|
I was reading about SSL. I understood that each browser comes with a predefined set of known public keys,which is then used to authenticate the messages. I was wondering what will happen when a virus changes these public keys with his own version. Is there any mechanism in the browser to prevent that? |
|||
|
|
A virus may add its own root authority to your browser and sign keys. That is possible and would allow it to sniff traffic. It may also remove other authorities. But remember the nature of viruses, they cause damage regardless of what the user does. Just try to protect yourself. However if you are encrypting/decrypting data with your own keys (non browser) viruses cant access it themselves. They can possibly key log you and attempt to find/steal keys. They cant impersonate you or read your data until they successfully capture your private key. |
|||
|
|
|
There is no possible virus when the infected system has perfect protection. The continuous existence of viruses is a reminder that perfection is rarely achieved in human endeavours. If a virus or any piece of malevolent software succeeds in inserting its own public key in the trusted root store of your browser, then whoever controls the virus can make perfect impersonations of HTTPS Web sites, with fake certificates that your browser will accept as if they were the genuine thing. But, of course, why would the virus stop there ? The virus is hostile code running on your computer with at least as much privilege than your normal applications; the virus can simply open a door for external commands. Your machine is no longer, well, yours. When the attacker can put his own code on your machine, then grabbing your password when you connect to your bank site is much simpler than luring you to a fake bank site, so why would he bother ? |
|||
|
|
