Governments May Fake SSL Certificates

Electronic Frontier FoundationToday two computer security researchers, Christopher Soghoian and Sid Stamm, released a draft of a forthcoming research paper in which they present evidence that certificate authorities (CAs) may be cooperating with government agencies to help them spy undetected on “secure” encrypted communications. (EFF sometimes advises Soghoian on responsible disclosure issues, including for this paper.) More details and reporting are available at Wired today. The draft paper includes marketing materials from Packet Forensics, an Arizona company, which suggests that government “users have the ability to import a copy of any legitimate keys they obtain (potentially by court order)” into Packet Forensics products in order to impersonate sites and trick users into “a false sense of security afforded by web, e-mail, or VoIP encryption”. This would allow those governments to routinely bypass encryption without breaking it.

Many modern encryption systems, including the SSL/TLS system used for encrypted HTTPS web browsing, rely on a public-key infrastructure (PKI) in which some number of CAs are trusted to vouch for the identity of sites and services. The CA’s role is crucial for detecting and preventing man-in-the-middle attacks where outsiders invisibly impersonate one of the parties to the communication in order to spy on encrypted messages. CAs make a lot of money, and their only job is to make accurate statements about which cryptographic keys are authentic; if they do this job incorrectly — willingly, under compulsion, by accident, or negligently — the security of encrypted communications falls apart, as man-in-the-middle attacks go undetected. These attacks are not technically difficult; surveillance companies like Packet Forensics sell tools to automate the process, while security researchers like Moxie Marlinspike have publicly released tools that do the same. All that’s needed to make the attack seamless is a false certificate. Can one be obtained?

This risk has been the subject of much speculation, but Soghoian and Stamm’s paper is the first time we’ve seen evidence suggesting that CAs can be induced to sign false certificates. The question of CAs’ trustworthiness has been raised repeatedly in the past; researchers recently showed that some CAs continued to use obsolete cryptographic technology, signed certificates without verifying their content, and signed certificates that browsers parsed incorrectly, putting users at risk of undetectable attacks. What’s new today, however, is the indication that some CAs may also knowingly falsify certificates in order to cooperate with government surveillance efforts. Continue reading.

Related Posts

How Android Security Stacks Up Today's smart phones have all the speed, storage, and network connectivity of desktop computers from a few years ago. Because of this, they're a treas...
How the Swedish Pirate Party Platform Backfires on Free Software By Richard Stallman: The bullying of the copyright industry in Sweden inspired the launch of the first political party whose platform is to reduce cop...
How to Stop Distant Attacks on RFID Chips The limited power and processing ability of RFID chips makes them vulnerable to attackers operating at a distance. A new protocol could tackle this pr...
Privacy Risks from Geographic Information In today's world more geographic information is being collected about us, such as where we live, where the clinic we visited is located, and where we ...
FTC’s exploring privacy roundtable webcast "The Federal Trade Commission will host a series of day-long public roundtable discussions to explore the privacy challenges posed by the vast array o...
All Your Browsing History Are Belong to Us For several years, it has been a poorly kept secret that any Web site you went to could secretly search your browser’s history file to see what sites ...

We Recommend These Vendors and Free Offers

Launch an SSD VPS in Europe, USA, Asia & Australia on Vultr's KVM-based Cloud platform starting at $5:00/month (15 GB SSD, 768 MB of RAM).

Deploy an SSD Cloud server in 55 seconds on DigitalOcean. Built for developers and starting at $5:00/month (20 GB SSD, 512 MB of RAM).

Want to become an expert ethical hacker and penetration tester? Request your free video training course of Online Penetration Testing and Ethical Hacking

Whether you're new to Linux or are a Linux guru, you can learn a lot more about the Linux kernel by requesting your free ebook of Linux Kernel In A Nutshell.


Leave a Comment

Your email address will not be published. Required fields are marked *

*