4 ms·
To be clear: this is a two-part hack. Part 1: The null-prefix cert bug is still in the Windows SSL stack. Any browser that uses the Windows SSL libs will take
by hapless 17y ago
To be clear: this is a two-part hack.
Part 1: The null-prefix cert bug is still in the Windows SSL stack. Any browser that uses the Windows SSL libs will take this cert, issued to CN=www.paypal.com\0someoneelse.es, and use it for CN=www.paypal.com.
Part 2: The certificate has already been revoked by its issuer, but a man-in-the-middle attack will prevent the client from discovering that. Moxie Marlinspike's sslsniff + arp spoofing can be run anywhere within the layer 2 broadcast domain in order to deceive the client when it tries to verify the cert.
- ComputerGuru 17y agoIf I'm not mistaken, the same trick you mention in "Part 2" can be used to deceive the client for any false certificate, not just a null-prefix certificate.
- sp332 17y agoBut you need to have a cert signed by an authority the browser trusts, which is why you need the null-prefix attack.