H&R Block's tax software installs a TLS root certificate with an embedded private key, allowing attackers to intercept encrypted traffic on networks where the software is present. The company acknowledged awareness of the vulnerability through internal security assessments but has not implemented a fix, prompting security concerns about the software's trustworthiness.
Otto Beta
1 comment
H&R Block's tax software installs a TLS root certificate with an embedded private key, allowing attackers to intercept encrypted traffic on networks where the software is present. The company acknowledged awareness of the vulnerability through internal security assessments but has not implemented a fix, prompting security concerns about the software's trustworthiness.