10

In order to perform a successful man in the middle attack on HTTPS, one needs to either strip SSL layer and convert it to HTTP completely or needs to have a valid certificate from a CA for the same domain to re-encrypt the content, therefore have a green bar.

Many cheap SSL providers allow you to get SSL certificates for domain names without putting much effort in verification. The situation could be better for domestic companies but foreign companies only need to fax some "good looking" documents at most, that's all.

What is the mechanism which prevents us from getting a valid SSL certificate for, say, google.com ?

CRL is only a post-disaster measure and it could be too late before a CRL is issued. What am I missing in the picture here?


EDIT: Interesting, a month after I asked this question, a Turkish certificate authority issued a certificate for a fake request for google.com domain, the example I used :)

2
  • Great question! I'll write an answer for this later.
    – Polynomial
    Nov 23, 2012 at 12:20
  • Well, looks like there's no need. Thomas beat me to it as usual!
    – Polynomial
    Nov 26, 2012 at 12:39

2 Answers 2

11

For a successful attack, the attacker must either obtain a SSL certificate from one of the CA that the victim trusts, or he must induce the victim into ignoring the scary-looking warning that his browser will display.

Existing browsers and operating systems are shipped with a hundred or so of "trusted CA" and it is true that if one is deceived or bribed into issuing a fake certificate, then the fake certificate can be used to build a fake HTTPS server. The attacker would still have to make connections go to his server, either with links from spam emails or man-in-the-middle attacks.

It has happened. News article have used such events as basis to prophecize the End of the Internet, the digital Ragnarok which will plunge us all into chaos; that's how news media work (bad news is good news, and the Apocalypse is hard to top). However, what is interesting to note is that:

  • It did not happen often. A couple of (highly publicized) times.
  • The hole was promptly filled again (in particular, Microsoft pushed an explicit patch to "disable" the offending certificates, like a CRL which you cannot evade).

The point here is that obtaining a fake certificate is only one step in the whole thing, and even if it can be done, it is much harder to do it discreetly. When the attacker has obtained the fake certificate, he does not have much time before the fake issuance is discovered. On the other hand, a successful scam (be it with a man-in-the-middle or a lot of spam) needs preparation, care and some time. In a way, corrupting a trusted CA jeopardizes the whole operation, because it gives exposure to the attacker.

On the other hand, user's gullibility is a proven constant; there is no lack of it. It is much easier, and much less risky (for the attacker), to use it, and make the user ignore the browser warnings. Therefore, in practice, existing CA are very rarely corrupted.

To sum up: yes, with the current CA system, certification is only as robust as the weakest of the trusted CA, and that's not very secure -- but, in this world and day, this is secure enough. The Web SSL system works. The day the SSL system crumbles will be the day easier attack paths have all been closed, and users have become cautious and sensible, and attackers will have no choice but to obtain fake certificates. This will be cause to rejoice, not weep.

(But remember that the current Web+SSL works because of economics: attackers find it not worth the effort to attack CA. Be wary if you try to apply the same model elsewhere, where money and commerce operate differently, e.g. to secure the system for launching nuclear missiles. A security analysis always depends on the exact threat model.)

2
  • 1
    BTW do you trust all of the >250 CAs that are in modern browsers? I think that this is a real problem now that there are so many certificates pre-installed in the browsers.
    – Uwe Plonus
    Nov 23, 2012 at 12:47
  • 2
    I "trust" them in the following sense: I have not deactivated any of them. The idea is that as long as my configuration is the same than everybody's, then my sorrows will be shared. In the privacy of my mind, I certainly do NOT believe all of these CA to be ultimately honest, let alone competent. But I do not skip heartbeats on that matter, either. Nov 24, 2012 at 21:44
4

I think that there is no real solution for this problem. The following attempts are known to me for this problem:

  1. CRL (but this is only a post-disaster measure as you write)
  2. Remove CA from list of trusted CAs but this is also only a post-disaster measure.
  3. Don't add such CAs to the list of trusted CAs. Here the problem is where to draw the line.
  4. Fix the certificates/hosts to a certain CA, as google is doing this for chrome.

I think that the complete CA structure is broken as it is implemented right now. I don't know any solution to this right now but I think something has to change for the future.

A probable solutions could be to have only one central CA (is this really a solution? Who should run this CA?).

Another solution could be a web of trust which would men that we have to discard all existing solutions as they are now...

Also one solution could be that every user imports its own CAs but for many users this would not be the final solution...

As a result I think there will not be viable solution in the near future to this.

1

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .