iTnews

Cyberoam generates fix for 'nullified' vulnerability

By Darren Pauli on Jul 11, 2012 11:43AM
Cyberoam generates fix for 'nullified' vulnerability

Generates unique certificates.

Security vendor Cyberoam has issued a hotfix for a interception vulnerability it downplayed this week. 

The fix replaces generic certificates within Cyberoam Unified Threat Management (UTM) devices with unique ones.This squashes the possibility that the Deep Packet Inspection (DPI) modules could intercept traffic from users assigned to different Cyberoam UTM boxes.

Tor security researcher Runa Sandvik and OpenDNS’ Ben Laurie discovered the that units used shared certificates which users must accept to have their encrypted traffic scanned, ostensibly for security threats.

Users accepting the certificates could be scanned by any Cyberoam DPI unit, researchers said.

Cyberoam refuted the allegations along with suggestions by the researchers that private keys could be extracted from the devices.

"Cyberoam UTM either accepts or rejects, but does not store HTTPS Deep Scan Inspection data, as processing is done in real-time. The possibility of data interception between any two Cyberoam appliances is hence nullified," the company said on its blog.

“.. theoretically it is possible to decrypt SSL data using a conned private key. Cyberoam UTM does not allow import or export of the foresaid private key used for the SSL-Bridging technology.”

The fix generates a positive alert when it has been successfully applied.

Got a news tip for our journalists? Share it with us anonymously here.

Copyright © SC Magazine, Australia

Tags:
cyberoamdeepinspectioninterceptionpacketsecuritytortorprojectutm

Partner Content

Alienated from your own data? You’re not alone
Promoted Content Alienated from your own data? You’re not alone
Security "mindset shift" needed to protect organisations
Promoted Content Security "mindset shift" needed to protect organisations
Top 5 Benefits of Managed IT Services
Promoted Content Top 5 Benefits of Managed IT Services
5 essential digital transformation ideas
Promoted Content 5 essential digital transformation ideas

Sponsored Whitepapers

Planning before the breach: You can’t protect what you can’t see
Planning before the breach: You can’t protect what you can’t see
Beyond FTP: Securing and Managing File Transfers
Beyond FTP: Securing and Managing File Transfers
NextGen Security Operations: A Roadmap for the Future
NextGen Security Operations: A Roadmap for the Future
Video: Watch Juniper talk about its Aston Martin partnership
Video: Watch Juniper talk about its Aston Martin partnership
Don’t pay the ransom: A three-step guide to ransomware protection
Don’t pay the ransom: A three-step guide to ransomware protection

Events

  • iTnews Benchmark Awards 2022 - Finalist Showcase
  • 11th Annual Fraud Prevention Summit 2022
  • IoT Impact Conference
  • Cyber Security for Government Summit
By Darren Pauli
Jul 11 2012
11:43AM
0 Comments

Related Articles

  • Victorians lost $31.9 million to business email compromise in 2021
  • Ombudsman says agencies still break data interception laws
  • Home Affairs boss says big tech is bigger surveillance threat than government
  • Russia ratchets up internet control by blocking Tor
Share on Twitter Share on Facebook Share on LinkedIn Share on Whatsapp Email A Friend

Most Read Articles

NSW digital driver's licences 'easily forgeable'

NSW digital driver's licences 'easily forgeable'

NBN Co's 250Mbps and gigabit growth is finally clear

NBN Co's 250Mbps and gigabit growth is finally clear

Kmart Australia re-platforms ecommerce site to AWS

Kmart Australia re-platforms ecommerce site to AWS

NBN Co sizes up six-figure customer exodus a year to fixed wireless

NBN Co sizes up six-figure customer exodus a year to fixed wireless

Digital Nation

Why do DeFi and DAOs matter to business?
Why do DeFi and DAOs matter to business?
CTO Juergen Mueller offers a glimpse into SAP's metaverse play
CTO Juergen Mueller offers a glimpse into SAP's metaverse play
Lendlease launches its own metaverse in Milan
Lendlease launches its own metaverse in Milan
COVER STORY: Data and IoT set digital agriculture on a sustainable future
COVER STORY: Data and IoT set digital agriculture on a sustainable future
COVER STORY: A Year in the Metaverse
COVER STORY: A Year in the Metaverse
All rights reserved. This material may not be published, broadcast, rewritten or redistributed in any form without prior authorisation.
Your use of this website constitutes acceptance of nextmedia's Privacy Policy and Terms & Conditions.