4 ms·
You're close. I'm not in the business of telling people how to exploit this and am assuming those who already know were already doing it based on what would be
by patcheudor 12y ago
You're close. I'm not in the business of telling people how to exploit this and am assuming those who already know were already doing it based on what would be a "best practice" (for a bad guy that is) when it comes to generating a self-signed cert.
- ryan-c 12y ago...is it blindly copying any x509v3 attributes present on the certificate, or just the one that you seem to be carefully not mentioning? Can you email me (one is listed in my HN profile)? I just thought of a pretty horrible exploit. 2199399413f2e63e6291a3f3e60f3475518aaf88215434222c65d6bc6fe41f34
- userbinator 12y agoAfter a little more thought, it seems obvious to me now what the problem is. :-) The shocking thing is that the certificate name matching algorithm has been standardised for over 15 years and yet those who wrote the cert generation code weren't aware of how browsers implement it.
- patcheudor 12y agoDing, ding, ding. ;-)
- mattlong 12y agoThis is bumming me out. I'm really curious about what the exploit is but cannot quite put the pieces together...
- patcheudor 12y agoI hope to have a write-up at some point in the near future. I'm working with the vendor now to fix the vulnerability and hope they will be agreeable to a co-authored write-up once they've issued patches.
- jasonyan 12y agoLooks like someone already wrote a post about it: https://blog.filippo.io/komodia-superfish-ssl-validation-is-broken/ https://blog.filippo.io/komodia-superfish-ssl-validation-is-...
- hellbanner 12y agoI'm really just curious & not malicious - is that string at the end of your post a hash of a key or of an exploit code?
- octo_t 12y agoIts probably the hash of their explanation of the exploit.
- ryan-c 12y agocorrect
- hellbanner 12y agoThen it must be a simple to phrase exploit with only one obvious way of stating it.
- jongraehl 12y agoThe purpose of a publicized hash is that you can produce the content later and assert that you had authored it prior to the time you publicized the hash. This is proof to the extent that generating text to hit a given hash is really hard.