Slashdot Mirror
Making Sense of Mismatched Certificates?
Ropati writes "I bank with capitalone.com. Recently I went to log in to my credit card account, and my browser reported that the site certificate didn't match the web site I was on. [Expletive.] I'm wondering if I am getting a poisoned DNS URL. I have to log in and do my banking, so I accept the mismatched certificate. The banking site is complete, my transactions are listed but that doesn't mean there isn't a man in the middle attack here. I am still curious how much I have exposed my banking assets." Read on for more, and offer advice on how to interpret what sounds like a flaky response from the bank.
Ropati continues "On the Capital One login page, there is a Verisign link on the page to check that the website is suppose to match. So I click on the verification icon and I am rewarded with a link to Verisign. They report that this web site certificate is for onlinebanking.capitalone.com not the servicing.capitalone.com where I log in. Is this the mismatch my browser reported. I know nothing about certificates.
I call Capital One and ask them to fix the problem. If this was a browser issue on my part, then the Verisign link should match. The tech support supervisor, Joe — XRT413, said he couldn't do anything about it and he couldn't escalate the problem to someone who could.
So my questions are: Are the certificates a mismatch or is my browser bellyaching for nothing? Is the certificate mismatch a security hazard? If someone poisoned my local DNS routers would it be obvious in the URL? How would I prevent such a thing? If everything was working correctly, would the certificate alert me to DNS poisoning, or is this just cosmetic security?"
Ropati continues "On the Capital One login page, there is a Verisign link on the page to check that the website is suppose to match. So I click on the verification icon and I am rewarded with a link to Verisign. They report that this web site certificate is for onlinebanking.capitalone.com not the servicing.capitalone.com where I log in. Is this the mismatch my browser reported. I know nothing about certificates.
I call Capital One and ask them to fix the problem. If this was a browser issue on my part, then the Verisign link should match. The tech support supervisor, Joe — XRT413, said he couldn't do anything about it and he couldn't escalate the problem to someone who could.
So my questions are: Are the certificates a mismatch or is my browser bellyaching for nothing? Is the certificate mismatch a security hazard? If someone poisoned my local DNS routers would it be obvious in the URL? How would I prevent such a thing? If everything was working correctly, would the certificate alert me to DNS poisoning, or is this just cosmetic security?"
This is a misconfiguration on their end. EV certificates, the ones that turn your address bar green and coax turtles into doing happy dances, are really expensive. It's my guess that they've either reused a certificate on another system, or one of their developers made a mistake in how the site and server cluster is configured. It's certainly something to complain about.
If you're ever in doubt about the validity of the certificate or security of a transaction, however, DON'T DO IT!. This goes for standing at an ATM in a shady neighborhood or doing business online.
Hello, IT, have you tried turning it off and back on again?
Ah... another tech support call. Sure, what's the problem?
Are the certificates a mismatch or is my browser bellyaching for nothing?
Yes. And maybe yes too.
Is the certificate mismatch a security hazard?
Common sense would suggest it wouldn't be in a big popup dialog labeled "WARNING" if it wasn't.
If someone poisoned my local DNS routers would it be obvious in the URL?
No.
How would I prevent such a thing?
Stop clicking "Okay" or "Yes" to every security warning you don't understand.
If everything was working correctly, would the certificate alert me to DNS poisoning, or is this just cosmetic security?
If the certificate isn't properly signed, a warning like the one you were presented with should throw a dialog box in the web browser.
#fuckbeta #iamslashdot #dicemustdie
Seconded. The certificate is correct.
I don't know what that verisign link is all about but it is useless.
You certainly cannot trust information within a web page to verify the identity of the server.
Click on the the little 'lock' icon on the bottom right corner of your browser to inspect the certificate.
An ID Thief opened a Capital One account in my name. They had my name, address, SSN, and DOB, but got my mother's maiden name wrong. Capital One approved the card anyway. Then, when the thief immediately changed the address (from mine to another address), before even activating the card, it didn't raise any red flags in their systems. Then, when the thief tried to get a $5,000 cash advance on the card (still not activated), it didn't raise any red flags in their systems (though they denied the advance). Then, when I called them, they refused to give me any information on the theory that I could "go and shoot the guy and they would be liable." Instead, I had to have a police officer call a special "cops number." The police officer called that number and got a recording which apparently no one ever returned phone calls from. At every step of the way, Capital One seemed to be going out of its way to protect itself *from* me and my ID Theft investigation instead of caring about the fact that it was an accessory to ID theft. Needless to say, I won't ever do business with Capital One again.
My sci-fi novel, Ghost Thief, is now available from Amazon.com.
