Cyberoam updates UTM certs to avoid traffic snooping

Share this article:

Security vendor Cyberoam has issued a hotfix for an interception vulnerability it downplayed this week. 

The update this week replaces generic certificates in Cyberoam Unified Threat Management (UTM) devices with unique ones.This squashes the possibility that the deep packet inspection (DPI) modules could intercept traffic from users assigned to different Cyberoam UTM boxes.

The update comes after a commenter to a blog post over the weekend published the default private key that was being used across Cyberoam's UTM devices.

Last month, Tor Project security researcher Runa Sandvik and OpenSSL's Ben Laurie discovered that the units relied on shared certificates that users must accept to have their encrypted traffic scanned, ostensibly for security threats.

Users accepting the certificates could be scanned by any Cyberoam DPI unit, the researchers found.

Cyberoam had refuted the allegations, along with suggestions by the researchers that private keys could be extracted from the devices.

"Cyberoam UTM either accepts or rejects, but does not store HTTPS Deep Scan Inspection data, as processing is done in real-time," the company said on its blog. "The possibility of data interception between any two Cyberoam appliances is hence nullified."

The fix generates a positive alert when it has been successfully applied.

This article originally appeared at SCMagazine.com.au

Share this article:

Sign up to our newsletters

More in News

Brazilian president signs internet 'Bill of Rights' into law

Brazilian president signs internet 'Bill of Rights' into ...

President Dilma Rousseff signed the legislation on Wednesday at the NetMundial conference in Sao Paulo.

Android trojan sends premium SMS messages, targets U.S. users for first time

Android trojan sends premium SMS messages, targets U.S. ...

An SMS trojan for Android, known as FakeInst, has been observed sending premium SMS messages to users all over the world, including, for the first time, the United States.

Report: DDoS up in Q4 2013, vulnerability scanners leveraged to exploit sites

Report: DDoS up in Q4 2013, vulnerability scanners ...

Researchers observed 346 DDoS attacks in the final quarter of 2013 and attackers used Vega and Skipfish vulnerability scanners to exploit web flaws at financial companies.