Latest Replies


Latest Threads


EFF uncovers further evidence of SSL CA bad behavior

Discussion in 'News Archive' started by Jack, Apr 7, 2011.

Thread Status:
Not open for further replies.
  1. Jack

    Jack Administrator
    Staff Member

    Jan 24, 2011
    Likes Received:
    Windows 10
    In the wake of the Comodo SSL Certificate Authority (CA) having been compromised by an Iranian hacker the Electronic Frontier Foundation published more evidence of problems in the SSL signing industry.

    While many were critical of Comodo's hard coding passwords into public facing code and using their root certificate to sign certificates, now there is more evidence of industry-wide lax practices.

    Chris Palmer wrote a blog on Tuesday outlining work the EFF had done analyzing the quantity of certificates that were signed and trusted by all of our browsers that were technically invalid and could be used for fraud.

    The particular practice the EFF was looking for was the signing of certificates that did not contain fully-qualified domain names.

    To obtain verification of your identity for the CA to sign a certificate, the certificate must contain something that globally only you could be identified by.

    If I try to get a certificate for just plain www, I should be rejected. Yet if I try to purchase, you could verify that I am allowed to represent Sophos, and that this certificate would not be valid for any other organization.

    So what did the EFF find? They found that certificate authorities have signed over 37,000 certificates that are not specific to any organization, they contain only a hostname. The worst offender was

    Each and every one of these could be used to impersonate some local server on your intranet by an intruder...

    Wait! It gets worse.. 28 Extended Validation certificates were issued in this manner.. 10 of which are still valid. What is Extended Validation? Wikipedia states three specific conditions must be met:

    1. Establish the legal identity as well as the operational and physical presence of website owner.

    2. Establish that the applicant is the domain name owner or has exclusive control over the domain name.

    3. Confirm the identity and authority of the individuals acting for the website owner, and that documents pertaining to legal obligations are signed by an authorised officer.

    More details - link
Other threads that you may like Forum Date
Security Report IoT Village uncovers 47 security vulnerabilities across 23 devices General Security Discussions Sep 16, 2016
Trend Micro Uncovers Homegrown Terrorist Apps News Archive May 8, 2016
Symantec uncovers stealth virus used to spy on companies, govts. since 2008 General Security Discussions Nov 24, 2014
Thread Status:
Not open for further replies.