SSL, This elepant isn't going away

[thetan]

http://www.infobytesec.com/down/isr-evi ... Readme.txt

This week i present to you a rethink of the firesheep concept, only this time an order of magnitude more horrific.

Evil grade takes the same concept employed by firesheep, which is snooping on _unencrypted_ and _unauthenticated_ connections adds a little bit of DNS spoofing in the mix and installs backdoors on victims system's that attempt to upgrade a program that doesn't use an _authenticated_ connection.

Had these vulnerable programs pulled upgrades over SSL/TLS in a strict manner, evilgrade would be powerless over them.

Hopefully this will be another harsh lesson for software engineers to stop ignoring the elephant in the room.

[alltheprettyhorses]

Hmmm, the more exploits against this vulnerability that come out, the more likely it is to become common practice to ostracise the proverbial elephant.

[centip3de]

I have 10 of those programs....... *uninstalls* *shifty eyes*