Computer Security Blog.

16 Haziran 2015 Salı

10 tips to computer security nr1

Computers can be enormous timesavers and powerful financial tools. Using budget tracking software, paying bills online and buying items more cheaply from wholesale or auction sites can make a lot of sense. Secure your ID on your PC Using passwords and profiles Getting your guard up Upping the anti with software Running scans to stay current Taking wireless precautions Pumping up passwords Doubting downloads Avoiding public computers Watching smart phones and PDAs Scrubbing files But before you load up your computer with sensitive information about yourself, you'll want to take the necessary steps to ensure your personal finances stay personal. Here's how to keep your computer on lockdown and off limits to identity thieves. 1. Use passwords for protection You wouldn't leave sensitive documents laying out for prying eyes; likewise, you need to put away the information stored on your computer in a safe place: locked behind a password in your own user account. Even if you are a true Luddite and never intend to go online, you'll still want to password protect your computer. That's because if you have a snoopy houseguest or if a thief picks up your laptop, they could get at your information as you sleep if it's not password protected. Set up a separate user account for others to surf on so you keep your sensitive information private. HOW TO: For Windows-based machines, go into the control panel, choose user accounts and follow the instructions. Mac users must create a password upon using the computer for the first time and they can change their password settings by going into system preferences. There they can disable automatic login. (If you get stuck, ask a trusted techie for assistance. That goes for all these tips.) 2. Get your guard up Before merging with the information superhighway, you're going to want to make sure that all the existing security settings your computer comes with are turned on. If you want to go out and buy added protection later, that's great. Just make sure you have basic protection enabled before going online. First, fire up the firewall. Your computer should come with a firewall, or perhaps a software package came bundled with your purchase that includes a firewall. It's basically a set of programs that work together to enforce the safety rules you outline when you choose a security level. The firewall is the gatekeeper for Internet activity. Read more: http://www.bankrate.com/finance/financial-literacy/10-tips-to-computer-security-1.aspx#ixzz3dDLF7zjt Follow us: @Bankrate on Twitter | Bankrate on Facebook

10 Nisan 2015 Cuma

Compliance Mindset Can Lead to Epic Security Fail

There have been abundant warnings that compliance with government regulations alone would not be adequate to protect companies from the kinds of cyberthreats the world faces today. However, Premera learned that lesson the hard way. Auditors with the U.S. Office of Personal Management in January 2014 recommended that Premera address two areas of system administration: more timely installation of software patches and upgrades; and creation of configuration baselines so it could effectively audit its server and database security settings. However, those weren't very serious deficiencies in the minds of the auditors, who wrote in their final report released in November, that "nothing came to our attention that caused us to believe that Premera is not in compliance with the HIPAA security, privacy, and national provider identifier regulations." The company was breached in May 2014. Although that was six months before the feds released their final audit report, Premera didn't discover the breach until January 2015. Common Problems Granted, the OPM's audit was a general one -- one designed to audit information systems related only to the claims processing applications used at Premera -- and not as rigorous as those conducted for compliance with HIPAA security and privacy regulations by the U.S. Office of Civil Rights. "The scope and depth of the OPM audit was likely just a subset of what would have been covered by a true HIPAA audit conducted by OCR," said Ulf Mattsson, CTO of Protegrity. "Based on the information provided in the audit report, there's no way to know for sure how Premera would have performed if it had been audited by OCR," he told TechNewsWorld. "The problems cited by the audit are probably pretty common to all organizations. While fixing those problems can improve an organization's security posture slightly, by no means were they likely the cause of the massive data breach at Premera," Mattsson said. "The storing of sensitive data without being encrypted is the more likely culprit," he added. Checkbox Security It's unlikely that even a rigorous audit would have deterred Premera's data thieves. "Since HIPAA does not require companies to encrypt their data at rest, even passing a true HIPAA audit by OCR may not have prevented the Premera breach," Mattsson said. Although compliance rules are supposed to set minimum standards for protecting data, many companies treat them as maximum benchmarks. "Cases like Premera and thousands of others are proof that if you follow compliance -- the checkbox approach to security -- it doesn't mean you're more secure," said Torsten George, vice president for marketing at Agiliance. "You can schedule an audit, but you can't schedule a cyberattack," he told TechNewsWorld. "You have to change your way of thinking. You have get away from these three-to-six-month sprints to get to compliance and then forget about it," George said. "Security needs to be part of your day-to-day operations," he added, "not just something you do to get through an audit review." Antiquated Thinking Healthcare security audits have some fundamental problems. "HIPAA is focused on prevention of threats," said Mike Davis, CTO of CounterTack. "As we all know, prevention doesn't always work. Hackers still get in," he told TechNewsWorld. "There's very little in HIPAA that requires healthcare institutions to detect threats," Davis added. For example, HIPAA requires access to patient records be restricted, but it doesn't require that access to the records be monitored. "You lock down the users, so only Bob can access patient information, but if an attacker takes over Bob's account, he has access to the patient information and you'd never know," he explained. The standards used by HIPAA are outdated, maintained Tom Kellermann, chief cybersecurity officer for Trend Micro. "They're based on perimeter defense, and they're over reliant on encryption of data," he told TechNewsWorld. "They focus on threats relevant 10 years ago," Kellermann continued. "The threats today are a thousand times more sophisticated."

