3 ms·
He would need to be in control of that domain entirely. thecitibank.com is just an address that looks legitimate and is purchasable.
by r0bbbo 11y ago
He would need to be in control of that domain entirely. thecitibank.com is just an address that looks legitimate and is purchasable.
- weavie 11y agoOk, I understand. On a slight side note he may not necessarily need to control the domain entirely, just have access to a privileged email address [1] However, now it seems you won't even need access to an email address. What would stop someone creating a cert for the real citibank.com and using it for a MITM attack? How many people actually check the green bar? [1] http://arstechnica.com/security/2015/03/bogus-ssl-certificate-for-windows-live-could-allow-man-in-the-middle-hacks/ http://arstechnica.com/security/2015/03/bogus-ssl-certificat...
- schoen 11y agoIn the live.fi example, it sounds like Microsoft may have failed to prevent a random user from registering administrator@live.fi as a personal account. Citibank probably won't allow a customer to get that e-mail address!
- weavie 11y agoIt was hostmaster@live.fi (http://www.tivi.fi/Kaikki_uutiset/2015-03-18/A-Finnish-man-created-this-simple-email-account---and-received-Microsofts-security-certificate-3217662.html http://www.tivi.fi/Kaikki_uutiset/2015-03-18/A-Finnish-man-c...)