What can a trusted certificate do?

Question

I am doing some reading about security on mobile applications because I found an article about Man in the Middle Attacks.

I saw in that article and in many other places (including security.stackexchange), that if the user installs a certificate of an unknown 3rd party, that 3rd party can exercise MitM attacks in other apps of the device.

Basically what I want to understand is why? How can this 3rd party certificate be a vulnerability on other apps? I want some understanding of how these certificates work in that regard.

I read about certificate authorities, root certificates, chain of trust and related matters, which makes me even more confused on how something "self-signed" would be a security vulnerability.

Can anyone give me a brief explanation on how/why this happens? Or even provide me with links/books with relevant information.

Answer 1

I saw in that article and in many other places (including security.stackexchange), that if the user installs a certificate of an unknown 3rd party. That 3rd party can exercise MitM attacks in other apps of the device.

If you install a certificate for a certificate agency (not a certificate for a site) then you effectively trust the certificate agency fully, i.e. allow it to sign certificates for any other site - even for sites where other agencies have already issued certificates. And this allows man in the middle attacks.

This would be similar if you have a new friend and you trust this friend fully. If then some shady guy comes and claims to be your bank and presents a document signed by your friend which attests this claim, then you would believe this guy just because you trust your friend fully. Thus it is possible for someone to impersonate someone else with the help of your friend. And this make man in the middle attacks possible, where the man in the middle impersonates the real destination.