7 ms·

The story of how WoSign gave me an SSL certificate for GitHub

153 points by schrauger 10y ago

daxelrod 10y ago
This is great additional detail on the WoSign fiasco. Also discussed yesterday here: https://news.ycombinator.com/item?id=12389573 https://news.ycombinator.com/item?id=12389573
0x0 10y ago
Their policy page at http://www.wosign.com/policy/ http://www.wosign.com/policy/ currently renders backend source code in plain text...
- jontro 10y ago
  http://www.wosign.com/policy/cps_e.htm http://www.wosign.com/policy/cps_e.htm if you parse the source :p
- cpeterso 10y ago
  And it's VBScript! <% Dim strAcceptLanguage strAcceptLanguage=Request.ServerVariables("HTTP_ACCEPT_LANGUAGE") 'response.write strAcceptLanguage if instr(strAcceptLanguage,"zh")>0 then Response.Redirect "cps.htm" else Response.Redirect "cps_e.htm" end if %>
  - contingencies 10y ago
    So much of China runs on Windows scripting it's horrific. That is changing, but slowly.
ryanmarsh 10y ago
Stuff like this is depressing. Are we ever going to have any semblance of privacy and security on the Internet? Everyone has been hacked, political figures, governments, businesses. In 100 years I think people are going to look back on this time and think we were all crazy like how we see safety in the early auto industry.
- Hondor 10y ago
  The early auto industry? They'll likely think we're crazy looking at our current auto industry. Who doesn't know anyone who was killed or seriously injured in a car crash?
  - MichaelGG 10y ago
    How much of that is avoidable though? You still have people zooming around in big metal/composite boxes. There's only so much that can be done, especially given the culture around cars.
est 10y ago
So OP mentioned a question posted to stackexchange, clicked link, expected closed. https://security.stackexchange.com/questions/91292/ https://security.stackexchange.com/questions/91292/ LOL good ol' stackexchange, closed as duplicate.
- schrauger 10y ago
  Yeah, I still think it shouldn't be considered a duplicate. Especially since going directly to WoSign didn't end up solving the overall problem, which is what the linked duplicate question says to do.
- Natsu 10y ago
  That "duplicate" has a rather vague answer that is almost completely unhelpful here.
hughw 10y ago
The root cert for www.schrauger.com is StartCom Certificate Authority. Isn't it their (StartCom's) responsibility to make sure the owner of Certification Authority of WoSign (the next cert in the chain) is acting in accord with some terms and conditions? Secondly, should the browser vendors remove StartCom CA as a trusted root? Do they not do that because all the StsrtSSL sites would break? Fine with me, personally. [Edited to clarify who "their" meant]
- schrauger 10y ago
  WoSign is included as a root certificate. When they first started, they weren't in all browser stores, so StartCom cross-signed their root certificate. That way, WoSign could create certificates while they waited for browsers to update with their root certificate. It also helps for legacy/embedded systems that don't get updates, since StartCom has existed far longer. Due to the cross-sign, all WoSign certificates are still compatible.
  - hughw 10y ago
    OK thanks. Doesn't StartCom bear responsibility for the behavior of the entity they cross-signed for?
    - Redoubts 10y ago
      Supposedly they were bought by WoSign http://letsphish.clonezone.link/part1 http://letsphish.clonezone.link/part1 I say supposedly because this is an archive of the original domain https://www.letsphish.org/ https://www.letsphish.org/ which now says > September 1, 2016: > I'm currently going under legal review of the site. > Content will not be available during this period.
    - Manishearth 10y ago
      IIRC not in this case because WoSign had been accepted as a root, it just wasn't in all browsers yet. LetsEncrypt went through the same process -- it was accepted, but it takes time for root store updates to reach all consumers so in the meantime it was cross signed by some other ca. That ca has no responsibility here, since letsencrypt was itself accepted as a CA and was a peer (and is thus fully responsible for its own actions)
jeff_marshall 10y ago
from the article: >Domain validation is hard. It isn't as simple as one may think, and WoSign isn't the first to have a problem. They are still a trusted CA for now, and hopefully they will get their act together quickly. The vulnerability exposed seems like a basic unit test to me (only assume ownership of validated domains or sub-domains - NOT all domains with a common root (or perhaps substring? the article is sparse on details)). I had already lost faith in the 'everyone can be a root if they describe their process' model of trust before reading this post, but if software vendors that rely on trust anchors on their users behalf can't be bothered to do even basic due dilligence beyond vendor-sponsered audits, I'm left speachless. Perhaps my experience with FIPS-140 has jaded me, but after seeing so much more money spent on paper-pushing than actual vulnerability assesment (and remediation), I can't help but feel lost after reading this.
anilgulecha 10y ago
This is nuts. The only long term solution here is a distributed decentralized DNS service. When there's "default-trust" at some locations (browser CAs), There's weak-points in the security chain. What are the best available dDNS solutions. Ideally these are initially backward compatible with redular DNS to help adoption, and then just disregard CAs.
- anilgulecha 10y ago
  Oh and browser vendors, distrust WoSign now! Imagine your regular developer performing a npm install which pulls in code from a compromised MITMed github URL. That's straightforward rootkit compile and install access!
  - thesimon 10y ago
    >Oh and browser vendors, distrust WoSign now! It's not like a lot happened to other authorities (a few pinky-promises)
- garaetjjte 10y ago
  https://news.ycombinator.com/item?id=12382752 https://news.ycombinator.com/item?id=12382752
  - sandstrom 10y ago
    Some disagree that this is a good solution, e.g. https://news.ycombinator.com/item?id=12383795 https://news.ycombinator.com/item?id=12383795
VMG 10y ago
What's that best way to disable the WoSign cert on Arch Linux?
- nmc 10y ago
  The GUI way: https://wiki.mozilla.org/CA:UserCertDB#Deleting_a_Root_Certificate https://wiki.mozilla.org/CA:UserCertDB#Deleting_a_Root_Certi... The CLI way: http://unix.stackexchange.com/a/285831 http://unix.stackexchange.com/a/285831
  - VMG 10y ago
    Thanks! I hoped it wasn't a per-browser procedure, doesn't seem to work for chrome :/ Edit: chrome(ium) has a cert manager under "settings" that allows editing certificate trust levels

