Presented at
DEF CON 23 (2015),
Aug. 9, 2015, 11 a.m.
(60 minutes)
The security of SSL/TLS is built on a rickety scaffolding of trust. At the core of this system is an ever growing number of Certificate Authorities that most people (and software) take for granted. Recent attacks have exploited this inherent trust to covertly intercept, monitor and manipulate supposedly secure communications. These types of attack endanger everyone, especially when they remain undetected. Unfortunately, there are few tools that non-technical humans can use to verify that their HTTPS traffic is actually secure. We will present our research into the technical and political problems underlying SSL/TLS. We will also demonstrate a tool, currently called "Canary", that will allow all types users to validate the digital certificates presented by services on the Internet.
Presenters:
-
Jeff Thomas / xaphan
- Senior Cyber Security Penetration Testing Specialist
as Jeff Thomas (xaphan)
xaphan is a "Senior Cyber Security Penetration Testing Specialist" for a happy, non-threatening US government agency. He has been a penetration tester for 17 years, but maintains his sanity with a variety of distractions. He is the author of several ancient and obsolete security tools and the creator of DEFCOIN.
Twitter: @slugbait
-
Rob Bathurst / Evilrob
- Security Engineer and Penetration Tester
as Rob Bathurst (evilrob)
Evilrob is a Security Engineer and Penetration Tester with over 14 years of experience with large network architecture and engineering. His current focus is on network security architecture, tool development, and high-assurance encryption devices. He currently spends his days contemplating new and exciting ways to do terrible things to all manner of healthcare related systems in the name of safety.
Twitter: @knomes
Links:
Similar Presentations: