3 ms·
> According to the QR code data seen by BleepingComputer, the fake certificates circulating online have been issued from different countries—France, Germany, It
by donmcronald 5y ago
> According to the QR code data seen by BleepingComputer, the fake certificates circulating online have been issued from different countries—France, Germany, Italy, Netherlands, North Macedonia, Poland, and so on, indicating the issue could very well impact the entire EU.
So what’s the likely cause then? I’d guess a design flaw in the system and it leaks keys somehow.
Normally I’d say everything should be done with a hardware token that requires a physical presence, but I’m not sure how you do that at scale.
- tluyben2 5y agoYeah was thinking that; this would be generated and stored in an HSM ;it would be impossible to retrieve it even if you have access to the HSM in the network (one of the devs). You could sign with it but not actually distribute it. There are relatively easy and cheap ways to do this these days (aws cloudhsm for instance) so it is all a bit strange.
- mattashii 5y agoA likely cause is a lack of secured issuing endpoints. It should be noted that these certificates do contain two different country identifiers: one of which is in the signed data, and one of which is the applied signature. According to what I picked up from the thread where this issue was first reported, a significant amount of these forged certificates were signed by one country's keys, but had a different country identifier in the signed data. It is therefore likely that, if any, only one country has had it's private key material leaked. But above compromised key materials, a more likely possibility would be compromised issuing endpoints; the infrastructure for these certificates was built and implemented in several months under high pressure to achieve, and government IT projects don't always excel in security.