CAPTCHAs May Do More Harm Than Good

CAPTCHA -- Completely Automated Public Turing Test To Tell Computers and Humans Apart -- was created to foil bots attempting to mass-create accounts at websites. Once created, those accounts could be exploited by online lowlifes for malicious ends, such as spewing spam. However there are signs that the technology that uses distressed letters to weed out machines from humans may have outlived its usefulness. When users are presented with a CAPTCHA, they are 12 percent less likely, on average, to continue with what they came to do at the website, according to a Distil Networks study released earlier this month. That number is even worse for mobile users, who abandon their intended activity 27 percent of the time they're confronted with a CAPTCHA, the study suggests. "If it causes too much friction for a checkout or a transaction, it could cost a website real dollars and cents or users," Distil CEO and cofounder Rami Essaid told TechNewsWorld. Better Bots Distil got the idea for the CAPTCHA study from one of its customers. "They were trying to solve a fraud problem," Essaid said. "When they put in their CAPTCHA, it dramatically decreased their conversions by over 20 percent." So Distil decided to study the problem. "We wanted to see if that was unique to that company or if people were annoyed by CAPTCHAs to the point that they abandon any interaction that they're doing," Essaid said. "The results shocked me. I didn't think they'd be as dramatic as they were." The wide gap between desktop and mobile abandonment is largely a usability issue, he said. "CAPTCHAs were created for desktops. We've never seen one fully designed for mobile, and that impacts users much more," Essaid explained. The kicker to CAPTCHAs is that their purpose -- to block bots -- has become problematic. "Bots have evolved to a point where they can solve the CAPTCHAs," Essaid pointed out. "CAPTCHAs can stop most bots, but the worst bots know how to get past CAPTCHA." Bad Cert Microsoft issued a security advisory last week alerting Windows users that a rogue certificate had been issued that could be used to spoof the company's Live services. "Microsoft is aware of an improperly issued SSL certificate for the domain 'live.fi' that could be used in attempts to spoof content, perform phishing attacks, or perform man-in-the-middle attacks," the advisory reads. "It cannot be used to issue other certificates, impersonate other domains, or sign code," it continues. "This issue affects all supported releases of Microsoft Windows. Microsoft is not currently aware of attacks related to this issue." Certificates increasingly have become targets for cybercriminals, noted Kevin Bocek, vice president for security strategy and threat intelligence at Venafi. "Bad guys are not only trying to steal certificates, but use fraud to obtain them, too," he told TechNewsWorld. "There are over 200 public Certificate Authorities trusted around the world," he explained, "and at any one time, any could be attacked to obtain a valid certificate." Microsoft has taken actions to thwart anyone trying to use the illicit cert, but those measures only work on its products. Since the cert will work in other products, it's up to maker of those products to update them to block recognition of the cert. Mobile FREAK-out Earlier this month, researchers discovered a vulnerability in SSL implementations called "FREAK." It allows an attacker to force SSL to stop using 128-bit encryption and start using 40-bit encryption, which can be cracked in a matter of hours using commodity computers or readily available cloud computing resources. Most of the attention on FREAK has been focused on its impact on browser communication, but last week, researchers at FireEye found a substantial number of mobile apps are vulnerable to the SSL flaw. After scanning 10,985 popular Google Play Android apps with more than 1 million downloads each, the researchers found 11.2 percent of them vulnerable to a FREAK attack. A similar analysis of 14,079 iOS apps revealed that 5.5 percent of them vulnerable to FREAK. "This is a problem of a client or server being able to say, 'I don't want to do this really secure thing, let's do something less secure,'" said Jared DeMott, principal security researcher at Bromium. While that sounds serious, exploiting the flaw isn't a piece of cake. "You need to be in a position to sit on the traffic, and you still have to decrypt the downloaded encryption, even if it isn't very good," he told TechNewsWorld. "That's the kind of thing you'd expect to see organized players doing -- a nation state or big crime ring," he said. "I don't know if it's going to have a big impact on individual consumers."

26 Şubat 2015 Perşembe

Windows 8 Security: What's New?

By Fahmida Y. Rashid
October 30, 2012
19 Comments

While the most obvious change in Windows 8 is the interface, Microsoft has made plenty of under-the-hood changes too, including some significant security updates.

Windows 8 Security: What's New?
Alternate Passwords

Microsoft has been adding and improving advanced security features and capabilities in its Windows operating system and other applications over the past few years. Each iteration of Windows has featured improved security—necessary to withstand the constant barrage of attacks—and Windows 8 coming is no exception.

In Windows 8, Microsoft expanded its support for embedded hardware security, bundling a full-blown security suite into the operating system, introducing secure boot and signed applications, and enableing alternate authentication schemes, to name a few. Some of the latest innovations are aimed specifically at enterprise users and meet business needs, but there are plenty of improvements that end-users will notice right off the bat, too.

"After reviewing the layers of technologies used by Microsoft to protect Windows 8, it is our opinion that it is the most secure version of Microsoft Windows to date," Aryeh Goretsky, a distinguished researcher at ESET, wrote in a whitepaper examining security technologies in Windows 8 released earlier this month. Microsoft is offering three main versions of the new operating system. Windows 8 is the "home" edition, Windows 8 Pro includes features for enterprises, such as support for Hyper-V, BitLocker, a virtual private network client and group policy support, and Windows RT for ARM-powered devices.