153 points by schrauger 10y ago

This is great additional detail on the WoSign fiasco. Also discussed yesterday here: https://news.ycombinator.com/item?id=12389573 https://news.ycombinator.com/item?id=12389573

0x0 10y ago

Their policy page at http://www.wosign.com/policy/ http://www.wosign.com/policy/ currently renders backend source code in plain text...

jontro 10y ago
http://www.wosign.com/policy/cps_e.htm http://www.wosign.com/policy/cps_e.htm if you parse the source :p
cpeterso 10y ago
And it's VBScript! <% Dim strAcceptLanguage strAcceptLanguage=Request.ServerVariables("HTTP_ACCEPT_LANGUAGE") 'response.write strAcceptLanguage if instr(strAcceptLanguage,"zh")>0 then Response.Redirect "cps.htm" else Response.Redirect "cps_e.htm" end if %>
- contingencies 10y ago
  So much of China runs on Windows scripting it's horrific. That is changing, but slowly.

ryanmarsh 10y ago

Stuff like this is depressing. Are we ever going to have any semblance of privacy and security on the Internet? Everyone has been hacked, political figures, governments, businesses. In 100 years I think people are going to look back on this time and think we were all crazy like how we see safety in the early auto industry.

Hondor 10y ago
The early auto industry? They'll likely think we're crazy looking at our current auto industry. Who doesn't know anyone who was killed or seriously injured in a car crash?
- MichaelGG 10y ago
  How much of that is avoidable though? You still have people zooming around in big metal/composite boxes. There's only so much that can be done, especially given the culture around cars.

est 10y ago

So OP mentioned a question posted to stackexchange, clicked link, expected closed. https://security.stackexchange.com/questions/91292/ https://security.stackexchange.com/questions/91292/ LOL good ol' stackexchange, closed as duplicate.

schrauger 10y ago
Yeah, I still think it shouldn't be considered a duplicate. Especially since going directly to WoSign didn't end up solving the overall problem, which is what the linked duplicate question says to do.
Natsu 10y ago
That "duplicate" has a rather vague answer that is almost completely unhelpful here.

