This week Mozilla, Microsoft and Google all updated their browser blacklists to include a list of fraudulent SSL certificates issued for the following URLs:
mail.google.com
www.google.com
login.live.com
addons.mozilla.org
login.skype.com
login.yahoo.com

These SSL certificates were issued by a Registration Authority (RA) affiliated with (and trusted by) Comodo, which claims that access to the RA was compromised and a user account was breached. They claim that this RA account was fraudulently used to issue 9 SSL certificates for the URLs above. They also claim that the attack originated from Iran.

Although these fraudulent certificates were revoked, many end users were still exposed to risk. Why? Because the technology that make sure revoked certificates are not mistakenly validated are either turned-off or entirely missing in some users' browsers. Even if the...

In the wake of Ashton Kuchur's recent Twitter account takeover and calls for consistent SSL protection on social media sites, Twitter is now offering an always-on SSL option.

For the past seven years or so we've seen a common criminal practice of creating just-in-time phishing scams around breaking news or other current events. These scams consistently appear for predictable events such as tax time or even March Madness, but they also arrive very quickly when high profile natural disasters occur. Dating back at least as far as the Katrina/Rita disaster (and occurring as recently as February's earthquake in Christchurch, New Zealand), these attacks seek to prey on concerned well wishers trying to donate money to aid disaster relief. The good news is that public awareness of this attack vector continues...

Less than a week after New York Senator Charles Schumer called out Twitter by name for incomplete SSL implementation (along with Yahoo and Amazon) the popular social networking site finds itself in the SSL media crosshairs once again. Specifically, Ashton Kutcher had his Twitter account taken over. The thief tweeted a pair of messages, which were

Ashton, you've been Punk'd

and then

This account is not secure. Dude, where's my SSL?

While it's to Twitter's discredit that such a high profile service hasn't even secured its login pages at this late date, unfortunately Twitter is not alone. A quick look around the web...