Secure Boot
Microsoft designed Secure Boot to protect the computer from low-level exploits and rootkits and bootloaders. A security process shared between the operating system and Unified Extensible Firmware Interface (UEFI, replacing the BIOS), Secure Boot requires all the applications that are running during the booting process to be pre-signed with valid digital certificates. This way, the system knows all the files being loaded before Windows 8 loads and gets to the login screen have not been tampered with.

If a bootloader has infected your computer and it tries to load during the boot-up sequence, Secure Boot will be able to undo all the changes and thwart the attack. Having Secure Boot means it is that much harder for attackers to try to compromise the start up sequence.

While PC makers have to have Secure Boot enabled in the UEFI firmware by default, if they want to be able to slap the Windows logo outside the box, the feature can be disabled within the UEFI interface. Anyone who wants to install a non-Windows operating system on Windows 8-certified hardware would first have to manually disable SecureBoot.

Windows Defender

As PCMag's lead analyst for security Neil Rubenking noted a few weeks ago, Microsoft decided to release Windows 8 with built-in antivirus. This is a much more robust application than Microsoft Security Essentials, the free anti-malware software that users could download and install manually in previous versions.

Windows Defender (Microsoft repurposed the name for the anti-malware product) is enabled by default, right out of the box, which means users have some form of security protection as soon as they turn on the machine. While it can't be uninstalled, it can be disabled if the user wants to install a different security product from another vendor (AV-Test has certified several as being Windows-8-ready). In fact, Windows Defender must be disabled if you want to install a third-party security suite.

Loading the AV First
Regardless of whether you are using Windows Defender or a different anti-malware product, Windows 8 has tweaked its load process so that security software runs first. Early Launch Anti-Malware (ELAM) insures that the first software driver loaded into Windows 8 is a driver from the user's anti-malware software.

In previous versions, if the malware executed and was loaded into system memory before the operating system and the antivirus, it was difficult to detect and remove. SecureBoot prevents rootkits from interfering with the OS, and ELAM ensures that pre-approved anti-malware software drivers are loaded before any other application.

Whether or not it is effective is unknown, but Goretsky noted in the whitepaper that the concept was "fundamentally sound."

SmartScreen

Originally an Internet Explorer security feature, Microsoft added SmartScreen to Windows 8. When a user downloads a program or a file from the Internet, the SmartScreen filter checks to see if other people have downloaded the same file as well. If so, there is a rating for the file based on its popularity and whether it was considered malicious. Users trying to download something with a low rating while Smart Screen is enabled will see a warning message. This can be good for detecting fake antivirus and other rogueware programs.

Since SmartScreen is now part of Windows 8, the filter will kick in regardless of what browser the user is running, not just Internet Explorer.

Welcome to Games planet for kids! We add new addicting games free games addicting games , gamesbox flash games cartoon ben10 best action ben 10 games ,bgames online games playhub free site free games ,free games web based a10 games every day a10 free games so you hopy never get bored in your a10 free time on internet huz games. We only add really popular miniclip and poptropica games from around the internet including miniclip games, free miniclip site,arcade games,barbie cooking games,decoration games,barbie games for girls,funbrain logic games, funbrain puzzle games,yepi fun games,yepi flash games,yepi online games,kizi free multiplayer games,kizi action games,kizi fighting games,agame sports games,agame sonic games,agame games, agame mario games,games for agame play your agame game today,agame more games ,sponge bob games, barbie games,bratz games,strategy games,y8 free action, y8 free adventure, y8 flash games, y8 play free, y8 driving games, y8 collection, y8 funny games, y8 online games, y8 dressup games, y8 y8 shooting games, more y8 bestest games,y8 addicting games and we will always let you play games free!We have also y3 free strategy, y3 good flash games, y3 style old games, y3 retro games category let you play 80s 90s old classic games.As we all know miniclip, Y8 friv sites. friv games for kids,gazo sites are biggest site on internet we collected highest quality friv games from friv miniclip and y8 too you may also check them friv games out.Newly we added friv zombie games please give a try them too. We have a great selection of over 1000free games to play. Feel free to bookmark our site to revisit when spend your free times with most favorite online games .WE have also language menu to select by your country flag for play your free games so you are welcome wherever on the world. Give a try to our searchbar too, we are working on new features to become the worlds unique flash games all website.

How to activate Windows Defender in Windows 8

Like every new Windows release, Windows 8 is more secure than the operating systems that came before it. That's due in large part to three major enhancements: An increased emphasis on UEFI Secure Boot optimizations, the extension of the SmartScreen Filter across the operating system, and the default inclusion of a more robust version of Windows Defender, which now protects against all kinds of malware—not just spyware.

Windows Defender's increased scope doesn't sit well with computer manufacturers, however. OEMs make beaucoup bucks by installing those trial versions of McAfee, Norton and other security suites you'll find bundled on boxed PCs. Windows Defender's default installation threatens that gravy train.

