Wednesday, March 23, 2011

trusted Certificate compromise - a sophisticated attack

thanks to ioerror at Tor Project for in-depth discovery and analysis of this situation, described here:

summarizing snippet:
Last week, a smoking gun came into sight: A Certification Authority appeared to be compromised in some capacity, and the attacker issued themselves valid HTTPS certificates for high-value web sites. With these certificates, the attacker could impersonate the identities of the victim web sites or other related systems, probably undetectably for the majority of users on the internet.
If you are interested in PKI and its security in a global sense, I recommend you read the article.  A couple of observations.  First, the right thing seemed to happen, emphasis on 'seemed' so far,  in that the affected CAs identified an issue and notified relevant parties rapidly.  And 'fixes' were rolled out by the browser manufacturers.   Even more interesting to me is the glimpse into the people and systems that are collaborating to monitor this global PKI infrastructure and report on its robustness, bringing light to a murky, complicated area.   Having visibility into the operations of the global PKI is a good thing for all of us.

UPDATE:  More on this topic from Peter Eckersley of EFF.  I didn't know that IP addresses associated with the attack were Iranian.   Also, Peter links to a statement by Comodo.  Here are Peter's remarks:

Another UPDATE: Paul Roberts at ThreatPost offers some common-sense wisdom, via Paul Turner, for managing your certificates, and your certificate exposure I suppose. See:

Yet Another UPDATE:  Comodo hacker statement released, discussed in detail by Errata Security:   Yes, Iranian.  Yes, not that hard to do, apparently.

Perhaps Final UPDATE:  Ben Adida offers a useful analogy about evolution in discussing how the global PKI became brittle enough to permit this kind of compromise.  In my opinion Ben is always thoughtful and his insights and analysis help me to see issues from new perspectives.   His discussion is here:

No comments: