DigiNotar Issued Fraudulent Google Certificate

<DigiNotar> is a Dutch Certificate Authority who issued a rogue SSL certificate to somebody in Iran on July 10th, 2011 for the domain name .google.com. This allows the certificate holders the ability to possibly carry out a man in the middle attack on most of Google's services, including GMail, Google+, and Google Docs.

DigiNotar is a wholly owned subsidiary of VASCO Data Security International. On August 30, 2011 <VASCO released a public statement> acknowledging that their DigiNotar Certificate Authority infrastructure was hacked on July 19, 2011, and was used to issue fraudulent CA's for a number of domains, including Google.com. <Some digging by F-Secure> found defacements left over from at least two separate intrusions that could be years old.

The Google Chrome browser <has an extra fine grained set of CA's with the authority to sign for Google> which is rumored to have protected Google Chrome users.

Firefox suggested revoking DigiNotar and <provides instructions for revoking the CA> in your local browser.


Fraudulent Digital Certificates Could Allow Spoofing (Aug 29, 2011)
<Microsoft Security Advisory (2607712)>

UPDATE (Aug 31, 2011):
<Mozilla pushes Firefox 6.0.1 update explicitly to revoke the DigiNotar CA>

Google Project: Obfuscated TCP

From the <Obfuscated TCP Project's Home>,

"Obfuscated TCP is a transport layer protocol that adds opportunistic encryption. It's designed to hamper and detect large-scale wiretapping and corruption of TCP traffic on the Internet."

View the <quick YouTube explanation>:

Clickjacking

Clickjacking

  Clickjacking is the buzz word for the week. Robert “RSnake” Hansen and Jeremiah Grossman had planned a presentation on clickjacking at the <world OWASP conference in New York>. After sharing the information with Adobe they were <asked to delay> releasing of details because of it's impact on one of their products.

  Clickjacking is underappreciated, but well known. Traditionally JavaScript had many implications in this area, but this does not require JavaScript. This zero day is purported as a fundamental flaw in how browsers handle web pages that affects all (or most all?) graphical browsers. From <Jeremiah Grossman on his blog>, "At the time, we believed our discoveries were more in line with generic Web browsers behavior, not traditional 'exploits,' and that guarding against clickjacking was largely the browser vendors' responsibility."

It's been said by many people that turning off JavaScript will not prevent this attack. The Firefox plugin/add-on <NoScript> does much more than micro-managing JavaScript. <ZDNet's Blog> posted the following email from <Firefox Noscript>:

Hi Ryan,
  I’ve seen a lot of speculation and confusion in the comments to your Clickjacking article about NoScript not being able to mitigate [the issue].
  I had access to detailed information about how this attack works and I can tell you the following:

1. It’s really scary
2. NoScript in its default configuration can defeat most of the possible attack scenarios (i.e. the most practical, effective and dangerous) — see this comment by Jeremiah Grossman himself.
3. For 100% protection by NoScript, you need to check the “Plugins|Forbid <IFRAME>” option.

Cheers,
Giorgio

Through <Jeremiah Grossman's blog> (referred to in the email above) and <Robert Hansen's blog at ha.cker.org> some information about the zero day can be found, but it seems the rest of the details have been kept pretty tight.

<Breaking Point Systems> has been speculating on this vulnerability and posted <source to some forms of web jacking>. Later they realized that these weren't exactly the zero day and then posted this <proof of concept "IFrame Trick"> which seems to fit the details of the vulnerability.

Firefox 3 World Record Is Official: 8 Million Downloads

" Thanks to the support of the always amazing Mozilla community, we now hold a Guinness World Record for the most software downloaded in 24 hours. From 18:16 UTC on June 17, 2008 to 18:16 UTC on June 18, 2008, 8,002,530 people downloaded Firefox 3 "

<SpreadFirefox.com World Record>

Mozilla announces Firefox 3 release date

Of course this is just an expected release date, but the big day is...
Tuesday, June 17th, 2008

<Download Day 2008 Headquarters>
<Mozilla Development Center news post> (posted June 11th, 2008 at 4:47 pm)
<Firefox 3 mass-download world record attempt> (posted May 29, 2008)

Firefox 3 Preparing for World Record Attempt

  The official release of Firefox 3 maybe be the most anticipated software releases of the year. Firefox 3 shows many promising improvements, most notably major memory usage cutbacks and performance improvements. <Early memory comparisons> have shown impressive numbers. Many other changes and improvements are already locked in since the first <release candidate> was released. A quick run down of feature comparisons can be found <here>.

  <The Mozilla Blog> has announced an attempt to break a world record for most software downloads in 24 hours. The release date for Firefox 3 isn't set yet, but is expected some time in June. Mozilla has a <Download Day Headquarters> site where you can monitor for the release date, read more, and even pledge to download on the release date.

Accessing 'Must Sign Up to View' sites

  More and more sites try to capture you as a repeat visitor from your casual viewing of their site by forcing you to create an account to view or download their content. We will list a few techniques and services which will help you circumvent this annoying process.
  There is a ton of additional services/techniques more than we will list. Feel free to post your favorite in the comments. No account or sign up is required to post comments. The best technique to use may vary by site and the content you are after, but in general the following suggest should be considered in order.

BugMeNot is a site that allows people to share login accounts for accessing sites.

<BugMeNot.com>

<BugMeNot Firefox Add On>

Web caches are saved copies of web pages. They can let you view sites who are no longer accessible and sometimes can cache sites not normally accessible.

Google automatically shows a link to cached versions of search results as shown above.

<More about Google caches>

The Wayback Machine (referring to the time machine in 'The Rocky and Bullwinkle Show' cartoon) is another web caching service.

<Internet Archive: Wayback Machine>

  User Agent spoofing is another possible technique. When a web page is requested by your browser some information is sent along. Part of that information is your <user agent> witch identifies your browser and possibly your operating system and their versions. This is to help websites display properly across many software clients and platforms.
  Web search engines have 'spiders' crawling the web indexing web sites. To comply with standards and prevent getting low search engine scores web sites typically do what they can to allow web spiders a larger amount of access to content. Spiders typically are identified by their user agent string. So, by spoofing a web spider's user agent string, you may have some less restricted access to content of sites. The following tools will help you spoof your user agent.

<Firefox add on: User Agent Switcher>
(this may require a quick <Google search of 'user agent list'> to find a list of common user agents to load into the tool.)

<Be The Bot> A web based proxy meant to request pages using a Google or Yahoo spider's user agent string.

Firefox 3 Browse On A Diet

Firefox 3 puts a nice effort into further reducing memory consumption. Initial testing of Firefox 3 Beta 4 shows a dramatic change. In the mist of Internet Explorer 8's less than fantastic standards progress, along with rumors of the IE8 beta being horribly buggy, Firefox's competitive outlook seems good.




Memory change highlights:

• Reduced memory fragmentation
• Cycle collector
• Tuned Caches
• Image data storage adjustment
• Leak cleanups

<Source: Firefox 3 Memory Useage>