4 ms·

In the wild: Phony SSL certificates impersonating Google, Facebook, and iTunes

29 points by ghosh 13y ago

t0mas88 13y ago
I don't understand why this is newsworthy? Everybody could generate an unsigned certificate for any name in just a few seconds. The point is that they are unusable in any sane browser.
- ejain 13y ago
  In browsers, yes, but what about apps? Search StackOverflow for e.g. "ssl ignore server certificate" and despair...
- yeukhon 13y ago
  That's not enough for some people. A somewhat stronger version would be to do PK pinning. But the consequence can be annoying and painful. --EDIT-- Opps they did mention PK pinning as a solution. Cool.
  - PhantomGremlin 13y ago
    Pinning is still a joke, years after multiple known instances of malicious certificates in the wild. When will Firefox actually implement pinning in the browser itself, instead of via some random add-on? Supposedly Google pays Mozilla $300m/yr. If we can accept that astronomical number, then WTF happens to all that money? Trivial FF changes like moving tabs above the address bar. But useful improvements like pinning languish.
    - joosters 13y ago
      It's difficult to do, that's why. Pinning a certificate relies upon trusting someone. But who do you trust, and how do you decide upon a basis to trust them? With Chrome, the answer is easy. Google control the browser code, so you're implicitly trusting them anyway, and they're vouching for the certificates to their own sites, so you have good reason to accept what they say are the real certs. With Firefox, the picture is much more hazy. The certificates being pinned aren't owned by Mozilla (at least, for the functionality to be useful you want to pin certs from other places, unless you browse mozilla's website all day long). So someone at Mozilla has to vouch for a 3rd party's certificate. Why should we trust Mozilla at this? How would Mozilla decide who to trust when they say 'honest, this really is my certificate'? And even if we accepted mozilla's judgement, all this does is make them an authority. You know, like all those other certificate authorities that already do this job. So nothing will have changed and nothing will have been improved.
      - 7952 13y ago
        Essentially all these systems depend on maintaining the security of a private key which can be compromised in the same way as a client side password. DNS should be something that can give persistent assurance even if a site is compromised in the short term. If you give complete trust to the private key, you then need some kind of revocation scheme to remove that trust when it is compromised. Who runs the revocation list, and how do you authenticate the person revoking the certificate? The challenge is really to encourage offline authentication of DNS and SSL certificate changes. It should be something that can be put in a safe and requires physical attack to circumvent. Something permanent enough that loss would be unlikely, and would result in permanent revocation of the domain.
oleganza 13y ago
The root of the problem is inability to pin pubkey directly to a DNS record which is changeable only by the owner of the private key. If there was a single place where any client can check which PK owns which name and trust derived SSL certificates from there, then the end user UI would be simpler and safer altogether. Suggestion: a protocol to register names on Bitcoin blockchain. You can securely transfer ownership of a name, securely associate more metadata with it etc. Every client can independently check if a given certificate for a given domain name is issued by a proper owner, not by one of opaque organizations that you just have to trust. Today personal computers are bundled with hundreds of root certificates. If one is compromised by FBI or Mossad, they can impersonate FB or Google no problem. DNS records can be taken from you and/or censored, DNS servers spoofed etc. Combining SSL with decentralized DNS-on-blockchain is just so logical. BTW, Namecoin is not the best attempt because it requires separate blockchain. People want one, the most powerful, most robust blockchain and we should pin all our metadata right there. The real problem is how to organize socially, how to agree that this particular protocol with that distribution of names is The Name System, while all others are cheap clones.
- oleganza 13y ago
  Just to clarify: With modern DNS and SSL one of the root issuers can be compromised to impersonate any website. More root certificates - more targets. With blockchain as a root authority, every website is their own guardian. If Google loses their keys, someone may impersonate only Google, but not Facebook, Twitter or your homepage. In combination with multisignature transactions, Google may lock access to their "BitDNS" records to a board of directors with 3-of-5 vote. If one or two keys are compromised or unavailable, it does not stop the company from moving their property how they want.
- JetSpiegel 13y ago
  Namecoin is the best attempt, because if someone compromises DNS it doesn't immediately have access to real money. The task of maintaining Namecoin would be taken by the current maintainers of the DNS system. What's so bad about keeping different things separated?
  - 13y ago
dcaunt 13y ago
SSL pinning on iOS is now very easy. AFNetworking 1 supported it and AFNetworking 2 has made it a great deal easier. Pinning by public key means makes upgrades and certificate renewal less of a problem.