Microsoft tossed its partners a bone by allowing OEMs to deactivate Windows Defender in order to ship boxed PCs with alternative security solutions installed. That's all well and good from a "variety is the spice of life" perspective, but one side-effect that isn't so hot is what happens when you fail to register that third-party security software: Windows 8 doesn't automatically reactivate Windows Defender by default. In other words, your pretty new prepackaged PC is wide open and vulnerable to all the nasties of the 'Net.

Fortunately, activating Windows Defender is a snap. Here's how to do it.

Activate Windows Defender in Windows 8

Windows Defender isn't subtle about being deactivated.

First, head to the modern-style Start screen and type "Windows Defender" to have Windows search for the program, then click on the Windows Defender icon when it appears in the results. A Windows Defender window will appear on the classic desktop. If Microsoft's security software is disabled, you'll seen a lot of scary red tones alongside an "At risk" warning and an image of a computer screen with a big X on it. Subtle, eh?

Next, click on the Settings tab at the top of the window. Make sure "Real-time protection" is selected in the left pane, then check the box next to "Turn on real-time protection (recommended)." Finally, click Save Changes at the bottom of the Window.

You'll know it worked when the terrifying red "At risk" bar at the top of the Windows turns a much more soothing shade of green and switches to "PC Status: Protected."

Check for leaks

You're not quite done yet. Now it's time to make sure your PC is actually malware-free! Click the Update tab, then click on the big Update button in the middle of the Window to download the latest malware definitions Microsoft has on file.

Next, open the Home tab and select the "Full" radio button in the Scan Options list. All you have to do now is click Scan Now, then sit back and wait while Windows Defender checks the nooks and crannies of your PC for any hidden baddies. Grab a cup of coffee; it may take some time. While you're waiting, we recommend checking out your Windows 8 antivirus options.

Windows 8: Put its hidden security features to work!

Don't let the Windows 8 haters brainswash you: Microsoft actually introduced a few great features in its new operating system, some of which will help keep you safer from malware and other security threats. Though most of these security enhancements are active by default, you still must be proactive to get the most from them. Also, one new Windows 8 feature presents specific security concerns that must be addressed to keep your PC—and your data—as safe as possible. Let's jump in and investigate.

Buy a new PC instead of upgrading

To take full advantage of Windows 8’s new security features, your PC needs to run a new kind of boot system called Unified Extensible Firmware Interface (UEFI). This system, which replaces the archaic Basic Input/Output System (BIOS), adds many new boot features and greatly speeds the startup process.

Included in UEFI is a feature, called Secure Boot, that helps prevent unauthorized operating systems and malware from running at startup. This makes it more difficult for data thieves to use bootable discs or flash drives to access your files; it also helps keep rootkits—a form of malware that's hard to detect—from infecting your computer during bootup.

Some PC vendors included UEFI on select systems in the past, but Secure Boot requires a new version, specifically UEFI revision 2.3.1. So if your system originally came with Windows XP, Windows Vista or Windows 7, it likely doesn’t include UEFI. And if it does include UEFI, it’s probably an earlier version that doesn’t support Secure Boot.

Though some PC and motherboard vendors offer upgrades to UEFI, you might want to consider buying a new PC or board that’s designed for Windows 8, as such hardware must include UEFI and have Secure Boot enabled by default.

Look for new PCs and devices that carry this logo.

If you’re technically inclined, however, you can double-check an older PC’s UEFI compatibility before you run out and buy a new system. First, try pressing the traditional BIOS or setup key (such as F2 or Delete) during booting just after you turn on the system. There, you can find your BIOS or UEFI version.

From Windows, you can type msinfo32 in the Start menu search field or the Run prompt to find the BIOS version. If it appears you have a traditional BIOS, you could check with the system or motherboard vendor to see if it's offering upgrades to UEFI. And if the UEFI version you have is older than 2.3.1, see if there are any updates for your PC.

Take precautions when using a Microsoft account

In Windows 8, you can now optionally sign into Windows with a Microsoft account using your email address. This account stores many of your personal Windows settings, preferences, and saved passwords, as well as other items like browser history, favorites, and Windows 8 apps, on Microsoft's servers. Whenever you log on to a new Windows 8 device with that Microsoft account, all your data automatically syncs to your new hardware.

You can change the sync settings via the new PC Settings app.

Although this new syncing functionality can be useful, it does pose a security risk. If malcontents get your Microsoft account password, they could log in to your account at another Windows 8 PC and access your synced data. And if you use Microsoft’s SkyDrive cloud storage service, they’ll quickly be able to access your online files.

To help prevent your Microsoft account from being hacked, use a strong password when creating your account in Windows 8. Try to make it as complex as you can with lower- and uppercase letters, numbers, and special characters, and avoid words from the dictionary. Also make sure to use a unique password. If you simply re-use the same old string that gets you into other sites and services, you're just asking for trouble. Finally, you should avoid storing any truly sensitive documents in SkyDrive.

If you already have a Microsoft (or Windows Live) account, you can use it when logging into Windows 8 instead of creating a new account. And if your existing password isn’t strong, you can always change it.

Fortunately, your saved passwords from Internet Explorer, networks, and Windows 8 apps aren’t synced to a new system until you confirm it as a “Trusted PC.” Once you sign in to a new Windows 8 system, Microsoft sends you an email and/or a text-message alert asking you to confirm it. This is a great protection mechanism, but if you’re using a Microsoft email address (Hotmail, say), or if someone knows both your Microsoft account and your other email password, he could confirm the PC he’s using as trusted and then access all your saved passwords.

