3 ms·

> This traffic was redirected to a server hosted in Russia, which served the website using a fake certificate — they also stole the cryptocoins of customers. W

> This traffic was redirected to a server hosted in Russia, which served the website using a fake certificate — they also stole the cryptocoins of customers. What does this sentence mean? Sorry if I'm being slow. I thought the whole point of certificates is that you can't generate a legitimate one for a domain you don't control, so messing with name resolution wouldn't affect it.

deleted 9y ago
[deleted]
polpo 9y ago
It means just that. Since they had control of DNS, they could have easily gotten a DV certificate, but in this case, they didn't and people clicked through certificate warnings.
- polpo 9y ago
  Here's a source on Twitter showing some documentation of the self-signed certificate that myetherwallet.com users ignored warnings about: https://twitter.com/GossiTheDog/status/988785871188045825 https://twitter.com/GossiTheDog/status/988785871188045825
- ryanlol 9y ago
  Relatively easily, you'll need to be prepared with a mix of DV providers to make sure you don't get screwed by DNS caches.
- discreditable 9y ago
  > people clicked through certificate warnings Which is a shame. They could have prevented users clicking through warnings by implementing HTTP Strict Transport Security.
kodablah 9y ago
Maybe they didn't mean "fake certificate" as we think of it. Maybe they meant a valid certificate that they got from something like LE since they could show they hosted the domain (via the DNS check or the HTTP check).
ceejayoz 9y ago
They rerouted DNS traffic, which would've let them point the domain at their own servers, which would've let them successfully get a new SSL certificate.
- rocqua 9y ago
  Apparently they didn't though. Reports are that they just served an unstrusted certificate and people clicked through all the warnings (or their browsers failed to detect the faulty cert, or some middle box proxy failed to)
JelteF 9y ago
Usually yes, but that's only the case if you try to spoof DNS/routing for end users. If you can fake the DNS/routing for the certificate registrars you can trick them in giving you a certificate.
bklyn11201 9y ago
Certificates can be issued with simple domain validation. If you can receive an email directed to webmaster@crypto.com, you can get a valid cert. So if you can put up a fake DNS server to impersonate Amazon's DNS servers and then start receiving traffic meant for Amazon (BGP route hijacking), you can accomplish domain validation to receive an illegitimate certificate.
- geocar 9y ago
  Or by controlling the IP (as with letsencrypt)
- conistonwater 9y ago
  Thank you.
rgbrenner 9y ago
I thought the whole point of certificates is that you can't generate a legitimate one for a domain you don't control But they did control it. The domain's name servers were pointed to route53 ips, which were controlled by the attackers. If they setup a dns server, they can point those entries to any server they want. They certainly could have gotten a dv ssl certificate for any of the domains affected.
rodionos 9y ago
According to crt.sh, there were no new domain-validated certificates issued to yEtherWallet.com - https://crt.sh/?Identity=%.MyEtherWallet.com https://crt.sh/?Identity=%.MyEtherWallet.com

deleted 9y ago

[deleted]

polpo 9y ago

It means just that. Since they had control of DNS, they could have easily gotten a DV certificate, but in this case, they didn't and people clicked through certificate warnings.

polpo 9y ago
Here's a source on Twitter showing some documentation of the self-signed certificate that myetherwallet.com users ignored warnings about: https://twitter.com/GossiTheDog/status/988785871188045825 https://twitter.com/GossiTheDog/status/988785871188045825
ryanlol 9y ago
Relatively easily, you'll need to be prepared with a mix of DV providers to make sure you don't get screwed by DNS caches.
discreditable 9y ago
> people clicked through certificate warnings Which is a shame. They could have prevented users clicking through warnings by implementing HTTP Strict Transport Security.

kodablah 9y ago

Maybe they didn't mean "fake certificate" as we think of it. Maybe they meant a valid certificate that they got from something like LE since they could show they hosted the domain (via the DNS check or the HTTP check).

ceejayoz 9y ago

They rerouted DNS traffic, which would've let them point the domain at their own servers, which would've let them successfully get a new SSL certificate.

rocqua 9y ago
Apparently they didn't though. Reports are that they just served an unstrusted certificate and people clicked through all the warnings (or their browsers failed to detect the faulty cert, or some middle box proxy failed to)

JelteF 9y ago

Usually yes, but that's only the case if you try to spoof DNS/routing for end users. If you can fake the DNS/routing for the certificate registrars you can trick them in giving you a certificate.

bklyn11201 9y ago

Certificates can be issued with simple domain validation. If you can receive an email directed to webmaster@crypto.com, you can get a valid cert. So if you can put up a fake DNS server to impersonate Amazon's DNS servers and then start receiving traffic meant for Amazon (BGP route hijacking), you can accomplish domain validation to receive an illegitimate certificate.

geocar 9y ago
Or by controlling the IP (as with letsencrypt)
conistonwater 9y ago
Thank you.

rgbrenner 9y ago

I thought the whole point of certificates is that you can't generate a legitimate one for a domain you don't control But they did control it. The domain's name servers were pointed to route53 ips, which were controlled by the attackers. If they setup a dns server, they can point those entries to any server they want. They certainly could have gotten a dv ssl certificate for any of the domains affected.

rodionos 9y ago

According to crt.sh, there were no new domain-validated certificates issued to yEtherWallet.com - https://crt.sh/?Identity=%.MyEtherWallet.com https://crt.sh/?Identity=%.MyEtherWallet.com