Slashdot Mirror
Phony Web Certs Issued For Google, Yahoo, Skype
Gunkerty Jeb writes "A major issuer of secure socket layer (SSL) certificates acknowledged on Wednesday that it had issued 9 fraudulent SSL certificates to seven Web domains, including those for Google.com, Yahoo.com and Skype.com following a security compromise at an affiliate firm. The attack originated from an IP address in Iran, according to a statement from Comodo Inc."
Comodo’s advisory:
http://www.comodo.com/Comodo-Fraud-Incident-2011-03-23.html
Firefox released 3.6.16 yesterday:
http://www.mozilla.com/en-US/firefox/3.6.16/releasenotes/
Microsoft released an advisory and patch yesterday:
Advisory: http://www.microsoft.com/technet/security/advisory/2524375.mspx
Patch: http://support.microsoft.com/kb/2524375
What, they don't support revocation lists already? This should be a non-issue, once someone realized it happened.
Build it, and they will come^Hplain.
Yeah! We should ban such third world hellholes as the United States, Japan, Canada, Italy, Germany and the United Kingdom! They are all in the top 10 for spamming, according to Spamhaus. The others are China, Russia, Brazil, and Argentina.
SSC
The article says that browser makers rushed to put out patches to blacklist the fraudulent certs. Isn't this what certificate revocation lists are for? Are CRLs completely broken and unused?
Your browser already trusts a certificate authority run by the Chinese government, along with one that delegated authority to them.
Your browser also trusts certificate authorities in Africa, *stan countries, and the non-EU portion of Eastern Europe. How many of these could be bribed or coerced if you knew the right people or worked for a random 3rd-world government?
Really, the lock/key icon and colored URL box are totally misleading. You have almost no security. Given the rotten certificate authority situation, failing to accept self-signed and expired certificates is actually a loss for security. You might as well get encryption against a passive attacker. Pretending to be secure against active attackers is just providing a false sense of security.
Uh, you're kinda behind. IE and Firefox have already been patched, no doubt chrome too.
Neither of these are perfect, but here are two different firefox add-ons that can significantly reduce the chance of you falling victim to a compromised certificate authority:
Network Notary - sort of crowd-sourcing approach
Certificate Patrol - remembers the certs of sites you've visited in the past and tells you when they change
When information is power, privacy is freedom.
Current releases of 3.6, 4.0 and 3.5 have the fix for this problem
http://www.mozilla.org/security/announce/2011/mfsa2011-11.html
http://blog.mozilla.com/security/2011/03/22/firefox-blocking-fraudulent-certificates/
These people look deep within my soul and assign me a number based upon the order I joined. -Homer Simpson
Wow, broken clocks are right twice a day it seems.
If I'm paying the CA to certify that public key X really is mine, and yet someone who's not me can get the same certification from the CA for being me ... what was I paying for again?
RSA =/= rubber stamp authority
Information theory is life. The rest is just the KL divergence.
Citation, please?
Because an uncommon, widely-publicized, already-fixed incident that affects a very small number of sites is somehow worse than the status quo, where there's no validation of sites, no assurance of a lack of tampering of data in transit, or of illicit interception of data, right?
Don't they mean "The last proxy they were able to tracert to was in Iran"?
That I hear a whoosh there. Maybe its that big group of birds up above? I think that they're seagulls ;)
http://www.spamhaus.org/statistics/countries.lasso
That's exactly what SSL is for. What you're thinking of is the key distribution. If you don't know who's signing the keys, then SSL cannot help you.
Fair enough.
My point was that CAs rarely mistakenly sign keys for fraudulent entities. Has it happened? Absolutely. Is it common? No. With EV certs becoming more popular for big-name sites (e.g. banks and the like), users can have a reasonable confidence in that the site they're visiting is legitimate. Non-EV certs provide a more modest assurance. Non-SSL sites offer essentially no assurance, which is the current situation for most sites.
In short, using even an occasionally-flawed system like the current SSL infrastructure is far better than not using anything at all, which is what's currently going on.
(Ever looked at how many "trusted" CA's your browser includes by default? Are you familiar enough with even 10% of them to trust them for this role?)
Yes, I've looked at the list. Rather than prune it of CAs that I may consider to be bad (they do, after all, have to undergo audits and the like to be added to the major browser lists), I make it a habit to always hover over the Firefox SSL indicator (which then displays the name of the CA) when I visit an SSL-secured site, and make sure it's a reasonable CA (e.g. one in North America or Western Europe for essentially all the sites I visit) for the site. I also have the Certificate Patrol plugin to detect spoofing.
Of course, the average user doesn't do anywhere near this much checking (which admittedly isn't much). However, I stand by my above point that even with its flaws, using SSL on everything (or at least more things) is far better than keeping things they way they are now.
Why should we be trusting some dis-interested third party to give us that assurance? It's a loser's game! Certificate vendors are in a price war. They don't get paid extra for "going the mile" to confirm your identity, they get paid extra for processing more applications faster and charging 10% less than the other guy. The actual cost of the certificate is too cheap to measure - a couple of used PCs bought on Ebay and a free copy of Linux could probably satisfy most of the global need for certificates. They don't need to be "super certain" they only need to be "reasonably certain", enough to not get sued, and still pass a SAS-70 audit by yet another, disinterested accountancy firm.
Are you feeling confident yet?
In a very real sense, the thing that asserts the IP address of your domain is your DNS server. It's what declares, to the world, where your server is. Since it's the declarative source, why shouldn't it be the confirmational one, as well?
DNSSEC comes close. With DNSSEC you can confirm with certificates and the "chain of trust" that the answer you have came from the DNS server you thought you were asking for the answer from. Now, just one more step: the certificate for the web server should be generated by the trusted DNS server.
It's no assurance that www.screwmebadly.com is a friendly site, but it is a very effective assurance that you are properly connected to www.screwmebadly.com!
I have no problem with your religion until you decide it's reason to deprive others of the truth.
Also given that we know how easy it is for goverments to coerce large buisnesses even in countries that supposedly have checks and balances you can basically assume that the goverment of any country with a recognised CA in it can get a cert to use to MITM your traffic.
note: i'm known as plugwash most places but i screwd up registering that here somehow in the past and now can't register