People trust green bars, because it is proven to not to be of malicious origin.

This seems to be the questions of hundreds and many are concerned about it, picture that; a team of fraudsters(or at least one), promote their website to many people with the use of Facebook and Twitter advertising who can be easily set up in no time. (1).

The fraudulent websites created a site, looking real etc.. and as already said they have an EV certificate verified implemented. In what ways could such thing be successfully be done, how do certificate distributors verify who that who is(if it can be faked)? (2).

  • "because it is proven to not to be of malicious origin" - your entire question is based on this premise, but the premise is foundationally incorrect. Encryption does not prove a lack of maliciousness. – schroeder Jul 12 '19 at 8:49

EV certificates are designed to more affirmatively identify the legal ownership of a domain. They are not designed to prove that a site is not malicious.

The steps to identifying a domain owner are specified by the CA/B Forum in the Guidelines For The Issuance And Management Of Extended Validation Certificates.

Generally speaking, an EV certificate is not going to be easily faked. They can be, without too much effort however, obtained by by an organization with malicious intent and then used for nefarious purposes. Once you have one, you can use it however you like. I would expect that EV certificates used for fraud are generally fairly quickly revoked, but ultimately they will exist and they will be used to prey on those who heed the decidedly badly-thought-out advice that the green bar means a trustworthy site. The fact that people believe that is as big a problem as mis-used EV certs themselves are.

| improve this answer | |
  • 1
    I would add that even the legal ownership can be misleading as was demonstrated by Ian Carroll who obtained an EV certificate for Stripe Inc in Kentucky (stripe.ian.sh). So even if the organization name is trusted, it might not be the organization the user is thinking of. – user2313067 Jul 9 '19 at 21:21
  • @user2313067 Yeah, that's an excellent point of clarification. – Xander Jul 9 '19 at 23:25

The extended validation is done by the certificate authority. It can be faked if someone is able to set up a CA which root certificate is added to the trusted certificates list issued by the operating system or the browser vendor. Then it can sign certificate requests that are trusted by most devices. Since a CA is required to maintain a certain security level and trust to be accepted to this list, this scenario is highly unlikely. But in the way the PKI system is build we have to trust some organizations and their efforts to maintain their security.

After the extended comment discussion I decided to strap my unlikely scenario of obtaining a CA's private key for malicious actions and rather link to another answer which discusses the ways to compromise a CA:

How do attackers achieve to compromise a CA?

| improve this answer | |
  • Why is this so unlikely that it makes a downvote necessary? Even wikipedia states this scenario as the main compromise scenario. – Stefan Lorenz Jul 10 '19 at 11:47
  • Sorry but still don't get the point, the question asked about the misuse of EV certificates. Since the CA has to validate the holder as valid to issue an EV certificate, a compromised trusted CA would be an attack vector, Thats all I was referring to. This was already attempted several time by various actors but you are right that it didn't happen for a trusted CA so far. But this wasn't my point. My point was, its more likely that an existing CA is compromised than setting up a trusted CA from the beginning for fraudulent use. – Stefan Lorenz Jul 10 '19 at 12:49
  • Thanks for challenging me to write a better answer. You were right about the likelihood of compromising a private key. – Stefan Lorenz Jul 10 '19 at 13:14
  • Much improved! Clearing out the outdated comments now. – Xander Jul 10 '19 at 13:46

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy