4 ms·
Surely you would at least need access to a relevant email address on that domain? How would you bypass that?
by weavie 11y ago
Surely you would at least need access to a relevant email address on that domain? How would you bypass that?
- r0bbbo 11y agoHe would need to be in control of that domain entirely. thecitibank.com is just an address that looks legitimate and is purchasable.
- weavie 11y agoOk, I understand. On a slight side note he may not necessarily need to control the domain entirely, just have access to a privileged email address [1] However, now it seems you won't even need access to an email address. What would stop someone creating a cert for the real citibank.com and using it for a MITM attack? How many people actually check the green bar? [1] http://arstechnica.com/security/2015/03/bogus-ssl-certificate-for-windows-live-could-allow-man-in-the-middle-hacks/ http://arstechnica.com/security/2015/03/bogus-ssl-certificat...
- schoen 11y agoIn the live.fi example, it sounds like Microsoft may have failed to prevent a random user from registering administrator@live.fi as a personal account. Citibank probably won't allow a customer to get that e-mail address!
- weavie 11y agoIt was hostmaster@live.fi (http://www.tivi.fi/Kaikki_uutiset/2015-03-18/A-Finnish-man-created-this-simple-email-account---and-received-Microsofts-security-certificate-3217662.html http://www.tivi.fi/Kaikki_uutiset/2015-03-18/A-Finnish-man-c...)