To help make the process of confirming trusted PCs even more secure, use a non-Microsoft email address for your Microsoft account, and use a different password for that email account (which you should be doing anyway). Also make sure to enter your mobile number on your Microsoft account and update it when it changes. You can always add and change email addresses and mobile numbers.

Choose your antivirus program wisely

Windows Defender looks and works much like Microsoft Security Essentials.

Windows 8 comes with built-in antivirus software as part of the updated Windows Defender program. However, if your PC manufacturer included a third-party antivirus program with your computer, Windows Defender may be disabled. Either way, make sure you have some form of antivirus program installed and enabled. And if you're considering a commercial antivirus suite, compare the different security suites and choose one that offers good protection—our recent security suite roundup is a good place to start.

Bottom line

We’ve discussed some security concerns with Windows 8 and how to combat them. Remember, in order to use the new Secure Boot feature, you need to purchase a new system that is Windows 8–certified, or make sure that your current system supports it before upgrading from a previous version of Windows.

If you log in to Windows using a Microsoft account, take the extra precautions I’ve described to secure your data. Use separate and unique strong passwords for both the Microsoft account and the email account you use. Don’t store sensitive files in your SkyDrive online storage account. And keep your Microsoft account up-to-date with your mobile number.

Even though your Windows 8 PC might come with the built-in Windows Defender or a third-party antivirus program turned on, compare your options and choose one of the better antivirus programs.