hughw 10y ago

The root cert for www.schrauger.com is StartCom Certificate Authority. Isn't it their (StartCom's) responsibility to make sure the owner of Certification Authority of WoSign (the next cert in the chain) is acting in accord with some terms and conditions? Secondly, should the browser vendors remove StartCom CA as a trusted root? Do they not do that because all the StsrtSSL sites would break? Fine with me, personally. [Edited to clarify who "their" meant]

schrauger 10y ago
WoSign is included as a root certificate. When they first started, they weren't in all browser stores, so StartCom cross-signed their root certificate. That way, WoSign could create certificates while they waited for browsers to update with their root certificate. It also helps for legacy/embedded systems that don't get updates, since StartCom has existed far longer. Due to the cross-sign, all WoSign certificates are still compatible.
- hughw 10y ago
  OK thanks. Doesn't StartCom bear responsibility for the behavior of the entity they cross-signed for?
  - Redoubts 10y ago
    Supposedly they were bought by WoSign http://letsphish.clonezone.link/part1 http://letsphish.clonezone.link/part1 I say supposedly because this is an archive of the original domain https://www.letsphish.org/ https://www.letsphish.org/ which now says > September 1, 2016: > I'm currently going under legal review of the site. > Content will not be available during this period.
  - Manishearth 10y ago
    IIRC not in this case because WoSign had been accepted as a root, it just wasn't in all browsers yet. LetsEncrypt went through the same process -- it was accepted, but it takes time for root store updates to reach all consumers so in the meantime it was cross signed by some other ca. That ca has no responsibility here, since letsencrypt was itself accepted as a CA and was a peer (and is thus fully responsible for its own actions)

jeff_marshall 10y ago

from the article: >Domain validation is hard. It isn't as simple as one may think, and WoSign isn't the first to have a problem. They are still a trusted CA for now, and hopefully they will get their act together quickly. The vulnerability exposed seems like a basic unit test to me (only assume ownership of validated domains or sub-domains - NOT all domains with a common root (or perhaps substring? the article is sparse on details)). I had already lost faith in the 'everyone can be a root if they describe their process' model of trust before reading this post, but if software vendors that rely on trust anchors on their users behalf can't be bothered to do even basic due dilligence beyond vendor-sponsered audits, I'm left speachless. Perhaps my experience with FIPS-140 has jaded me, but after seeing so much more money spent on paper-pushing than actual vulnerability assesment (and remediation), I can't help but feel lost after reading this.

anilgulecha 10y ago

This is nuts. The only long term solution here is a distributed decentralized DNS service. When there's "default-trust" at some locations (browser CAs), There's weak-points in the security chain. What are the best available dDNS solutions. Ideally these are initially backward compatible with redular DNS to help adoption, and then just disregard CAs.

anilgulecha 10y ago
Oh and browser vendors, distrust WoSign now! Imagine your regular developer performing a npm install which pulls in code from a compromised MITMed github URL. That's straightforward rootkit compile and install access!
- thesimon 10y ago
  >Oh and browser vendors, distrust WoSign now! It's not like a lot happened to other authorities (a few pinky-promises)
garaetjjte 10y ago
https://news.ycombinator.com/item?id=12382752 https://news.ycombinator.com/item?id=12382752
- sandstrom 10y ago
  Some disagree that this is a good solution, e.g. https://news.ycombinator.com/item?id=12383795 https://news.ycombinator.com/item?id=12383795

VMG 10y ago

What's that best way to disable the WoSign cert on Arch Linux?

nmc 10y ago
The GUI way: https://wiki.mozilla.org/CA:UserCertDB#Deleting_a_Root_Certificate https://wiki.mozilla.org/CA:UserCertDB#Deleting_a_Root_Certi... The CLI way: http://unix.stackexchange.com/a/285831 http://unix.stackexchange.com/a/285831
- VMG 10y ago
  Thanks! I hoped it wasn't a per-browser procedure, doesn't seem to work for chrome :/ Edit: chrome(ium) has a cert manager under "settings" that allows editing certificate trust levels