27 ms·
> In order to successfully pull off the MITM attack against TLS connections they will need a rogue CA or cooperation from browsers. Well, "fortunately", Blue C
by msbarnett 10y ago
> In order to successfully pull off the MITM attack against TLS connections they will need a rogue CA or cooperation from browsers.
Well, "fortunately", Blue Coat Systems, leading manufacturer of intercept devices for authoritarian regimes, now has an intermediate cert courtesy of Symantec CA, so they're fully capable of issuing and installing MITM certs for use on their clients' devices.
- Canada 10y agoExcellent point. The trustworthiness of the CA system demands the revocation of that certificate.
- curiousgal 10y agoSaid trustworthiness should have stopped them from granting the certificate in the first place.
- Canada 10y agoYeah. Maybe its issuer should also be revoked for good measure.
- pcl 10y agoThis is why HSTS pre-loading is so important: https://hstspreload.appspot.com https://hstspreload.appspot.com
- gruez 10y agoYou would think that if they did something like this their (or Symantec) CA will be revoked... right guys?
- cheshire_cat 10y agoI was under the impression that they can't issue Sub-CAs because the pathlen of their Cert is set to 0. [0] They would have to give their private key to their clients to achieve a MITM attack, right? [0] https://crt.sh/?id=19538258 https://crt.sh/?id=19538258
- msbarnett 10y agoThey might have to deploy their private key on the devices they maintain for their clients, perhaps relying on a secure keystore on-device to try to protect it from client sniffing (presuming quietly selling it to the client isn't part-and-parcel of the deal). Others have suggested they could provide a cloud-type service to achieve the same result.
- cheshire_cat 10y agoThank you, do you have a link with more technical explanations?
- predakanga 10y agoI'm not entirely familiar with sub-CA specifics, but CloudFlare (at the very least) has developed a system for deploying SSL with off-site private keys[0]; I imagine that could be used in a situation like this. [0]: https://blog.cloudflare.com/keyless-ssl-the-nitty-gritty-technical-details/ https://blog.cloudflare.com/keyless-ssl-the-nitty-gritty-tec...
- imglorp 10y agoWould it be hyperbolic to say vendors like Blue Coat have blood on their hands? Yeah it's just a tool and yeah your workplace or school might need one to "keep the children safe", and yeah they're not responsible for what their customers do with their products. But when they knowingly sell[1] to repressive governments where bad things happen to dissenters, what does that make them? And please spare us the "terrorist" and "criminal" barf, we've heard it in the West. Any Blue Coat care to comment? 1. https://www.eff.org/deeplinks/2011/10/blue-coat-acknowledges-syrian-government-use-its-products https://www.eff.org/deeplinks/2011/10/blue-coat-acknowledges...
- deleted 10y ago[deleted]
- tomjen3 10y agoHow the fuck did they get that and why is Symantec still included in common roots? Thats literally the one thing you aren't allowed to do as a CA.
- msbarnett 10y ago> why is Symantec still included in common roots? Because they (and the companies they own, like Verisign), are the root of about 30-40% of all active, web-visible ssl certs at the moment. No browser maker, even Google is going to break that much of the web over one shady intermediate cert. The consequences for users are too high and too many people are willing to excuse it because it's "only" a pathlen=0 and it would be noticed if used en masse so it's "only" useful for targeted attacks by state-actor clients.
- occamrazor 10y agoIf Blue Coat issues a certified for google.com, then its own intermediate certificate gets revoked by all browser vendors in a matter of days. They can use rogue certificates for targeted attacks, not for mass surveillance.