BACKGROUND:
The NSA is warning organizations to avoid using wildcard digital encryption certificates in order to minimize the risk from a new form of TLS traffic decryption attacks, dubbed “ALPACA.”
This attack, discovered in June, allows threat actors to confuse machine identities that run multiple protocols and trick servers to respond to encrypted HTTPS requests through unencrypted protocols. These unencrypted responses offer a means for cybercriminals to steal cookies and private user data.
About the Author
The opinions expressed in this post belongs to the individual contributors and do not necessarily reflect the views of Information Security Buzz.
