MI5 stinks up website with dead SSL certificate
Secret policeman's balls-up
Regcast training : Hyper-V 3.0, VM high availability and disaster recovery
Blighty's intelligence agency MI5 forgot to replace the expired digital certificate for its website over the weekend.
The schoolboy error meant anybody trying to securely access the Security Service's site - perhaps to report suspected terrorist activity - would have been warned by their browser that the connection was untrusted. Communications would have still been encrypted if surfers chose to proceed regardless of the alert.
The digital paperwork expired on Sunday, 15 April, and a new one was installed on Monday morning. The replacement certificate was issued on 25 March and expires on 27 March 2018, so the problem was sparked by a failure to install the new cert rather than late payment for a renewal. Both the old and new credentials were issued by VeriSign.
Spook-watching Spyblog points out that the glitch was particularly embarrassing for MI5 because its www.mi5.gov.uk web server is configured to be accessible only over a secure connection.
"Since the MI5 website redirects to an SSL/TLS HTTPS-only version, they have effectively created a Denial of Service attack on themselves," Spyblog notes.
"'This connection is untrusted' web browser warnings do not give the impression of professional competence and respect for internet confidentiality, which potential users of their SSL/TLS encrypted 'Reporting suspected threats' web form should expect, and upon which their lives and the lives of potential British targets may depend on." ®
COMMENTS
"Since the MI5 website redirects to an SSL/TLS HTTPS-only version, they have effectively created a Denial of Service attack on themselves,"
They better bloody arrest themselves then and do some self waterboarding (instructions are available on certain adult websites) and then ask the US if they can be extradited and sent to gitmo.
Theirs is the orange boilersuit.
Ahh that's it
MI5 are using the same Calendar software as The Register. Clearly it doesn't handle leap years.
I reckon it's a trick.
Anyone who clicks through is automatically deemed too stupid to have a job.
IT infrastructure monitoring strategies
Agentless Backup is Not a Myth
Top 10 SIEM implementer’s checklist
Steps to Take Before Choosing a Business Continuity Partner
Requirements Checklist for Choosing a Cloud Backup and Recovery Service Provider
