1

I'm trying to analyze a SSLv3 connection. The certificate of the server has a "MD5 with RSA" signature. So I was setting up a local man in the middle attack by setting up a local DNS server that would return a local IP address to the client. That local server would pipe the connection to the real server. However, the client immediately drops the connection, because it verifies the certificate, this suggests the binary is using certificate pinning. I don't have write access to the calling binary, therefore I can't just patch the cert-verification.

Is it possible to forge a certificate so the MD5 signatures collide, preventing the client from dropping the connection? I already read about HashClash, that it is indeed possible to create two certificates that have a colliding MD5 signature. But is it possible to do the same with a given certificate? If yes, is it possible in a reasonable amount of time?

1 Answer 1

0

Is it possible to forge a certificate so the MD5 signatures collide

Technically it is possible, but it will take a significant amount of work, this is exactly what hashclash discusses.

Generically, you can clone all aspects of the original certificate (CN, OU, expiry dates, etc) except its signature which depends on the original key pair and the private counter-part of the signing cert. Once you can produce a verifiable signature against parameters you've chosen, you've successfully fully forged a certificate.

Although... this may not be the most efficient use of your time... see below.

However, the client immediately drops the connection, because it verifies the certificate, this suggests the binary is using certificate pinning.

That is a reasonable assumption and may in fact be true. But it's not the only explanation to the client's behaviour. Some of the reasons that have a client reject a TLS connection can be influenced:

  • The code could be checking certificate parameters but not its actual signature - which you can, for the most part, duplicate in a fake cert;
  • The code could simply be checking whether the certificate is valid against a root CA, which you can also influence, by importing your own root CA, having used it to sign the fake cert;
  • The code could be implementing cert pinning. On a rooted android or JB iDevice you can use objection to bypass some of the cert pinning routines;
3
  • 1
    Thanks for your input! I already tried to duplicate as much parameters as possible and it still drops the connection. But I didn't think about the second possible reason. Unfortunately the client is a Playstation 3 and I'm afraid I can't add a CA.
    – me123
    Jun 8, 2020 at 21:16
  • ah yes, a PS3 might be tricky to fiddle with. there's other peripheral techniques like blocking OCSP queries, etc, but that's unlikely to work.
    – Pedro
    Jun 9, 2020 at 8:51
  • Yeah, I already figured it would be a pretty tough challenge. Anyway, thanks for your time and input!
    – me123
    Jun 9, 2020 at 13:39

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .