Re: Defending against malicious SSL proxy

2013-09-30 Thread Igor Bukanov
Unfortunately I cannot be more specific than to state that in Scandinavia most fraud attempts comes not directly from operators of botnets, but rather from third-parties buying their services. Those guys develop a so-called config file which the botnet typically applies to victim computer. The file

Re: Defending against malicious SSL proxy

2013-09-30 Thread ianG
On 30/09/13 20:35 PM, Igor Bukanov wrote: ... A real experience shows that a substantial number of those fraud attempts comes from computers where malware installs own root certificate and then install either real or transparent proxy. The access to the proxy is then sold to third parties that ca

Defending against malicious SSL proxy

2013-09-30 Thread Igor Bukanov
On the current web it is a matter of fact that a banking site should be developed under assumption that a substantial number of users use infected computers with some of them would attempt to perform a banking fraud. A real experience shows that a substantial number of those fraud attempts comes f

Re: Scope of Dev-Security List

2013-09-30 Thread Curtis Koenig
Hi Zen, Yes, we have contributors to our security work. We mostly hang out in the #security channel on the mozilla irc. Our web security team has efforts around tool development for finding and reporting security flaws, as well as preforming security reviews on the code and web services manually

Security Volunteers (Was: Scope of Dev-Security List)

2013-09-30 Thread Frederik Braun
On 28.09.2013 01:39, zen.redm...@gmail.com wrote: > Hi guys, I'm interested in Web security, is it possible to volunteer as part > of your Security team ? Yes! We are currently working on finalizing some project ideas for volunteers to work on as part of our security mentorship program. I don't