Marked Cards

Marked Cards

Originally shared by Kam-Yung Soh

Details about the Estonian ID vulnerability now out. "A crippling flaw in a widely used code library has fatally undermined the security of millions of encryption keys used in some of the highest-stakes settings, including national identity cards, software- and application-signing, and trusted platform modules protecting government and corporate computers.

The weakness allows attackers to calculate the private portion of any vulnerable key using nothing more than the corresponding public portion. Hackers can then use the private key to impersonate key owners, decrypt sensitive data, sneak malicious code into digitally signed software, and bypass protections that prevent accessing or tampering with stolen PCs. The five-year-old flaw is also troubling because it's located in code that complies with two internationally recognized security certification standards that are binding on many governments, contractors, and companies around the world. The code library was developed by German chipmaker Infineon and has been generating weak keys since 2012 at the latest.

The flaw is the one Estonia's government obliquely referred to last month when it warned that 750,000 digital IDs issued since 2014 were vulnerable to attack. Estonian officials said they were closing the ID card public key database to prevent abuse. Last week, Microsoft, Google, and Infineon all warned how the weakness can impair the protections built into TPM products that ironically enough are designed to give an additional measure of security to high-target individuals and organizations.
[...]
The flaw resides in the Infineon-developed RSA Library version v1.02.013, specifically within an algorithm it implements for RSA primes generation. The library allows people to generate keys with smartcards rather than with general-purpose computers, which are easier to infect with malware and hence aren't suitable for high-security uses. The library runs on hardware Infineon sells to a wide range of manufacturers using Infineon smartcard chips and TPMs. The manufacturers, in turn, sell the wares to other device makers or end users. The flaw affects only RSA encryption keys, and then only when they were generated on a smartcard or other embedded device that uses the Infineon library."

Andres Soolo
https://arstechnica.com/information-technology/2017/10/crypto-failure-cripples-millions-of-high-security-keys-750k-estonian-ids/

Comments

Post a Comment

Popular posts from this blog

Entremet

Entremet Originally shared by Kam-Yung Soh "“Like most people in the US, I grew up knowing the words to this carol and even (shudder) singing them occasionally (singing is not a strong point of mine), but never really thought about what they meant, how the carol originated, or what birds were involved”, says Dr Rasmussen in email. So she decided to figure it out. Dr Rasmussen, who’s tied for third for the most bird discoveries in the world, is probably also the world’s foremost avian sleuth, due to her meticulous detective work a few years ago that uncovered the many ornithological thefts and records frauds in museums that were committed by eminent British ornithologist, Richard Meinertzhagen. But who would ever have thought that an old Christmas carol might also hold an avian mystery? “After all, it’s just a Christmas carol!” Dr Rasmussen points out." https://medium.com/@GrrlScientist/meet-the-real-birds-of-the-twelve-days-of-christmas-fame-grrlscientist-5a8bc09350c9
Read more

Flushbunkingly Gloriumptious

Flushbunkingly Gloriumptious Originally shared by Kam-Yung Soh "Renowned children's author and occasional spy, Roald Dahl spent the last years of his life in a home located in the small English village of Great Missenden, and now his beloved village is home to an attractive museum devoted to his life and works.  [...] Today the museum holds all of Dahl's original manuscripts, as well as his "Idea Books" where he would jot down his nascent creations. In addition to celebrating his writing career, there are also displays covering his service in the RAF. However, the crown jewel of the museum is the recreation of Dahl's purpose built "Writing Hut," complete with the arm chair he had customized to write in." http://www.atlasobscura.com/places/the-roald-dahl-museum
Read more

Originally shared by Kam-Yung Soh

Originally shared by Kam-Yung Soh So Labradors tend to overeat. Now it has been traced to genetic differences. "Dr Eleanor Raffan, a veterinary surgeon and geneticist who studies how genes influence metabolism at the Institute of Metabolic Science at the University of Cambridge recently published a study that examines the genetics that underlie food motivation and obesity in Labrador retrievers. [...] When Dr Raffan and her team carefully examined this POMC gene variant, they found that a small 14-basepair section a little more than halfway down the gene’s length was missing. This deletion creates a frameshift mutation that results in the production of an abnormal protein where the last half is scrambled into a blob of nonsense [...]. Normally, the POMC is translated into the POMC pro-peptide, which is cleaved at precise sites to give rise to number of smaller peptides, including the appetite suppressing neuropeptides, ß-MSH & ß-endorphin, but the abnormal POMC pro-peptide do...
Read more