31 Temmuz 2014 Perşembe

Security with HTTPS and SSL

Security with HTTPS and SSL In this document Concepts An HTTP Example Common Problems Verifying Server Certificates Unknown certificate authority Self-signed server certificate Missing intermediate certificate authority Common Problems with Hostname Verification Warnings About Using SSLSocket Directly Blacklisting Pinning Client Certificates See also Android Security Overview Permissions The Secure Sockets Layer (SSL)—now technically known as Transport Layer Security (TLS)—is a common building block for encrypted communications between clients and servers. It's possible that an application might use SSL incorrectly such that malicious entities may be able to intercept an app's data over the network. To help you ensure that this does not happen to your app, this article highlights the common pitfalls when using secure network protocols and addresses some larger concerns about using Public-Key Infrastructure (PKI). Concepts In a typical SSL usage scenario, a server is configured with a certificate containing a public key as well as a matching private key. As part of the handshake between an SSL client and server, the server proves it has the private key by signing its certificate with public-key cryptography. However, anyone can generate their own certificate and private key, so a simple handshake doesn't prove anything about the server other than that the server knows the private key that matches the public key of the certificate. One way to solve this problem is to have the client have a set of one or more certificates it trusts. If the certificate is not in the set, the server is not to be trusted. There are several downsides to this simple approach. Servers should be able to upgrade to stronger keys over time ("key rotation"), which replaces the public key in the certificate with a new one. Unfortunately, now the client app has to be updated due to what is essentially a server configuration change. This is especially problematic if the server is not under the app developer's control, for example if it is a third party web service. This approach also has issues if the app has to talk to arbitrary servers such as a web browser or email app. In order to address these downsides, servers are typically configured with certificates from well known issuers called Certificate Authorities (CAs). The host platform generally contains a list of well known CAs that it trusts. As of Android 4.2 (Jelly Bean), Android currently contains over 100 CAs that are updated in each release. Similar to a server, a CA has a certificate and a private key. When issuing a certificate for a server, the CA signs the server certificate using its private key. The client can then verify that the server has a certificate issued by a CA known to the platform. However, while solving some problems, using CAs introduces another. Because the CA issues certificates for many servers, you still need some way to make sure you are talking to the server you want. To address this, the certificate issued by the CA identifies the server either with a specific name such as gmail.com or a wildcarded set of hosts such as *.google.com. The following example will make these concepts a little more concrete. In the snippet below from a command line, the openssl tool's s_client command looks at Wikipedia's server certificate information. It specifies port 443 because that is the default for HTTPS. The command sends the output of openssl s_client to openssl x509, which formats information about certificates according to the X.509 standard. Specifically, the command asks for the subject, which contains the server name information, and the issuer, which identifies the CA. $ openssl s_client -connect wikipedia.org:443 | openssl x509 -noout -subject -issuer subject= /serialNumber=sOrr2rKpMVP70Z6E9BT5reY008SJEdYv/C=US/O=*.wikipedia.org/OU=GT03314600/OU=See www.rapidssl.com/resources/cps (c)11/OU=Domain Control Validated - RapidSSL(R)/CN=*.wikipedia.org issuer= /C=US/O=GeoTrust, Inc./CN=RapidSSL CA You can see that the certificate was issued for servers matching *.wikipedia.org by the RapidSSL CA. An HTTPS Example Assuming you have a web server with a certificate issued by a well known CA, you can make a secure request with code as simple this: URL url = new URL("https://wikipedia.org"); URLConnection urlConnection = url.openConnection(); InputStream in = urlConnection.getInputStream(); copyInputStreamToOutputStream(in, System.out); Yes, it really can be that simple. If you want to tailor the HTTP request, you can cast to an HttpURLConnection. The Android documentation for HttpURLConnection has further examples about how to deal with request and response headers, posting content, managing cookies, using proxies, caching responses, and so on. But in terms of the details for verifying certificates and hostnames, the Android framework takes care of it for you through these APIs. This is where you want to be if at all possible. That said, below are some other considerations. Common Problems Verifying Server Certificates Suppose instead of receiving the content from getInputStream(), it throws an exception: javax.net.ssl.SSLHandshakeException: java.security.cert.CertPathValidatorException: Trust anchor for certification path not found. at org.apache.harmony.xnet.provider.jsse.OpenSSLSocketImpl.startHandshake(OpenSSLSocketImpl.java:374) at libcore.net.http.HttpConnection.setupSecureSocket(HttpConnection.java:209) at libcore.net.http.HttpsURLConnectionImpl$HttpsEngine.makeSslConnection(HttpsURLConnectionImpl.java:478) at libcore.net.http.HttpsURLConnectionImpl$HttpsEngine.connect(HttpsURLConnectionImpl.java:433) at libcore.net.http.HttpEngine.sendSocketRequest(HttpEngine.java:290) at libcore.net.http.HttpEngine.sendRequest(HttpEngine.java:240) at libcore.net.http.HttpURLConnectionImpl.getResponse(HttpURLConnectionImpl.java:282) at libcore.net.http.HttpURLConnectionImpl.getInputStream(HttpURLConnectionImpl.java:177) at libcore.net.http.HttpsURLConnectionImpl.getInputStream(HttpsURLConnectionImpl.java:271) This can happen for several reasons, including: The CA that issued the server certificate was unknown The server certificate wasn't signed by a CA, but was self signed The server configuration is missing an intermediate CA The following sections discuss how to address these problems while keeping your connection to the server secure. Unknown certificate authority In this case, the SSLHandshakeException occurs because you have a CA that isn't trusted by the system. It could be because you have a certificate from a new CA that isn't yet trusted by Android or your app is running on an older version without the CA. More often a CA is unknown because it isn't a public CA, but a private one issued by an organization such as a government, corporation, or education institution for their own use. Fortunately, you can teach HttpsURLConnection to trust a specific set of CAs. The procedure can be a little convoluted, so below is an example that takes a specific CA from an InputStream, uses it to create a KeyStore, which is then used to create and initialize a TrustManager. A TrustManager is what the system uses to validate certificates from the server and—by creating one from a KeyStore with one or more CAs—those will be the only CAs trusted by that TrustManager. Given the new TrustManager, the example initializes a new SSLContext which provides an SSLSocketFactory you can use to override the default SSLSocketFactory from HttpsURLConnection. This way the