Can certificate-based authentication systems be bypassed in a MITM attack over WiFi ? I was just looking at a service called REMME and was wondering how secure it actually is.
In general certificate based authentication consists of two main parts:
- A presents a certificate to B and somehow proves to B that it has access to the private key to the certificate.
- B verifies that the contents of the certificate matches the expectations. These expectations are typically a trusted issuer known to B, a specific subject, that the certificate is not expired or revoked etc. But it might also be that B already knows the exact certificate to expect and just compares the certificate or its fingerprint against the known one.
These parts could be attacked within an MITM attack as follows:
- The MITM attacker presents the original certificate of A to B.
This should only be doable if the attacker has a matching private key. Assuming that the certificate does not use a weak key in the first place then the attacker needs to somehow steal the original private key, for example by hacking A. But it might also be that the prove that the peer has the private key for the certificate is wrong. Usually this prove is done by signing a challenge which is (at least in part) based on random data generated by the server. If the check of private key ownership is implemented wrong at B it might be possible for the attacker to replay a prove previously sent by A.
- The MITM attacker presents its own certificate (where he has the private key) to B.
In this case B must somehow be tricked into believing that this certificate is valid for A. Typically this works if the certificate is insufficiently validated in the first place, for example by not validating it at all. It might also be possible that the attacker is able to get a valid certificate from a CA trusted by B as issuer for the certificate.
In other words, if implemented correctly no MITM is possible. But there are various ways it might have been implemented incorrectly.