How do I report a security vulnerability about a trusted certificate authority?

Question

I stumbled across a huge security vulnerability in a Certificate Authority that is trusted by all modern browsers and computers.

Specifically, I am able to get a valid signed certificate for a domain I don't own. If I had the means to become a Man In The Middle, I would be able to present a perfectly valid ssl certificate.

This vulnerability required no SQL injections or coding on my part. I quite figuratively stumbled across it.

What is the proper way to report this? I want to be ethical and report it to the offending CA, but I also don't want them to simply fix the vulnerability and then sweep everything under the rug. This problem seems to have been there a while, and I'm simply not smart enough to be the only one capable of finding it.

I'm concerned that solely contacting the CA will result in a panic on their part, and they, fearing a DigiNotar-like incident, will do anything to keep the public from finding out.

Am I allowed to also contact some major players, such as other certificate authorities or other sites such as CloudFlare or Google? (I know CloudFlare was given a heads-up about HeartBleed before the public announcement went out.)

Note: I'm posting under a psuedonym account to (try to) remain anonymous for now.

Edit: This question is related to another question, but I feel this vulnerability falls outside the scope of that question. This could affect essentially the entire internet (ie everyone online is a customer), and my question explicitly states that simply contacting the 'developer' (the accepted answer for the linked question) doesn't seem like the best first step to me.

Edit 2: I've gotten in contact with some people, and they've advised me to avoid talking further on this forum (sorry guys!). I'll update this question later, after the vulnerability has been fully fixed and any incorrect certificates revoked.

Edit 3: The details are out. I've posted more information on my personal site about the specifics of the vulnerability. The story is still ongoing, and you can read the discussion between Mozilla, Google, and the CA WoSign.

Edit 4: As promised, I'm updating with a link to an article written by Ars Technica regarding this and other incidents involving WoSign. Looks like WoSign and StartCom (now owned by the same company) may be in serious danger of root revocation.

Answer 1

Such a claim is generally quite serious.

While reaching out to the vendor in question is a responsible matter, you should certainly consider notifying the relevant root store security teams, since they are responsible for designing, evaluating, and applying the security controls to prevent this, and will likely need to directly work with the CA to ascertain the issues.

In terms of responsible disclosure you should also immediately report this to each of the major root store operators: Google, Microsoft, Apple, Mozilla. Just search for "<vendor> report security bug", and the first result will tell you. These are just some of the vendors affected - e.g. not just the CA.

If you are unsure about how to do this, wish to remain anonymous, or need assistance coordinating, the Chromium security team is happy to investigate, contact the appropriate CA, and coordinate with the broader industry. See https://www.chromium.org/Home/chromium-security/reporting-security-bugs for details.

Answer 2

It sounds like your issue is that this vulnerability is bigger than you know what to do with.

The rules of responsible disclosure, as decribed here, say that you should contact the vendor and negotiate a period of time - between 1 week and 6 months, depending on the depth of the changes required - in which they can implement a patch, revoke and re-issue certificates, publish security bulletins, etc, before you go public with your findings. The intention is that at the end of the negotiated period you get your public recognition, but your going public can't do any more harm - if the vendor has done their job properly.

If figuring out how to contact them / negotiate a Responsible Disclosure period, go public with your results at the end, etc, is too big for you, or you don't know how to get started, then I suggest contacting and partnering with a well-known security researcher who already has established publication channels. Find a big name who has already published similar vulnerabilities and call them up! It sounds like you won't have any problem getting their attention.

Also congratulations! I look forward to seeing your name on a paper in 6 months!

Answer 3

Congratulations! Sounds like a major find.

First, generate some proof. The github.com SSL certificate sounds like a great start. Make sure you keep all the network traces you need to show exactly what happened.

You need to determine if you broke any laws or T&Cs while doing this. If the CA does not have a bug bounty, you almost certainly did. In that case, it is important for you to stay anonymous. One concern here is that you may have already revealed your identity during the testing. For example, you probably had to pay for that certificate; how did you make the payment? If you've already broken the law in a non-anonymous way, this pretty much rules out any strong arm tactics against the CA.

While it's commendable that you want to reach out to the CA, bear in mind that you do have a possibility of selling this vulnerability. This would potentially be worth $100,000 from an organisation like vupen. Up to you how you feel about that.

If you do want to disclose, you could do it yourself, but I agree with Mike's recommendation to reach out to an established researcher. I think you could aim a little higher than a university researcher. A celebrity like Bruce Schnier or Dan Kaminsky would be interested in this. You would have to trust them with the details, and use their weight to have the issue taken seriously.

Regarding CloudFlare getting an early view of HeartBleed, this is standard practice for major vulnerabilities - that key providers get an early warning. But that comes much later in the process. In the case of HeartBleed, after patches had been developed (but not publicly released). I'm not sure how that would apply to this vulnerability. It seems that every certificate issued by the CA is now suspect.

Whatever you choose to do, good luck!

Answer 4

When unsure, you can also contact CERT: https://forms.cert.org/VulReport/

They have experience in dealing with even very serious security vulnerabilities, and are generally considered a trusted party. At least they can confirm that your assessment of the vulnerability is correct, and document your part in finding it.

While CERT generally advises you to contact the vendor yourself, for a big case like this I'm sure they would offer assistance.

Answer 5

Ryan Sleevi has very good advice regarding this.

Before sounding off too many alarms, I would contact the Chromium Security Team as he has advised, just to make sure that you are not misunderstanding anything.

Have you checked your vulnerability against the CAB Forum Baseline Requirements to see if the execution of your vulnerability breaks those rules: https://cabforum.org/baseline-requirements-documents/?

For instance, I know of a issuance practice that seems to match up with your summary, but AFAIK is totally valid and not a vulnerability in the eyes of the CAB Forum. A certificate can be generated for a subdomain without having control over the root. I.e. you can get a certificate for test.google.com without having to demonstrate control over google.com.

Answer 6

Operating system and browser vendors might be a good place to report such a vulnerability to since they manage the root CA lists. Here are a few relevant links:

• www.google.com/about/appsecurity/
• www.mozilla.org/en-US/about/governance/policies/security-group/bugs/
• www.apple.com/support/security/
• technet.microsoft.com/en-us/security/ff852094.aspx

Answer 7

I would recommend that you obtain documentation and demonstration of the vulnerability as you are aware of it. Ideally if you can have this verified entirely by a third party, who has been read in to the situation.

To avoid issues of integrity or vendor repudiation of the advice on the vulnerability against you, additional proof by demonstration/execution is necessary. Since we are taking a cert related, capturing a certificate chain demonstrating a the fault would be ideal. Of course any session captures that show the vuln in action is useful.

Without full disclosure I'm just guessing what proof you need anyways. Take the proof of exploit documentation and seed into publicly visible locations like GitHub, Pastebin, email lists. This locks in the inability to repudiate if your evidence is strong.

The remaining issue is identity and communication with the vendor and public. I won't bother disusing revelation of your personal identity, it is up to you. Communications, if you want to be hands on, and prepared to screw up or not act with experience in the case say the whole thing blows up or goes sideways, you can do the contact.

Alternatively seek representation, from either the community, EFF or at the very least your attorney. Someone to protect your interests is advisable and think carefully before accepting industry help from a businesses in its commercial capacity. I am sure the community here can recommend some choices on representation if you solicit such advice.

An entire book could be written on this set of topics, I've tried to keep it short and out of TLDR; territory.

Also on a side note, thank you for the time you have spent uncovering this potential vulnerability. It is badly needed.

Answer 8

You can also report it to "[email protected]" but realize that if the CA in question is a CA/B Forum member, they will also see it. However, so will all the other CA and Browser members. Another option is to report it to the CA Security Council, an organization of the 8 largest public SSL issuers in the world. This is an industry group that has an interest in upholding high standards for its members as well as promoting best practices among all CAs. The form is here: https://casecurity.org/contact-us/