Sign up ×
Information Security Stack Exchange is a question and answer site for information security professionals. It's 100% free, no registration required.

Inspired by an old question from PulpSpy, I'm trying to think of whether this is a significant weakness in the Certificate Authority system. Here are the attack methods that I think would work - please comment, critique, and add more that you can think of:

  1. Get a less-reputable CA to issue a basic HTTPS cert. Manipulate the target's DNS requests to direct traffic to a server you control, which will give the appearance of a "valid" HTTPS connection (in the absence of additional precautions e.g. Certificate Patrol) .

  2. Snipe an active domain, get a reputable CA to issue an EV cert. The existence of the EV cert can be used to delay/prevent the "true" owner from regaining control, because the domain snipers now have better proof of ownership.

I think DNSSEC will protect against #1 in cases where the trust anchors are deployed via browsers (e.g. Firefox), and the browser installer itself is signed. The obvious issue is that not many domains are DNSSEC-enabled. (Counterpoint: Many important domains are DNSSEC-enabled).

Are there any other attack methods?

share|improve this question

1 Answer 1

up vote 3 down vote accepted

For SSL itself, a fake certificate can only serve as a way to run a fake server. This requires intercepting the connections from some clients to the true server, and redirect them against your server. Manipulating the DNS is only one way to do that (admittedly, often the easiest) and DNSSEC is meant to protect against that (since DNSSEC is about "securing" with signatures what the DNS servers return). If the attacker controls a router/firewall between the client and the server, he can redirect all the traffic he wants without needing to change anything in the DNS.

Your point #2 is more a Denial-of-Service than anything else. It highlights that when heavier authentication procedures are put in place (e.g. the procedures which are conducted before issuing an EV certificates), it makes mishaps less probable (harder for the attacker) but also deeper (recovery might be longer). This is a point which must be taken into account in the whole security trade-off.

share|improve this answer
Thank you for your answer Thomas. – scuzzy-delta Jan 15 '13 at 0:02

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.