Does Convergence solve the problem of hacked CAs?

Question

My question is about the Firefox AddOn Convergence.

So my question is if it is possible for convergence to observe that a phishing-site which is verified by fake Certificate because a hacker of a CA created one, is useing a actual not valid certificate?

I understand that with convergence the problem for the man-in-the-middle attack is solved. But it doesn't solve the problem with the hacked CAs, right?

Answer 1

No, Convergence won't protect against that specific attack. It is designed to detect a bad CA issuing a forged certificate for a real site to allow a MITM attack, by checking that all the Convergence notaries are seeing the same cert.

In your phishing example, the forged cert is for a fake site, so there's no "real" cert, and so the notaries will all see the same thing and not notice the problem.

There's good info about convergence in the answers to this question

Note that the attack you describe is unlikely to be used much in the real world. Firstly, phishers usually don't bother with a certificate at all, since plenty of victims won't notice that the page they are accessing is http and not https. Secondly, it would be much easier for a phisher to purchase a legitimate certificate than hack a CA - whoever owns gmial.com can perfectly legally buy an SSL cert for it. Lastly, phishing attacks get noticed fairly quickly (they are rarely subtle) and any certificates involved are going to be revoked quickly.

Answer 2

The idea of Convergence is that Truth is what the whole world sees. Your Firefox add-on shall ask several notaries, and declare itself content with the certificate if what your Firefox sees is also what all the notaries see (and they also find the certificate "reasonable", e.g. fulfils X.509 validation requirements).

In your scenario, the attacker got a "reasonable" certificate (the CA was hacked into signing it, so it is fine as per X.509 rules -- at least until the CA gets back to its senses and revokes it) with, as name, the name of a target server that the attacker wants to impersonate. The postulate of Convergence is that worldwide impersonation is hard. The attacker may succeed in intercepting calls to the true server, as long as these calls come from a restricted list of "victim clients" who are behind routers that the attacker controls. The idea is that the wider the list of victim clients, the more conspicuous the attack gets; ultimately, the attacker cannot maintain for long an interception such that all notaries will be fooled, because it would require taking over the whole Internet. Thus, by asking several notaries, you have a good chance that at least one notary will not be in the subnetworks that the attacker can fool, and the attack will be revealed.

At least so goes the theory. There are a number of faith items in this setup.

So Convergence should allow the detection of fake phishing sites which impersonate real servers, even if the fake sites got a seemingly valid certificate from a gullible CA. That's the goal. It relies on a number of heuristics, including the existence of many notaries, and some assumptions on network topology and average attacker's power.

Of course, this does not help in any way against phishing sites with close names (e.g. a site called "www.stackxechange.com"). For these, the best defence is the user's brain and common sense (I say "best" because that's the only one; "best" does not always imply "good").