Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

Taking a look at this (now rather old) article about the generated rogue DigiNotar certificates, it states the following:

...Such is the case with that small company in the Netherlands, DigiNotar. Reports from various sites indicate that hackers compromised the firm’s servers and generated rogue certificates. With a rogue certificate in place, a hacker can make your system think it’s using a legitimate, trusted certificate from well-known companies such as Google and Yahoo. The hacker can then intercept your Internet connection with the site you intended to use and redirect you to a fake site, where you are tricked into entering personal information such as your user name and password. Your computer still thinks it’s connected to a trusted site...

This is what I don't get: Instead of hacking CA's servers, wouldn't it be easier for a hacker to deploy a trojan which installs it's own certificate in the 'trusted root certification authorities' store on the users computer (and then use some kind of DNS hack to redirect the users browser to a server from the hacker) and that way basicly accomplishing the same goal?

I mean, it's pretty easy to deploy a certificate in the root 'trusted root certification authorities' via a batch script, and with this in place, the browser won't raise any flags because the hackers rogue certificate is 'trusted'.

Why go through all the trouble of hacking the Certificate Authority? What am I missing here?

share|improve this question
add comment

3 Answers

up vote 5 down vote accepted

You are assuming that trojan deployment is always possible. Assume that it is not, but that there are other methods at disposal to execute a man in the middle attack. For example a hacker has access to the victim router and can redirect DNS traffic to his own computer. Or a hacker gained access to a specific ISP DNS server and can then also spoof responses for queries like www.gmail.com and then provide a valid https site signed with apparently valid certificate.

Also if a hacker can deploy a trojan why would he even try to implement site spoofing at the victims computer when he can get, for example, the credentials to something by simply doing key logging.

share|improve this answer
    
Ah yes, I had assumed the hacker would already have access to the victim's PC because of the DNS hack. But as you point out, the DNS hack could occur at the router or ISP. Thank you for taking the time to answer my question! –  Jete Oct 27 '13 at 18:55
add comment

Installing a "trusted root" on a victim's computer requires local administrative rights. If the attacker can do that, then he has already won.

Hacking into the CA's server to obtain a fake certificate is a way for the attacker to be able to masquerade as various "trusted" servers and issuers (e.g. to make fake "signed" OS updates), in order to breach into user computers that are not easily reachable otherwise (Trojans work for some users, not for all). It is all a matter of escalation. A CA server is very sensitive because hacking it gives (more or less) automatic entry to millions of other computers.

share|improve this answer
add comment

By using false certificates you don't need to break into any computer apart from the CA's. Your certificates will then automatically be considered legitimate by all browsers. If the CA isn't adequately secured, this approach is surely easier than breaking into many computers and installing trojans on all of them.

To sum up: You are going to reach far more people by breaking into a CA. And even if you are targeting certain people (who might be very security conscious), they have no way of telling that they're dealing with false certificates.

share|improve this answer
    
You make it sound as if hacking the CA is the same as deploying a trojan to certain victim(s). It is not. You need a secondary attack vector. You need to intercept communication from that user at some position in the network. Also it is not entirely true that there is no way of telling that it is a false certificate. You can verify the chain of trust in your browser and see that the authority has changed from the usual one for that site(almost no one does that). There is no way of telling only if the hacker has hacked the original CA that was used by a specific site. –  Ivan Kovacevic Oct 27 '13 at 18:38
    
There is also a tool to help spot certificate changes: addons.mozilla.org/en-us/firefox/addon/certificate-patrol –  Ivan Kovacevic Oct 27 '13 at 18:40
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.