5 ms·
How exactly does this happen?
by zymhan 11y ago
How exactly does this happen?
- tdicola 11y agoIt happens. Engineer goes to upgrade the cert and copies it to a file share they didn't realize wasn't locked down. There's no evidence anyone malicious got the file but it's pretty standard protocol to just assume it's tainted and get a new cert.
- meowface 11y agoI wish they would say how it was disclosed. Your scenario is bad, but less bad than actually sending it out to the Internet, or some malware on a dev's machine grabbing it.
- eugenekolo2 11y agoI give equal likelihood to it being malware related, to somebody moving just disabling a settings on some server that can potentially connect to the server hosting the key. I don't think it's somebody just posting it online, or moving it.
- kozukumi 11y agoMy money would be on somebody commiting something to an externally facing and not security certified system. You see it quite a lot things that should be in gitignore for example.
- forgottenpass 11y agoEh, shit happens. Everything can't be perfect all the time. Especially in security.
- dwelch2344 11y agoPretty dangerous line of thinking when it comes to private keys for a wildcard cert on such a high traffic (and probably high value) target...
- forgottenpass 11y agoI didn't say "Don't try to get it right" I said "eh, shit happens."
- nailer 11y agoThis might seem unusual, but having thought about this a lot, I think the issue was with naming PKI concepts. Calling the public part of the keypair a 'public key' has conditioned people that 'uploading a key' is a normal thing to do. Once 'uploading keys' is normal, it's not a huge step for a user who doesn't know PKI well to go from uploading their public key to uploading their private key.