Making Sense of Mismatched Certificates?

Ropati writes "I bank with capitalone.com. Recently I went to log in to my credit card account, and my browser reported that the site certificate didn't match the web site I was on. [Expletive.] I'm wondering if I am getting a poisoned DNS URL. I have to log in and do my banking, so I accept the mismatched certificate. The banking site is complete, my transactions are listed but that doesn't mean there isn't a man in the middle attack here. I am still curious how much I have exposed my banking assets." Read on for more, and offer advice on how to interpret what sounds like a flaky response from the bank.

Ropati continues "On the Capital One login page, there is a Verisign link on the page to check that the website is suppose to match. So I click on the verification icon and I am rewarded with a link to Verisign. They report that this web site certificate is for onlinebanking.capitalone.com not the servicing.capitalone.com where I log in. Is this the mismatch my browser reported. I know nothing about certificates.

I call Capital One and ask them to fix the problem. If this was a browser issue on my part, then the Verisign link should match. The tech support supervisor, Joe — XRT413, said he couldn't do anything about it and he couldn't escalate the problem to someone who could.

So my questions are: Are the certificates a mismatch or is my browser bellyaching for nothing? Is the certificate mismatch a security hazard? If someone poisoned my local DNS routers would it be obvious in the URL? How would I prevent such a thing? If everything was working correctly, would the certificate alert me to DNS poisoning, or is this just cosmetic security?"

Comments

A few things about SSL

[einhverfr]

The first thing to note is that SSL covers the host-to-host connection and is ignorant of higher-level protocols. There are a couple of things which can cause SSL mismatches:

1) SSL cert is set up to one hostname that the machine services, but site is on another. The SSL negotiation happens prior to the host headers being processed. This could be solved by browser controls (i.e. do a rDNS lookup on the cert's host and make sure it matches the IP you are connecting to), but this ends up causing other, more serious issues, because different sites on the same server could be controlled by different parties. Hence if you have a shopping cart, I could re-use your cert on my shared site on the same box, spoof your page, and steel credit card numbers. So the browser behavior is correct.

2) The SSL cert could have been accidently re-used (unlikely).

My general rule is that if the hostname's TLD matches with the cert (capitalone.com), but the most host-specific portion does not (servicing vs online banking), this is reasonably (though not completely) safe to ignore. Revoked certs should ALWAYS be treated with suspicion because you don't know why it was revoked. Expired certs.... Well, it depends. There are other things that can cause certs to be improperly shown as expired so that demands more careful consideration.

Re:Looks fine to me

[JWSmythe]

    Exactly. They were stupid. They gave a server an alias, and didn't realize that it will throw an error to the clients. It probably worked fine in their dev environment though, where they probably accepted the wrong cert and saved the exception because they got tired of clicking the link. :)

    Being that he ignored the error, didn't view the cert to see what it was really assigned for (and continued on to give his login information), it proves that most users don't really care, and will provide their security credentials regardless if they've been warned that there is a problem or not. The cert could have been for bad_haxor_inc.ru, but since he didn't look, he doesn't know.

    We have to assume that it's a mixup with the servicing.capitalone.com and onlinebanking.capitalone.com hosts, but we don't know.

    Why didn't they just buy a wildcard cert? They're so much easier to work with. :)

Banks? Seriously?

[NineNine]

I don't really understand why any individual with regular "banking" needs would use a bank today. Credit unions are non-profit, and generally, because of their structure, are run much better than banks are. My credit union has been impacted 0% by this banking mess stuff. I'm earning 4% on my PERSONAL CHECKING account, and not paying any fees. I also have all of my business accounts, and my mortgage with my local credit union.

Credit Unions: Like banks, but cheaper, non-profit, less corrupt, no over-paid executives, and not out to screw you over.

Re:Not nothing.

[Anonymous Coward]

Also, lets not forget that a while back some children hacked into Comcast's DNS registrar with nothing more than an unsophisticated Social Engineering ploy.

If the capitalone domain registration ever became compromised, 'hijackeddomain.capitalone.com' would have the same 'root' domain as capitalone.com, but could be pointed at a hackers server in timbuktu.

Just because the domain is 'capitalone.com' does not necessarily mean that everything set up with a vanity off of it is hosted, owned, or operated by capitalone (or more importantly; that they're not owned and operated by someone who possesses malicious intent, be it a disgruntled capitalone employee or otherwise).

Last, the aforementioned domain registration social engineering end-around could theoretically be pulled to obtain a legitimate SSL Certificate. Maybe not specifically by targeting Verisign (at least, not as easily as other companies, I'd venture a guess), but any number of the other more generic and less valuable companies like GeoTrust are all plausible to target with this sort of ploy.

Re:Complaining is kind of pointless.

[irotsoma]

WARNING: RANT...

I hate to say it, but I agree that you'll never get anything fixed by a call center. I've worked in call centers and the people who work there generally have no way to speak to anyone who can fix a problem, even in a "tech support" call center. Also, since they either get paid per call, or at least get docked pay if they aren't actively answering incoming calls, then they have no incentive to fix anything. In fact, they have a big disincentive against fixing anything since it will take away from their pay check and they likely hate the company too much to do it on their own time.

Also, I've been on the other side doing development and it's a similar problem there. It's very easy to make a simple typo or other mistake and never know the difference. No one in the call center ever tells you that the customer is having a problem, so you don't know that something needs to be fixed. So even though it might be a 1 minute fix for you, you'll never know that it needs to be done. There was a bug in this one software that had been there for 3 years, and the workarounds were even in the documentation to train new call center employees. Once a developer finally got it, it took seconds to fix. The customers suffered for 3 years for a few seconds of someone's time. Now I realize you can't fix every bug, all the time, but if the right people don't know about it, then it will never get fixed.

The real problem, IMHO, is that large companies treat their support/customer service departments like they are a drain on the company rather than a way to increase your reputation, thus outsourcing, low pay, strict rules, etc.

Because of this I prefer to do business with smaller companies or, even better, in person. If you're a "real person" standing in line at a bank, the teller is more likely to fix a problem than if you're just a number on a screen and a squeaky voice on a phone. But in-person is so inconvenient in this world of constant multitasking.