Another month has flown by, and we’re here to recap what happened in terms of online and digital security! This time, we’re looking back at what happened in July in the hopes that it will lead to a safer and more-informed summer for us all. Read on to see what stories we thought were most important over the past four weeks.
Code Signing as a Service with eSigner
Need an overview of what SSL.com offers in terms of code signing, including our new eSigner cloud signing service? Check out the new article by Giannis Naziridis, eSigner: Code Signing as a Service, which does just that. In particular, the article highlights the advantages of eSigner for developers who would like to be able to sign code from any internet-connected computer without requiring USB tokens, HSMs, or specialized knowledge of PKI. eSigner also lets developers conveniently share code signing certificates with team members.
[su_note class=”info”]SSL.com’s Takeaway: We hope our new article is helpful for you when making decisions about code signing technology. If you’re ready to try eSigner, pricing for a range of service tiers is available on SSL.com’s main eSigner page.[/su_note]
Firefox Rolling out DoH-by-Default in Canada
Early in July, the Mozilla blog announced that Firefox will soon be extending default DNS-over-HTTPS to Canadian users. The browser will partner with the Canadian Internet Registration Authority to ultimately reach a goal of DoH as a default for all Canadian Firefox users.
As we’ve written before, the move to DoH as a default is gaining steam. Firefox adopted it for US users in February 2020, and in June 2020 Comcast joined the Mozilla initiative to embrace the standard. From the blog:
Since 2018, Mozilla, CIRA, and other industry stakeholders have been working to develop, standardize, and deploy a technology called DNS over HTTPS (or DoH). DoH helps to protect browsing activity from interception, manipulation, and collection in the middle of the network by encrypting the DNS data.
As the blog also notes, encrypting data with DoH is only a first step. Yes, DoH encrypts DNS information and prevents spying on what websites people are visiting, but Mozilla encourages companies that handle DNS data to follow rules like the ones laid out in its Trusted Recursive Resolver program.
[su_note class=”info”]SSL.com’s takeaway: We think the continued closing of the unencrypted DNS privacy loophole is a good thing, and applaud this step to expand DNS over HTTPS as a browser default.[/su_note]
Chrome 92 Improves Its Phishing Detection
The Chromium Blog brings word that phishing detection by Chrome is now faster and more efficient than ever. That does sound like a typical industry blog, granted, but the reason why the browser’s phishing detection has improved is pretty interesting. Chrome 92 is now quickly analyzing site color schemes to match known phishing sites, speeding detection by a factor of 50.
The blog also notes that, in addition to faster speeds, the process used to detect phish-y sites has gotten more efficient. Due to privacy concerns, the calculations are done on users’ machines. Chrome’s improvements are good news for laptop batteries, with an estimated reduction of 1.2% of of the total CPU time used by the browser’s rendering and utility processes.
[su_note class=”info”]SSL.com’s takeaway: We applaud Google’s efforts to protect Chrome users from phishing. For more information on what you can do to avoid getting phished and how digital certificates from SSL.com can help, please read Protect Yourself From Phishing.[/su_note]
Microsoft: New SolarWinds Attacker Targets Consumer Routers
A new attack on the embattled SolarWinds has recently been attributed to a Chinese group by Microsoft, which posted details of the attack. Simon Sharwood of The Register does an admirable job of breaking down the situation. In their report, Microsoft notes that the group responsible for the attack, which allowed attackers to run code, install programs and change data on targets “has been observed using commercial VPN solutions and compromised consumer routers in their attacker infrastructure.” The Register article goes on:
The mention of consumer routers is notable, as vendors of such devices are often unhelpfully relaxed about security and seldom make their machines easy to upgrade or advise when an update is necessary. ISPs, which often provide such devices to users, also seldom offer update advice.
While there are a lot of details to the attack, we agree that this is notable. Routers and the Internet of Things in general have increasingly become an entry point for bad guys into everything from home systems to giant companies.
[su_note class=”info”]SSL.com’s takeaway: We’ve discussed the need for enhanced security for IoT devices like home routers many times before, and this situation drives that point home. Check out these SSL.com articles for much more information on this topic:
- SSL/TLS Automation for the Internet of Things (IoT)
- SSL/TLS Automation for the IoT with ACME
- Securing the Internet of Things (IoT) with SSL/TLS
- The IoT Cybersecurity Improvement Act of 2020, Digital Certificates, and PKI
- HIPAA-Compliant IoT Solutions
- Authenticating Users and IoT Devices with Mutual TLS
[su_note class=”info”]Document Signing and EV Code Signing certificates from SSL.com may now be enrolled in be enrolled in eSigner, SSL.com’s cloud-based code and document signing platform. For more information, please read the eSigner FAQ or click the button below for general eSigner information and pricing.
[su_button url=”https://www.stg.ssl.com/esigner/” target=”blank”]eSIGNER INFORMATION AND PRICING[/su_button]