For a successful attack, the attacker must either obtain a SSL certificate from one of the CA that the victim trusts, or he must induce the victim into ignoring the scary-looking warning that his browser will display.
Existing browsers and operating systems are shipped with a hundred or so of "trusted CA" and it is true that if one is deceived or bribed into issuing a fake certificate, then the fake certificate can be used to build a fake HTTPS server. The attacker would still have to make connections go to his server, either with links from spam emails or man-in-the-middle attacks.
It has happened. News article have used such events as basis to prophecize the End of the Internet, the digital Ragnarok which will plunge us all into chaos; that's how news media work (bad news is good news, and the Apocalypse is hard to top). However, what is interesting to note is that:
- It did not happen often. A couple of (highly publicized) times.
- The hole was promptly filled again (in particular, Microsoft pushed an explicit patch to "disable" the offending certificates, like a CRL which you cannot evade).
The point here is that obtaining a fake certificate is only one step in the whole thing, and even if it can be done, it is much harder to do it discreetly. When the attacker has obtained the fake certificate, he does not have much time before the fake issuance is discovered. On the other hand, a successful scam (be it with a man-in-the-middle or a lot of spam) needs preparation, care and some time. In a way, corrupting a trusted CA jeopardizes the whole operation, because it gives exposure to the attacker.
On the other hand, user's gullibility is a proven constant; there is no lack of it. It is much easier, and much less risky (for the attacker), to use it, and make the user ignore the browser warnings. Therefore, in practice, existing CA are very rarely corrupted.
To sum up: yes, with the current CA system, certification is only as robust as the weakest of the trusted CA, and that's not very secure -- but, in this world and day, this is secure enough. The Web SSL system works. The day the SSL system crumbles will be the day easier attack paths have all been closed, and users have become cautious and sensible, and attackers will have no choice but to obtain fake certificates. This will be cause to rejoice, not weep.
(But remember that the current Web+SSL works because of economics: attackers find it not worth the effort to attack CA. Be wary if you try to apply the same model elsewhere, where money and commerce operate differently, e.g. to secure the system for launching nuclear missiles. A security analysis always depends on the exact threat model.)
