Posted on

Apple, Google, Microsoft, and Mozilla come together to end TLS 1.0

A green exterior door is sealed with a padlock.

Enlarge (credit: Indigo girl / Flickr)

Apple, Google, Microsoft, and Mozilla have announced a unified plan to deprecate the use of TLS 1.0 and 1.1 early in 2020.

TLS (Transport Layer Security) is used to secure connections on the Web. TLS is essential to the Web, providing the ability to form connections that are confidential, authenticated, and tamper-proof. This has made it a big focus of security research, and over the years, a number of bugs that had significant security implications have been found in the protocol. Revisions have been published to address these flaws.

The original TLS 1.0, heavily based on Netscape's SSL 3.0, was first published in January 1999. TLS 1.1 arrived in 2006, while TLS 1.2, in 2008, added new capabilities and fixed these security flaws. Irreparable security flaws in SSL 3.0 saw support for that protocol come to an end in 2014; the browser vendors now want to make a similar change for TLS 1.0 and 1.1.

Read 2 remaining paragraphs | Comments

Posted on

Safari address-spoofing bug could be used in phishing, malware attacks

From the department of things that aren't what they seem, researchers have demonstrated a new address-spoofing exploit that tricks Safari users into thinking they're visiting one site when in fact the Apple-made browser is connected to an entirely different address.

The recently published proof-of-concept exploit causes the Safari address bar to display dailymail.co.uk even though the browser is displaying content from deusen.co.uk. It works on fully patched versions of iOS and OS X. Malicious attackers might use the bug to dupe Safari users into thinking they're connecting to a trusted site instead of one that's phishing their login credentials or attempting to install malware.

The demo code isn't perfect. On the iPad Mini Ars tested, the address bar periodically refreshed the address as the page appeared to reload. The behavior might tip off more savvy users that something is amiss. Still, many users would surely fail to spot the unusual refresh. What's more, the refresh behavior wasn't observed on a MacBook Pro Ars also tested.

Read 2 remaining paragraphs | Comments

Posted on

Apple blacklists older versions of Flash plugin due to security risk

Just as it did with some versions of Java, Apple has now blocked older versions of Adobe's Flash plugin to protect Mac users from security risks. In a new support document posted to its website on Friday, Apple explained that it has already updated its plugin blocking tool built into Safari—users don't need to lift a finger.

"To help protect users from a recent vulnerability, Apple has updated the web plug-in-blocking mechanism to disable older versions of the web plug-in: Adobe Flash Player," the company wrote.

Earlier this year, Apple blacklisted the latest version of Java—twice—due to security vulnerabilities. But Flash comes with its own security risks: Adobe issued an emergency Flash update earlier this month due to similar vulnerabilities on OS X and Windows, with another emergency update issued again three days ago. Like the Java holes, the Flash vulnerabilities allow remote attackers to surreptitiously install malware on vulnerable machines.

Read 1 remaining paragraphs | Comments