allow only connections made using TLS 1.2 and TLS 1.3.

The move should have no impact on websites that support TLS 1.2 and up, but will result in an error message being displayed when the newer protocol iterations are not supported. An override button on the error page will provide users with the option to fallback to TLS 1.0 or TLS 1.1.

The deprecation of older TLS iterations was initially announced a couple of years ago, but some website administrators have yet to upgrade to newer versions of the protocol. The change introduced in Firefox 74 is expected to encourage them to improve the security of their sites and users

Safari

Apple has unveiled a policy for Safari at the CA/Browser forum that it will not trust any website certificates valid for more than 398 days. This will flow on to all iOS and macOS devices and that this starts on September 1, 2020. This is aimed at improving website security by making site developers are using certificates with up to date cryptographic standards.

Clearly the improved security is going to have some draw backs such as increasing the frequency of certificate deployment will increase the workload for IT staff. The suggestion is that companies need to look to automation to manage certificates and compliance.