Joe Purcell
Staff Writer  securitypronews

 

The internet is a universe of information. Just like in reality, not everyone is permitted to go wherever they like, thus, we have military, fences, and signs that say "Employees Only". On the internet we just have Certificate Authorities (CA), usernames, and passwords. While WikiLeaks' complete database was released, the internet has been taken by the horns with the breach at the CA DigiNotar and security vulnerabilities in Apache and other software.

The full WikiLeaks database of 250,000 diplomatic cables is now released. It can be found on sites like cryptome.org. According to an interview between NewScientist and Julian Assage, there was a secure arragnement between the Guardian and WikiLeaks for them to have access to the cables in order to do journalism. Long story short, the credentials for accessing the cables was leaked. The Guardian has its own story that involves Assange telling them that the password would expire. WikiLeaks tweeted, "It is strictly false that the Guardian was told the password or file were temporary, hence the elaborate password handover method."

Nonetheless, it alll resulted in WikiLeaks publishing the entire cables in order to minimize the amount of harm that could be done. Having the information public allows for those who might do harm and those who might be harmed to have the same information. The second reason, Mr. Assange states, was that there is now a reliable source for the cables. Knowing that the cables were released, but without a sound source allows for people to claim authenticity. There have already been stories published in other countries that were based on manufactured cables. Mr. Assange appeared on 60 Minutes with CBS and the release of the cables will have enormous implications for the future.

Another earth shaking event was the breach last month of a Duth Certificate Authority, DigiNotar, which was just made public. Certificate Authorities are very little understood. An article "The Internet's Secret Back Door" by Danny O'Brien published last year explains how these Certificate Authorities work and the reason they were implemented. Essentially, SSL certificates are the way that a user knows the authenticity of the site they are viewing, which is worse than the recent DNS attacks since certificates are expected to be secure. Some 531 false certificates were released last month, and according to a nakedsecurity post the false certificates were used by the Iranian government to spy on secure communications in their country. The Tor Projects' website has a list of all rogue certs, which shows that false certificates were issued for websites such as Facebook, Twitter, Microsoft, and Google.

Continue reading this article.

More Information and trial copies of Secure Hive Click Here!