connection will use your CAs for certificate validation. Here is the example in full using an organizational CA from the University of Washington: // Load CAs from an InputStream // (could be from a resource or ByteArrayInputStream or ...) CertificateFactory cf = CertificateFactory.getInstance("X.509"); // From https://www.washington.edu/itconnect/security/ca/load-der.crt InputStream caInput = new BufferedInputStream(new FileInputStream("load-der.crt")); Certificate ca; try { ca = cf.generateCertificate(caInput); System.out.println("ca=" + ((X509Certificate) ca).getSubjectDN()); } finally { caInput.close(); } // Create a KeyStore containing our trusted CAs String keyStoreType = KeyStore.getDefaultType(); KeyStore keyStore = KeyStore.getInstance(keyStoreType); keyStore.load(null, null); keyStore.setCertificateEntry("ca", ca); // Create a TrustManager that trusts the CAs in our KeyStore String tmfAlgorithm = TrustManagerFactory.getDefaultAlgorithm(); TrustManagerFactory tmf = TrustManagerFactory.getInstance(tmfAlgorithm); tmf.init(keyStore); // Create an SSLContext that uses our TrustManager SSLContext context = SSLContext.getInstance("TLS"); context.init(null, tmf.getTrustManagers(), null); // Tell the URLConnection to use a SocketFactory from our SSLContext URL url = new URL("https://certs.cac.washington.edu/CAtest/"); HttpsURLConnection urlConnection = (HttpsURLConnection)url.openConnection(); urlConnection.setSSLSocketFactory(context.getSocketFactory()); InputStream in = urlConnection.getInputStream(); copyInputStreamToOutputStream(in, System.out); With a custom TrustManager that knows about your CAs, the system is able to validate that your server certificate come from a trusted issuer. Caution: Many web sites describe a poor alternative solution which is to install a TrustManager that does nothing. If you do this you might as well not be encrypting your communication, because anyone can attack your users at a public Wi-Fi hotspot by using DNS tricks to send your users' traffic through a proxy of their own that pretends to be your server. The attacker can then record passwords and other personal data. This works because the attacker can generate a certificate and—without a TrustManager that actually validates that the certificate comes from a trusted source—your app could be talking to anyone. So don't do this, not even temporarily. You can always make your app trust the issuer of the server's certificate, so just do it. Self-signed server certificate The second case of SSLHandshakeException is due to a self-signed certificate, which means the server is behaving as its own CA. This is similar to an unknown certificate authority, so you can use the same approach from the previous section. You can create your own TrustManager, this time trusting the server certificate directly. This has all of the downsides discussed earlier of tying your app directly to a certificate, but can be done securely. However, you should be careful to make sure your self-signed certificate has a reasonably strong key. As of 2012, a 2048-bit RSA signature with an exponent of 65537 expiring yearly is acceptable. When rotating keys, you should check for recommendations from an authority (such as NIST) about what is acceptable. Missing intermediate certificate authority The third case of SSLHandshakeException occurs due to a missing intermediate CA. Most public CAs don't sign server certificates directly. Instead, they use their main CA certificate, referred to as the root CA, to sign intermediate CAs. They do this so the root CA can be stored offline to reduce risk of compromise. However, operating systems like Android typically trust only root CAs directly, which leaves a short gap of trust between the server certificate—signed by the intermediate CA—and the certificate verifier, which knows the root CA. To solve this, the server doesn't send the client only it's certificate during the SSL handshake, but a chain of certificates from the server CA through any intermediates necessary to reach a trusted root CA. To see what this looks like in practice, here's the mail.google.com certificate chain as viewed by the openssl s_client command: $ openssl s_client -connect mail.google.com:443 --- Certificate chain 0 s:/C=US/ST=California/L=Mountain View/O=Google Inc/CN=mail.google.com i:/C=ZA/O=Thawte Consulting (Pty) Ltd./CN=Thawte SGC CA 1 s:/C=ZA/O=Thawte Consulting (Pty) Ltd./CN=Thawte SGC CA i:/C=US/O=VeriSign, Inc./OU=Class 3 Public Primary Certification Authority --- This shows that the server sends a certificate for mail.google.com issued by the Thawte SGC CA, which is an intermediate CA, and a second certificate for the Thawte SGC CA issued by a Verisign CA, which is the primary CA that's trusted by Android. However, it is not uncommon to configure a server to not include the necessary intermediate CA. For example, here is a server that can cause an error in Android browsers and exceptions in Android apps: $ openssl s_client -connect egov.uscis.gov:443 --- Certificate chain 0 s:/C=US/ST=District Of Columbia/L=Washington/O=U.S. Department of Homeland Security/OU=United States Citizenship and Immigration Services/OU=Terms of use at www.verisign.com/rpa (c)05/CN=egov.uscis.gov i:/C=US/O=VeriSign, Inc./OU=VeriSign Trust Network/OU=Terms of use at https://www.verisign.com/rpa (c)10/CN=VeriSign Class 3 International Server CA - G3 --- What is interesting to note here is that visiting this server in most desktop browsers does not cause an error like a completely unknown CA or self-signed server certificate would cause. This is because most desktop browsers cache trusted intermediate CAs over time. Once a browser has visited and learned about an intermediate CA from one site, it won't need to have the intermediate CA included in the certificate chain the next time. Some sites do this intentionally for secondary web servers used to serve resources. For example, they might have their main HTML page served by a server with a full certificate chain, but have servers for resources such as images, CSS, or JavaScript not include the CA, presumably to save bandwidth. Unfortunately, sometimes these servers might be providing a web service you are trying to call from your Android app, which is not as forgiving. There are two approaches to solve this issue: Configure the server to include the intermediate CA in the server chain. Most CAs provide documentation on how to do this for all common web servers. This is the only approach if you need the site to work with default Android browsers at least through Android 4.2. Or, treat the intermediate CA like any other unknown CA, and create a TrustManager to trust it directly, as done in the previous two sections. Common Problems with Hostname Verification As mentioned at the beginning of this article, there are two key parts to verifying an SSL connection. The first is to verify the certificate is from a trusted source, which was the focus of the previous section. The focus of this section is the second part: making sure the server you are talking to presents the right certificate. When it doesn't, you'll typically see an error like this: java.io.IOException: Hostname 'example.com' was not verified at libcore.net.http.HttpConnection.verifySecureSocketHostname(HttpConnection.java:223) at libcore.net.http.HttpsURLConnectionImpl$HttpsEngine.connect(HttpsURLConnectionImpl.java:446) at libcore.net.http.HttpEngine.sendSocketRequest(HttpEngine.java:290) at libcore.net.http.HttpEngine.sendRequest(HttpEngine.java:240) at