It is UNSAFE to use Google, Skype, Microsoft and Yahoo on iOS 4.3 or Before

[SomeDudeAsking]

Comodo, the Jersey City, NJ-based security company whose reseller issued the bogus certificates, disputed the charge, saying that at no time was anyone at risk.

Last week, attackers used a valid username and password to obtain nine SSL certificates -- used to prove that a site is legitimate -- from an Comodo affiliate. The certificates were for six Web sites, including the log-on sites for Microsoft's Hotmail, Google's Gmail, the Internet phone and chat service Skype, and Yahoo Mail. A certificate for Mozilla's Firefox add-on site was also acquired.

At least one of the certificates, for logon.yahoo.com, was used to legitimize a fake Yahoo site hosted by an Iranian ISP (Internet service provider), Comodo said yesterday.

Comodo's CEO and founder, Melih Abdulhayoglu, said there was evidence, largely circumstantial, that the Iranian government had backed the hack of its partner to obtain SSL certificates.

http://www.computerworld.com/s/arti...put_Iranian_activists_at_risk_says_researcher

It is unsafe to use Google, Skype, Microsoft and Yahoo on iOS 4.3 or before if you use it check your e-mail, VOIP, or send anything sensitive when using iOS 4.3 or before because you are vulnerable to man in the middle attacks. Since iOS Safari and derived browsers have no means of updating trusted certificates or blacklisting them, you absolutely MUST upgrade to iOS 4.3.1 released today, which I believe should contain the blacklisted certificates.

iOS 4.3.1 is *not* optional people, it is a security upgrade.

 

[bwrairen]

I fail to see what this has to do with 4.3.1. These sites would have cleared authentication because they had valid ssl certificates.

Care to elaborate?

 

[Ashin]

The security holes he speaks of are well documented, and this is why 4.3.1 has come out so fast without full beta testing cycles like normal.

 

[SomeDudeAsking]

I fail to see what this has to do with 4.3.1. These sites would have cleared authentication because they had valid ssl certificates.

Care to elaborate?

The problem is that supposedly nefarious hackers for the "Iranian government", "Israel pertaining to be the Iranian government", or "China pertaining to be Israel pertaining to be Iran" hacked into one of the root authorities that make those SSL certificates and gave themselves valid working ones for Google, Skype, Microsoft, and Yahoo. That means in iOS 4.3 if you use Safari or any other Safari based brower (ie: all of them), you can get all your passwords, data, and communications stolen from those sites if the cellular network or wifi network you are on routes through one of their routers (last week, AT&T 3G data was routed through China for some time) because iOS 4.3 is now vulnerable to man in the middle attacks. iOS 4.3.1 should have the stolen certificates blacklisted so you wouldn't be vulnerable to these specific attacks. And attacks in the wild have already been spotted using these certificates, especially for Yahoo.

 

[marksman]

Please post evidence that AT&T's 3G data was routed through china for some time last week.

That defies even knowing how networking works.

 

[SomeDudeAsking]

Please post evidence that AT&T's 3G data was routed through china for some time last week.

That defies even knowing how networking works.

Traffic destined for Facebook from AT&T's servers took a strange loop though China and South Korea on Tuesday, according to a security researcher.

Barrett Lyon, who has worked for companies such as EveryDNS, did a traceroute -- a command that allows a user to see which network providers were used to reach a desired website -- to Facebook while on AT&T's network.

Lyon wrote on his blog that data from AT&T customers would usually go directly to Facebook's network provider. But due to what Lyon characterized as a routing mistake, the traffic first went through China Telecom and then to SK Broadband in South Korea before routing to Facebook.

Routing errors are not uncommon on the part of network operators. In insignificant cases, it can allow traffic to take circuitous routes to destinations. But in the worst scenarios, it can mean websites in certain IP ranges could be unreachable.

In 2008, Pakistan Telecom made an error with BGP (Border Gateway Protocol), which is used to configure routers used by network providers to exchange traffic. After Pakistan's government ordered that ISPs block YouTube, Pakistan Telecom misconfigured BGP and made YouTube unreachable to users worldwide.

