Feeds

Fake certificate attack targets Facebook users in Syria

al-Assad family suspected of spying on its subjects

Next gen security for virtualised datacentres

A man-in-the-middle attack is being run against users of the secure version of Facebook in Syria, the Electronic Frontier Foundation (EFF) warns.

The semi-professional attack against the HTTPS version of the Facebook site relies on a digital certificate unsigned by any Certificate Authority and probable re-routing of traffic by the Syrian Telecom Ministry. The ongoing attack has been detected against multiple Syrian ISPs.

The EFF doesn't name the perpetrators of the attack, but the ruse bears the hallmarks of an operation by the Syrian government, which is in the midst of cracking down on a popular uprising against the autocratic rule of the al-Assad dynasty. It amounts to an unsubtle attempt to snoop on Facebook posts and updates.

The use of an unsigned certificate as part of the attack means that the certificate is treated as invalid by modern browsers, raising a security warning. Unfortunately many users ignore such warnings, which can be generated for a variety of reason, such as attempting to visit a secure site via a Wi-Fi hotspot connection that requires an initial log-in.

Surfers in Syria are advised to use either Tor or proxies outside the country in order to access Facebook. The EFF has obtained a copy of the unsigned certificate used in the ruse via contacts in Syria, which it has published in an alert here.

The Facebook fake certificate ruse follows a problem that prevented Syrian surfers from accessing the encrypted version of Hotmail. Microsoft blamed a bug for what it characterised as a glitch, which it said had been limited to first-time users of the encrypted Hotmail who signed in from several countries. Webmail users in the Bahamas, Cayman Islands, and Fiji were also affected by the snafu. ®

The essential guide to IT transformation

More from The Register

next story
Goog says patch⁵⁰ your Chrome
64-bit browser loads cat vids FIFTEEN PERCENT faster!
Chinese hackers spied on investigators of Flight MH370 - report
Classified data on flight's disappearance pinched
NIST to sysadmins: clean up your SSH mess
Too many keys, too badly managed
Scratched PC-dispatch patch patched, hatched in batch rematch
Windows security update fixed after triggering blue screens (and screams) of death
Researchers camouflage haxxor traps with fake application traffic
Honeypots sweetened to resemble actual workloads, complete with 'secure' logins
prev story

Whitepapers

Top 10 endpoint backup mistakes
Avoid the ten endpoint backup mistakes to ensure that your critical corporate data is protected and end user productivity is improved.
Implementing global e-invoicing with guaranteed legal certainty
Explaining the role local tax compliance plays in successful supply chain management and e-business and how leading global brands are addressing this.
Backing up distributed data
Eliminating the redundant use of bandwidth and storage capacity and application consolidation in the modern data center.
The essential guide to IT transformation
ServiceNow discusses three IT transformations that can help CIOs automate IT services to transform IT and the enterprise
Next gen security for virtualised datacentres
Legacy security solutions are inefficient due to the architectural differences between physical and virtual environments.