Can a certificate be spoofed at the browser level? Meaning I go click the LOCK image in my url bar and it shows a valid certificate from VeriSign but somehow the attacker spoofed that information. I'm not sure how they could do it and that's what I'm asking specifically. Could they use ECMAScript? Could they write a browser extension or plugin in C that could somehow update that info?

  • 1
    What do you mean by spoofed? Can you expand a bit more on what attack you're asking about? Dec 6 '16 at 18:23
  • I expanded @XiongChiamiov Dec 6 '16 at 18:40

Well, if you modify the browser, you've basically modified the operating system of the user. In that case, you could also directly install a keylogger or password grabber.

The function of that lock symbol in non-modified browsers of course is to demonstrate the cryptographic security of a site, so obviously, it's not possible to interact with it from a website other than supplying a valid certificate that matches a CA the browser trusts. That is, of course, bugs and backdoors aside, but frankly, I don't think you'll find a blatant security hole in modern browsers that'd allow you to fake that symbol.


Technically -- yes, they could. However, there are few thoughts:

1) web page code cannot interact with browser's address bar.

2) an attacker may write a plugin/extension if web browser provides interfaces for such interactions.

2.1) an attacker can spoof browser's binary modules to change browser behavior. However, this will require source code knowledge and an ability to overwrite binaries.

In reality it is very and very unlikely. This attack vector assumes that attacker already gained access to your computer. In this case, he don't need to do such complex manipulations, it is easier to insert rogue root certificate in trust store and use it to spoof users.

  • 1
    "Major browsers do not allow that." - Well, if you write a standard Firefox extension you have access to all browser features, including the SSL indicators in the URL bar.
    – Arminius
    Dec 6 '16 at 19:14
  • 1
    For clarity HTML5 web browser's can allow a website to interact with the address bar using the History API. However, it still can not rewrite it's domain or interact with the lock icon.
    – Bacon Brad
    Dec 6 '16 at 19:51

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.