InfoSecBulletin Cybersecurity for mankind
Starting November 1, 2024, Google will block websites that use certificates from Entrust. Google made this decision because Entrust has not been able to handle security issues promptly and has not complied with their requirements.
“Over the past several years, publicly disclosed incident reports highlighted a pattern of concerning behaviors by Entrust that fall short of the above expectations, and has eroded confidence in their competence, reliability, and integrity as a publicly-trusted [certificate authority] owner,” Google’s Chrome security team said.
PoC Exploited Released for Oracle Weblogic Server Vul
Microsoft warn dev urgently to update .NET installer link
Look back; The Worst Hacks of 2024
HIPAA to be updated with new cybersecurity regulations, White House
New NGate Trojan Drains Bank Accounts via ATMs
CPE Seminar Held at ISACA Dhaka Chapter Office Premises
Update Immediately
Palo Alto Releases Patch for PAN-OS DoS Flaw
Cyberattack Hit Japan Airlines Systems, delaying flights
Hacker reportedly leak Indonesia Gov.t 82 GB data
BCSI officially announce National Vulnerability Disclosure Program (NVDP)
The tech giant announced that it will no longer trust TLS server authentication certificates from Entrust in Chrome browser versions 127 and higher by default. However, Chrome users and enterprise customers can override these settings if they want to.
Google stated that certificate authorities have an important role in ensuring secure connections between browsers and websites. They also criticized Entrust for not providing incident reports and failing to meet improvement commitments, which puts the internet at risk.
Blocking will occur on Windows, macOS, ChromeOS, Android, and Linux. However, Chrome for iOS and iPadOSThe blocking action will affect Windows, macOS, ChromeOS, Android, and Linux versions of the browser. However, Chrome for iOS and iPadOS will not be affected because of Apple’s policies that prevent the use of the Chrome Root Store.
Users visiting a website with a certificate from Entrust or AffirmTrust will see a warning message about their connection not being secure or private.
Website operators need to switch to a trusted certificate authority by October 31, 2024 to avoid problems. Entrust’s website says that their solutions are trusted by big companies like Microsoft, Mastercard, VISA, and VMware.
“While website operators could delay the impact of blocking action by choosing to collect and install a new TLS certificate issued from Entrust before Chrome’s blocking action begins on November 1, 2024, website operators will inevitably need to collect and install a new TLS certificate from one of the many other CAs included in the Chrome Root Store,” Google said.