In this case, the concern outlined by Lyon is data safety: If Facebook users did not have encryption enabled, it would be possible for those network operators to see the data.

"What could have happened with your data?" Lyon wrote. "Most likely absolutely nothing. Yet China is well known for its harmful networking practices by limiting network functionality and spying on its users, and when your data is flowing over their network, your data could be treated as any Chinese citizens'. "

Information that could be harvested could include session ID information, personal information, e-mail, photos, chat conversations and an idea of who a person knows via their Facebook profile, Lyon wrote.

http://www.pcworld.com/businesscent...ebook_traffic_takes_a_loop_through_china.html

You should listen to me when I tell you something. I know more about this stuff than you do.

 

[jake4ever]

http://www.pcworld.com/businesscent...ebook_traffic_takes_a_loop_through_china.html

You should listen to me when I tell you something. I know more about this stuff than you do.

Sorry, you are incorrect. Please excuse my poor English, but what you saying exactly is wrong. It has nothing to do with 4.3.1.

 

[SomeDudeAsking]

Sorry, you are incorrect. Please excuse my poor English, but what you saying exactly is wrong. It has nothing to do with 4.3.1.

Then you don't know what man in the middle attacks are because if you do, you would realize the significance of the stolen SSL certificates from COMODO coupled with routing through foreign countries. iOS 4.3.1 should have blacklisted the stolen certificates to make these attacks not possible.

 

[EvanLugh]

Then you don't know what man in the middle attacks are because if you do, you would realize the significance of the stolen SSL certificates from COMODO coupled with routing through foreign countries. iOS 4.3.1 should have blacklisted the stolen certificates to make these attacks not possible.




I can't help it if I'm smarter than most people that post here. Someone has to think.

I had to restrain myself from posting yesterday.. you are posting information you've found on the internet (granted, like most people) with little or no knowledge. If an SSL certificate can't be validated, what do you think happens?

I can't help it if I'm smarter than most people that post here. Someone has to think.

'Smart' people don't tell others how smart they are, it's usually based on their intellectual posts and/or evidence, unlike yourself reeling off links and as another user said commanding people.

Also, have a guess how many people connect to i.e. Facebook without https, through Wifi networks, cellular etc. Easy interception. Maybe you should look into this!

A quote from your link also has the interesting paragraph:

"What could have happened with your data?" Lyon wrote. "Most likely absolutely nothing. Yet China is well known for its harmful networking practices by limiting network functionality and spying on its users, and when your data is flowing over their network, your data could be treated as any Chinese citizens'. "

Do you think this is any different to any other practice?

Comodo, the Jersey City, NJ-based security company whose reseller issued the bogus certificates, disputed the charge, saying that at no time was anyone at risk.

Google, Microsoft and Mozilla have each issued updates that add the nine stolen certificates to their browsers' blacklists.

So, how does this affect 4.3.1 in anyway, SomeDudeAsking?
(in regards to the fact they were blacklisted without the need of iOS software (4.3.1)

 

[dashrendar]

not only that, but I believe that only the Yahoo certificate was used for testing by the hackers. The other ones weren't released yet. And the have all been pulled by COMODO. 4.3.1 has nothing to do with this.

 

[PNutts]

Hey look! I can cut and paste, too!

http://www.theregister.co.uk/2011/03/23/facebook_traffic_china_telecom/

From the article:

Facebook issued a statement that read:

We are investigating a situation today that resulted in a small amount of a single carrier's traffic to Facebook being misdirected. We are working with the carrier to determine the cause of this error.

Our initial checks of the latency of the requests indicate that no traffic passed through China.

 

[Intell]

...and this is why 4.3.1 has come out so fast without full beta testing cycles like normal.

The X.X.1, X.X.2, etc. builds never have a beta cycle. They are just security updates and only fix minor bugs. They don't redo the public APIs.