4 ms·

Your private root CA can only be used maliciously if it's compromised. If you use certificate transparency to publicly leak all your local network administrativ

by jart 3y ago

Your private root CA can only be used maliciously if it's compromised. If you use certificate transparency to publicly leak all your local network administrative activities, then you won't need to worry about someone compromising your network because you've already compromised yourself.

captn3m0 3y ago
The risk in both of theses is vastly different. A root CA leak is hard to detect, has tremendous consequences, and adding limitations to the cert (TLD/domain) don’t work across every OS. OTOH, leaking the existence of your private services (which are likely inaccessible over the internet for the general attacker) is a much smaller risk, and can be contained with wildcard certs as a workaround.
8organicbits 3y ago
Compromise of private CAs isn't always difficult. People store unencrypted keys on SharePoint or send them in email along with the password. There's also cases of rogue IT department staff using the private CA intended to be used for `*.corp` to MITM employee Internet traffic, so "compromise" isn't needed for harm to occur. For companies that do it right, yeah, the concern is minimal. I think the risk of leaking internal domain names is real, but overblown. If you find a vulnerable internal service via CT logs you still need to connect to the private network to exploit it. If you're connected to the private network, you could have enumerated subdomains many other ways. Early knowledge of vulnerable subdomains can speed up an attack or target selection, but this is still a two step process. Most subdomains are pretty boring anyway; it's not surprising to learn that $corp has subdomains like webmail, wiki, etc. These names don't leak version or brand information. I was playing with the idea of doing CT log poisoning, where you register and renew certificates for decoy subdomains along side your real subdomain names. If you add enough noise, CT logs are no longer useful for enumerating private subdomains.
- jart 3y ago
  Sharepoint and email servers aren't public. Transparency logs are. Small companies might not care if the public knows what they're doing. In fact they'd probably benefit from the attention. However other companies are concerned, since leaks can fuel media rumors, harmful stock trades, or worse.
  - worik 3y ago
    More to the point if you cannot keep one file a secret your problems are quite large. Those sort of problems are common, true. That is saying that competence is rare in computing. That is not surprising given the almost complete lack of accountability in this space.

by jart 3y ago

captn3m0 3y ago

The risk in both of theses is vastly different. A root CA leak is hard to detect, has tremendous consequences, and adding limitations to the cert (TLD/domain) don’t work across every OS. OTOH, leaking the existence of your private services (which are likely inaccessible over the internet for the general attacker) is a much smaller risk, and can be contained with wildcard certs as a workaround.

8organicbits 3y ago

Compromise of private CAs isn't always difficult. People store unencrypted keys on SharePoint or send them in email along with the password. There's also cases of rogue IT department staff using the private CA intended to be used for `*.corp` to MITM employee Internet traffic, so "compromise" isn't needed for harm to occur. For companies that do it right, yeah, the concern is minimal. I think the risk of leaking internal domain names is real, but overblown. If you find a vulnerable internal service via CT logs you still need to connect to the private network to exploit it. If you're connected to the private network, you could have enumerated subdomains many other ways. Early knowledge of vulnerable subdomains can speed up an attack or target selection, but this is still a two step process. Most subdomains are pretty boring anyway; it's not surprising to learn that $corp has subdomains like webmail, wiki, etc. These names don't leak version or brand information. I was playing with the idea of doing CT log poisoning, where you register and renew certificates for decoy subdomains along side your real subdomain names. If you add enough noise, CT logs are no longer useful for enumerating private subdomains.

jart 3y ago
Sharepoint and email servers aren't public. Transparency logs are. Small companies might not care if the public knows what they're doing. In fact they'd probably benefit from the attention. However other companies are concerned, since leaks can fuel media rumors, harmful stock trades, or worse.
- worik 3y ago
  More to the point if you cannot keep one file a secret your problems are quite large. Those sort of problems are common, true. That is saying that competence is rare in computing. That is not surprising given the almost complete lack of accountability in this space.