a report from Washington Post Google Chrome, Safari, Firefox, and some root certificate authorities used by tech companies that have links to US intelligence. The firm, referred to as Trustcore, acts as a root certificate authority to verify the credibility of Internet sites – and while the report found no concrete evidence of wrongdoing, it raised important questions about the firm’s credibility. .
root certificate authority Every website shields against counterfeiting and attacks. Since root certificate authorities also have the flexibility to grant certificates to others, this raises some issues when associated with authority surveillance or malware attempts, as it calls all certification systems in query.
Post Provides significant proof that, at least, TrustCore is associated with more than easy authentication. Trustcore’s Panamanian registration offers significant overlap with that of an Arizona-based spyware and adware firm related to data packet forensics, along with a “similar slate of officers, agents, and partners” shared between the 2 corporations. Packet Forensics, a widely known surveillance contractor, has reportedly offered communications interception companies to US authorities for more than 10 years.
Another partner of Trustcore is linked, as it seems, to Raymond Soulino, a spokesman for Packet Forensics. One wired Article Since 2010. Saulino pops up once again as a liaison to Global Resource Systems, an organization that manages more than 175 million IP addresses for the US Department of Defense. It is still unclear why the Pentagon transferred these IP addresses to the company, although the Pentagon advised Post At the time it was part of a “pilot effort” to “identify potential vulnerabilities” and “prevent unauthorized use of the DoD IP address space”.
The result raises real issues that TrustCore could have misused its energy as a certificate authority for additional US surveillance operations. Cybersecurity researchers Joel Reardon of the University of Calgary and Serge Egelman of the University of California at Berkeley advise Post They envision that TrustCore can use its potential “against high-value targets within short windows of time”.
According to Post, Trustcore is also associated with a Panamanian company called Measurement Systems. it is the same agency He wall street journal informed of Earlier this year it was paying builders to include a string of its code in separate apps to take in the data. The spyware and adware – which was present in a Muslim prayer app, a Velocity anti-detection app, a QR code reader, and others – recorded customers’ cellphone numbers, electronic mail addresses, and locations. Google has removed these apps from the Play Store.
Reardon and Egelman also found that supposedly one of TrustCor’s products, an encrypted messenger called MsgSafe.io, isn’t actually encrypted and lets MsgSafe learn any message sent by the app. When Post Conceived as the physical handle of Trustcore, it was directed to a UPS store in Toronto. The outlet also found that the e-mail contact type on its website did not work, and that its Panama-based phone number had been disconnected.
TrustCore can hold fully authenticated web sites (and lets others authenticate them nicely) because browsers such as Chrome, Safari, and Firefox accept the company as the root certificate authority. famous as Post, cyber security researchers informed Google, Apple and Mozilla about their findings, but again didn’t hear much. The companies also did not respond immediately ledgeComment request.