29 points by ghosh 13y ago

I don't understand why this is newsworthy? Everybody could generate an unsigned certificate for any name in just a few seconds. The point is that they are unusable in any sane browser.

ejain 13y ago
In browsers, yes, but what about apps? Search StackOverflow for e.g. "ssl ignore server certificate" and despair...
yeukhon 13y ago
That's not enough for some people. A somewhat stronger version would be to do PK pinning. But the consequence can be annoying and painful. --EDIT-- Opps they did mention PK pinning as a solution. Cool.
- PhantomGremlin 13y ago
  Pinning is still a joke, years after multiple known instances of malicious certificates in the wild. When will Firefox actually implement pinning in the browser itself, instead of via some random add-on? Supposedly Google pays Mozilla $300m/yr. If we can accept that astronomical number, then WTF happens to all that money? Trivial FF changes like moving tabs above the address bar. But useful improvements like pinning languish.
  - joosters 13y ago
    It's difficult to do, that's why. Pinning a certificate relies upon trusting someone. But who do you trust, and how do you decide upon a basis to trust them? With Chrome, the answer is easy. Google control the browser code, so you're implicitly trusting them anyway, and they're vouching for the certificates to their own sites, so you have good reason to accept what they say are the real certs. With Firefox, the picture is much more hazy. The certificates being pinned aren't owned by Mozilla (at least, for the functionality to be useful you want to pin certs from other places, unless you browse mozilla's website all day long). So someone at Mozilla has to vouch for a 3rd party's certificate. Why should we trust Mozilla at this? How would Mozilla decide who to trust when they say 'honest, this really is my certificate'? And even if we accepted mozilla's judgement, all this does is make them an authority. You know, like all those other certificate authorities that already do this job. So nothing will have changed and nothing will have been improved.
    - 7952 13y ago
      Essentially all these systems depend on maintaining the security of a private key which can be compromised in the same way as a client side password. DNS should be something that can give persistent assurance even if a site is compromised in the short term. If you give complete trust to the private key, you then need some kind of revocation scheme to remove that trust when it is compromised. Who runs the revocation list, and how do you authenticate the person revoking the certificate? The challenge is really to encourage offline authentication of DNS and SSL certificate changes. It should be something that can be put in a safe and requires physical attack to circumvent. Something permanent enough that loss would be unlikely, and would result in permanent revocation of the domain.

oleganza 13y ago

The root of the problem is inability to pin pubkey directly to a DNS record which is changeable only by the owner of the private key. If there was a single place where any client can check which PK owns which name and trust derived SSL certificates from there, then the end user UI would be simpler and safer altogether. Suggestion: a protocol to register names on Bitcoin blockchain. You can securely transfer ownership of a name, securely associate more metadata with it etc. Every client can independently check if a given certificate for a given domain name is issued by a proper owner, not by one of opaque organizations that you just have to trust. Today personal computers are bundled with hundreds of root certificates. If one is compromised by FBI or Mossad, they can impersonate FB or Google no problem. DNS records can be taken from you and/or censored, DNS servers spoofed etc. Combining SSL with decentralized DNS-on-blockchain is just so logical. BTW, Namecoin is not the best attempt because it requires separate blockchain. People want one, the most powerful, most robust blockchain and we should pin all our metadata right there. The real problem is how to organize socially, how to agree that this particular protocol with that distribution of names is The Name System, while all others are cheap clones.

oleganza 13y ago
Just to clarify: With modern DNS and SSL one of the root issuers can be compromised to impersonate any website. More root certificates - more targets. With blockchain as a root authority, every website is their own guardian. If Google loses their keys, someone may impersonate only Google, but not Facebook, Twitter or your homepage. In combination with multisignature transactions, Google may lock access to their "BitDNS" records to a board of directors with 3-of-5 vote. If one or two keys are compromised or unavailable, it does not stop the company from moving their property how they want.
JetSpiegel 13y ago
Namecoin is the best attempt, because if someone compromises DNS it doesn't immediately have access to real money. The task of maintaining Namecoin would be taken by the current maintainers of the DNS system. What's so bad about keeping different things separated?
- 13y ago

dcaunt 13y ago

SSL pinning on iOS is now very easy. AFNetworking 1 supported it and AFNetworking 2 has made it a great deal easier. Pinning by public key means makes upgrades and certificate renewal less of a problem.