SSL cert is set up to one hostname
The parent is for all intensive purposes is correct. Class 3 SSL certificates are assigned to a common name (foo.com). Unless the certificate contains a wild-card, it ill not work for bar.foo.com. It will however work for foo.com/bar.
It sounds like the bank in question has a Class 3 for CN=bank.com and their webapp is located at online.bank.com. The browser caught the mismatch and throws a warning.
Please alert the webmaster of the institution with a full description of the error.It's easy to resolve on their end (they have to gen a new csr and order a new certificate).
BBH
OK, your bank screwed the pooch and you should complain - LOUDLY - until it's fixed. You should also look for a bank that understands basic internet/web concepts like "SSL cert's CN must match DNS hostname" -- I fear for the rest of their infrastructure.
That said, you were logging into your bank, which presumably holds a large percentage of your cash assets, you received a SSL error and you continued the transaction?
You deserve to have your account cleaned out for reckless disregard for the security of your financial information. Go to a brick-and-mortar bank, or call them on the telephone (*gasp*) if your banking is so urgent.
/~mikeg
The parent is for all intensive purposes is correct.
The phrase is intents and purposes. What the hell would an "intensive purpose" be?
Due to security concerns (just like the OP is expressing,) you can't get a Wildcard EV certificate.
A slashdotter who didn't build his own computer is like a Jedi who didn't build his own lightsaber.
It also works for me. I bank with Capital One, and in fact the link in the summary is the exact link I have stored in my bookmarks. I have never had certificate trouble with that link. I'd watch that account closely if I were you, and perhaps change your passwords if you use the same password elsewhere.
Similar thing happens whenever I try to log into my virginmobile account. https://virginmobileusa.com/ has a certificate for www.virginmobileusa.com
Something strange is going on here. Capital One's main site returns a certificate for the correct domain, but the certificate is invalid. This isn't a wrong-domain issue; the cert is bad. CN="www.capitalone.com", the dates are valid, the issuer is Verisign, but it won't validate in Firefox. Our own system, SiteTruth, which uses OpenSSL, also indicates it's no good. But neither Firefox nor OpenSSL is producing a useful error message. It looks like this certificate is either corrupted or bogus.
The location ("L") in the cert is Glen Allen, VA. Capital One has a facility in Glen Allen, according to Google, and it looks like a huge warehouse. So that's probably their data center, at 4871 Cox Rd, Glen Allen, VA - (804) 270-4104.
A traceroute ends at "capitalone-gw.customer.alter.net", which doesn't mean much one way or the other.
Their stock has dropped from 55 to 12 since September 2008. If you have any money in there above the FDIC insurance limits, get it out now..
capitalone sucks.
i have been paying down a credit card- from 13,000 to 8,000 last year. now they want to raise my rate to 30%. what hav i done? paid on time, NOT CHARGED ANYTHING IN TWO YEARS, and they call and threaten thaat if i dont accept the 30% rate i wont be able ot charge on tht card. ARE THEY EVEN LOOKING AT MY RECORDS?
stupid, stupid company. i will pay them off completely soon (next month) and NEVER do any business with them again.
It looks to me as though IE 8 does just this. The matched part of the url is in a bolder face than the rest of the address. Cool!
You can't get wildcard EV certs.
Xfce: Lighter than some, heavier than others. Just right.
Maintaining the PKE infrastructure, the technical support staffing costs, plus the likely attrition of customers who "just can't get their online banking to work right" would dwarf any savings that they'd see from not just buying a certificate.
Entrepreneur : (noun), French for "unemployed"
Great for phishing sites, totally useless for man-in-the-middle attacks.
Required reading for internet skeptics
Electronic banking is heavily regulated. If you feel your concerns are being taken seriously by the bank you need to head on over to the federal reserves website and file a complaint. The Federal Reserve will forward the complaint to the correct regulating facility and banks will respond or be fined.
http://www.federalreserveconsumerhelp.gov/
The first person who replied to me nailed it. My idea works for simple phishing sites, but not for man-in-the-middle sites, which are almost certainly more common these days. I guess my idea might have been worthy of the insightful mod about 5 years ago...
I am not left-handed, either!
You are exactly correct, except it was the CEO's son who happened to be browsing /. and gave his dad a call and explained what it meant. On the plus side, the policy team (who made this particuar call) is getting their backsides roasted just now...ah, schadenfraude.
If you suspect you're visiting a phishing site, try first entering the WRONG password. Since the fishing site shouldn't know your true password, it will just accept the incorrect one and store it away for the purpuse of dastardly use later on. If the site rejects the incorrect password, then accepts the true one, you know you're OK. Right?
Though the above may work in a phishing website, it's absolutely worthless in a true MITM scheme. Recall that the MITM is forwarding *your* input to the *true* website, and will give you the same results as if you had entered them yourself.