N@N

VeriSign, Inc.: VeriSign Confirms All SSL and EV SSL Certificates Remain Safe From Potential Threats Newly Presented at Black H

^{Published on 2009-07-31 04:13:58, Last Modified on 2009-07-31 04:14:06 - Market Wire}
 

LAS VEGAS, NV--(Marketwire - July 31, 2009) - Black Hat® USA 2009 Conference - As researchers unveiled a series of potential threats to Secure Sockets Layer (SSL) Certificates at Black Hat USA 2009, [ VeriSign, Inc ]. (NASDAQ: [ VRSN ]) today reassured its millions of SSL customers that all SSL Certificates from VeriSign, including its VeriSign® [ GeoTrust ]®, [ thawte ]® and [ RapidSSL ]® brands, are safe from the threats outlined this week.

SSL and Extended Validation (EV) SSL Certificates from VeriSign and its brands are not susceptible to two new SSL vulnerabilities described in Black Hat sessions this week:

 -- Null characters threat. Experts believe hackers may use null characters embedded in some SSL certificates to fool browsers and other pieces of relying software into believing a certificate has been issued to a different domain than the one to which is was actually issued. However, none of VeriSign's SSL Certificates of any brand are issued with null characters in the common name (CN), so VeriSign certificates cannot be used in this type of attack. In addition, EV SSL Certificates are an effective defense against null character certificate attacks. This defensive capability applies both to customer-facing and non-customer-facing-systems, such as auto-updating desktop applications. -- MD2 vulnerability. Experts also think certificates that employ Message Digest Algorithm 2 (MD2) may be subject to pre-image attacks later this year, essentially rendering this hash function untrustworthy. Since May 2009, VeriSign and its brands have issued their SSL Certificates using SHA- 1, designed by the National Security Agency. Customers with existing VeriSign certificates are not vulnerable to this attack and their certificates do not need to be replaced. 

"It's natural to be concerned when security experts uncover vulnerabilities that can open an organization and its customers to attack, but site operators can rest assured that SSL Certificates from VeriSign cannot be used as part of the SSL threats revealed this week," said Tim Callan, vice president of product marketing at VeriSign. "Until client software vendors can fix these vulnerabilities in their applications and operating systems, solutions like VeriSign EV SSL provide effective and reliable protection against these potential threats."

About VeriSign

VeriSign, Inc. (NASDAQ: [ VRSN ]) is the trusted provider of Internet infrastructure services for the networked world. Billions of times each day, VeriSign helps companies and consumers all over the world engage in communications and commerce with confidence. Additional news and information about the company is available at [ www.verisign.com ].

Statements in this announcement other than historical data and information constitute forward-looking statements within the meaning of Section 27A of the Securities Act of 1933 and Section 21E of the Securities Exchange Act of 1934. These statements involve risks and uncertainties that could cause VeriSign's actual results to differ materially from those stated or implied by such forward-looking statements. The potential risks and uncertainties include, among others, the uncertainty of future revenue and profitability and potential fluctuations in quarterly operating results due to such factors as the inability of VeriSign to successfully develop and market new products and services and customer acceptance of any new products or services, including VeriSign SSL, EV SSL, Code Signing and PKI solutions; the possibility that VeriSign's announced new services may not result in additional customers, profits or revenues; and increased competition and pricing pressures. More information about potential factors that could affect the company's business and financial results is included in VeriSign's filings with the Securities and Exchange Commission, including in the company's Annual Report on Form 10-K for the year ended December 31, 2008 and quarterly reports on Form 10-Q. VeriSign undertakes no obligation to update any of the forward-looking statements after the date of this press release.

©2009 VeriSign, Inc. All rights reserved. VeriSign, the VeriSign logo, the Checkmark Circle logo, GeoTrust, Thawte, RapidSSL, and other trademarks, service marks, and designs are registered or unregistered trademarks of VeriSign, Inc., and its subsidiaries in the United States and in foreign countries. All other trademarks are property of their respective owners.