libcore.net.http.HttpURLConnectionImpl.getResponse(HttpURLConnectionImpl.java:282) at libcore.net.http.HttpURLConnectionImpl.getInputStream(HttpURLConnectionImpl.java:177) at libcore.net.http.HttpsURLConnectionImpl.getInputStream(HttpsURLConnectionImpl.java:271) One reason this can happen is due to a server configuration error. The server is configured with a certificate that does not have a subject or subject alternative name fields that match the server you are trying to reach. It is possible to have one certificate be used with many different servers. For example, looking at the google.com certificate with openssl s_client -connect google.com:443 | openssl x509 -text you can see that a subject that supports *.google.com but also subject alternative names for *.youtube.com, *.android.com, and others. The error occurs only when the server name you are connecting to isn't listed by the certificate as acceptable. Unfortunately this can happen for another reason as well: virtual hosting. When sharing a server for more than one hostname with HTTP, the web server can tell from the HTTP/1.1 request which target hostname the client is looking for. Unfortunately this is complicated with HTTPS, because the server has to know which certificate to return before it sees the HTTP request. To address this problem, newer versions of SSL, specifically TLSv.1.0 and later, support Server Name Indication (SNI), which allows the SSL client to specify the intended hostname to the server so the proper certificate can be returned. Fortunately, HttpsURLConnection supports SNI since Android 2.3. Unfortunately, Apache HTTP Client does not, which is one of the many reasons we discourage its use. One workaround if you need to support Android 2.2 (and older) or Apache HTTP Client is to set up an alternative virtual host on a unique port so that it's unambiguous which server certificate to return. The more drastic alternative is to replace HostnameVerifier with one that uses not the hostname of your virtual host, but the one returned by the server by default. Caution: Replacing HostnameVerifier can be very dangerous if the other virtual host is not under your control, because a man-in-the-middle attack could direct traffic to another server without your knowledge. If you are still sure you want to override hostname verification, here is an example that replaces the verifier for a single URLConnection with one that still verifies that the hostname is at least on expected by the app: // Create an HostnameVerifier that hardwires the expected hostname. // Note that is different than the URL's hostname: // example.com versus example.org HostnameVerifier hostnameVerifier = new HostnameVerifier() { @Override public boolean verify(String hostname, SSLSession session) { HostnameVerifier hv = HttpsURLConnection.getDefaultHostnameVerifier(); return hv.verify("example.com", session); } }; // Tell the URLConnection to use our HostnameVerifier URL url = new URL("https://example.org/"); HttpsURLConnection urlConnection = (HttpsURLConnection)url.openConnection(); urlConnection.setHostnameVerifier(hostnameVerifier); InputStream in = urlConnection.getInputStream(); copyInputStreamToOutputStream(in, System.out); But remember, if you find yourself replacing hostname verification, especially due to virtual hosting, it's still very dangerous if the other virtual host is not under your control and you should find an alternative hosting arrangement that avoids this issue. Warnings About Using SSLSocket Directly So far, the examples have focused on HTTPS using HttpsURLConnection. Sometimes apps need to use SSL separate from HTTP. For example, an email app might use SSL variants of SMTP, POP3, or IMAP. In those cases, the app would want to use SSLSocket directly, much the same way that HttpsURLConnection does internally. The techniques described so far to deal with certificate verification issues also apply to SSLSocket. In fact, when using a custom TrustManager, what is passed to HttpsURLConnection is an SSLSocketFactory. So if you need to use a custom TrustManager with an SSLSocket, follow the same steps and use that SSLSocketFactory to create your SSLSocket. Caution: SSLSocket does not perform hostname verification. It is up the your app to do its own hostname verification, preferably by calling getDefaultHostnameVerifier() with the expected hostname. Further beware that HostnameVerifier.verify() doesn't throw an exception on error but instead returns a boolean result that you must explicitly check. Here is an example showing how you can do this. It shows that when connecting to gmail.com port 443 without SNI support, you'll receive a certificate for mail.google.com. This is expected in this case, so check to make sure that the certificate is indeed for mail.google.com: // Open SSLSocket directly to gmail.com SocketFactory sf = SSLSocketFactory.getDefault(); SSLSocket socket = (SSLSocket) sf.createSocket("gmail.com", 443); HostnameVerifier hv = HttpsURLConnection.getDefaultHostnameVerifier(); SSLSession s = socket.getSession(); // Verify that the certicate hostname is for mail.google.com // This is due to lack of SNI support in the current SSLSocket. if (!hv.verify("mail.google.com", s)) { throw new SSLHandshakeException("Expected mail.google.com, " "found " + s.getPeerPrincipal()); } // At this point SSLSocket performed certificate verificaiton and // we have performed hostname verification, so it is safe to proceed. // ... use socket ... socket.close(); Blacklisting SSL relies heavily on CAs to issue certificates to only the properly verified owners of servers and domains. In rare cases, CAs are either tricked or, in the case of Comodo or DigiNotar, breached, resulting in the certificates for a hostname to be issued to someone other than the owner of the server or domain. In order to mitigate this risk, Android has the ability to blacklist certain certificates or even whole CAs. While this list was historically built into the operating system, starting in Android 4.2 this list can be remotely updated to deal with future compromises. Pinning An app can further protect itself from fraudulently issued certificates by a technique known as pinning. This is basically using the example provided in the unknown CA case above to restrict an app's trusted CAs to a small set known to be used by the app's servers. This prevents the compromise of one of the other 100+ CAs in the system from resulting in a breach of the apps secure channel. Client Certificates This article has focused on the user of SSL to secure communications with servers. SSL also supports the notion of client certificates that allow the server to validate the identity of a client. While beyond the scope of this article, the techniques involved are similar to specifying a custom TrustManager. See the discussion about creating a custom KeyManager in the documentation for HttpsURLConnection. We are recomanded publishes some of the highest quality games available online, all completely free to play. Our massive selection of games include some of the most played genres online, the most popular being racing games, puzzle games, action games, MMO games and many more, all guaranteed to keep you entertained for hours to come. y8 | agame | friv | y3 | kizi | barbie | friv | y8 | huz | y8 | ben 10 | online games | miniclip | y8 | y8 | addicting games | y3 | y8 | funbrain | agame | y8 | friv | y3 | y8 | miniclip | friv | barbie | yepi | y8 | free games |y8 | addicting games | friv | all sites guaranteed to keep you entertained for hours to come.