Akshay retweeted
eMudhra has two interesting implications for me beyond the obvious browser trust issues.
I'm excited for the opportunities to liberate closed hardware this provides. We know hardware, particularly abandoned IoT devices are unlikely to be updating their revocation lists and root CAs. This means we can potentially intercept previously encrypted comms, or sign previously protected firmware.
I'm also interested in how well the revocation works at a WiFi supplicant level. Rogue RADIUS servers (mana, wpe, eaphammer) can now use validly* signed chains for forged leafs with TLS protected EAP modes. I'm not sure how well the revocations work in that world given the difference in the CA trust model in use there.
2 days after Dussehra, we are scraping wilted Mexican marigolds off Korean cars, with Chinese LED strings still blinking on the doorway, all to honour a tradition that is 1000s of years old. Globalisation is a beautiful thing.
... Look at the questions Google's Chrome team just put to the CA behind this mess. They are clearly not happy. Not trying to pile on here but these are genuinely tough questions anyone would want answered. ...
... And about last week's fresh issue a brand new broken file nobody can explain. Which key actually signed it? Could the same problem exist elsewhere too? and why did the fixes promised last year fail to stop this from happening again? ...
Shit scared... the end game is near...
The Ministry of Information and Broadcasting has directed all private satellite TV channels to adhere strictly to the Programme Code under the Cable Television Networks Act.
The advisory stresses responsible coverage of sensitive issues, including crime, disasters and debates, and warns of strict action against violations.
This is a great writeup on the compromise....
lorbic.com/emudhra-ca-compro…
I can't wrap myself around this statement. It doesn't say whether the key was generated or imported & that distinction is everything.
Also buried in there, these weak keys passed two independent audit cycles over 18 months undetected. That's the real story. ...
A friendly reminder that this is a good way to search all the epstein world. jmail.world/photos is good for digging through all photos in a gmail style interface.
This jmail.world/ is a pretty good way to have all emails related to the epstein world in a single view... Can easily search through emails.
Looks like bosses at CERT-in should be cancelling diwali leaves for their employee... but they are instead chilling...
MAJOR DATA BREACH CLAIM - INDIA 🇮🇳
A threat actor is allegedly selling a massive dataset linked to the Rajasthan Government’s Department of Information Technology & Communication (DoIT&C).
📊 Claimed exposure:
• 5,926 mailboxes containing 8.63 million emails
• 22,686 attachments (6.63 GB)
• 783,495 unique email addresses
• 70,301 identity records
• 59,460 mobile numbers
• 69 verified credentials
• 21 VPN logins and 64 VPN certificates
• 1,065 senior officer mailboxes
⚠️ Samples reportedly include government communications, financial records, KYC documents and internal access information.
The actor claims the dataset will be sold to multiple buyers.
Attribution, authenticity and the full extent of the alleged compromise remain unverified.
#CyberSecurity #DataBreach
World over, security is an after thought.
In India, security is never a thought.
🤦♀️
