The death of MD5 (and some SSL certificates)
Fake SSL Certificates
The bad news is attackers have a much simpler way to get an SSL certificate for an arbitrary site: They can simply buy one. In one case, someone was able to buy a certificate for Mozilla.org from an SSL reseller that did no checks to ensure that the individual was allowed to get certificates or even was affiliated at all with Mozilla.org [2].
In other cases, attackers have been able to get a certificate "Issued in minutes" (to quote RapidSSL.com) with fake requests by faxing in orders on official looking letterhead from organizations for which they want the SSL certificates. To put it simply, they claim to verify your information securely somehow in a few minutes (realistically, some simply query the WHOIS information for your domain and email the contacts listed, giving them a chance to cancel the certificate order). With CCL certificate authorities selling certificates to virtually anyone requesting them with only minimal oversight, the system can be abused easily by attackers.
How to Protect Yourself
Unfortunately, you can't do much to protect yourself. Even if you enable certificate revocation checking in your web browser, if attackers use the MD5 method to create a fake authority certificate, they can simply leave out the certificate revocation information (meaning your browser can't check to see whether it has been revoked or not!). Disabling the root certificates for the authorities that still support MD5 will break a large number of websites, some of which you might want to use (which is largely why, so far, Firefox has not blocked the use of the Comodo SSL authority).
If you want to do this for yourself, the instructions are: Go to the Advanced | Encryption settings tab in Firefox and click on View Certificates, then select Authorities. Now search for the certificate you want to disable (manually, because there is no search function) and select it, then all you have to do is select Edit and uncheck the box for This certificate can identify web sites.
In the future, websites that use this certificate authority to get their website certificates will show up as not signed by a trusted authority, and you'll get the Firefox warning. The process is just as, or more, convoluted in other web browsers. Oh, and most of the certificate authorities in your web browser have no descriptive information. Some of them don't even have valid websites (because they have gone out of business and sold their signing certificates to other companies). Web browsers could make significant improvements in this area.
Conclusion
The good news is that the organizations responsible for technical standards such as MD5 and SHA-1 have not been sitting still. The American National Institute of Standards and Technology (NIST) is holding a competition to develop and choose a new hashing algorithm that should be good for several decades of use [3]. Web browser vendors have also not been standing still. The advent of new "Extended Verification" certificates place much stricter controls on how certificates are issued and to whom (although one could argue this should have been done all along).
Unfortunately, without education, most users will not be able to tell the difference between a website with a "standard" certificate and one with "Extended Verification," although in most cases, the browser places the company name on a green background in the address bar.
Infos
- Creating a rogue CA certificate: http://www.phreedom.org/research/rogue-ca/
- mozilla.dev.tech.crypto: http://groups.google.com/group/mozilla.dev.tech.crypto/browse_thread/thread/9c0cc829204487bf?pli=1
- Cryptographic hash algorithm competition: http://csrc.nist.gov/groups/ST/hash/sha-3/index.html
« Previous 1 2
Buy this article as PDF
(incl. VAT)
Buy Linux Magazine
News
-
Another New Linux Laptop has Arrived
Slimbook has released a monster of a Linux gaming laptop.
-
Mozilla VPN Now Available for Linux
The promised subscription-based VPN service from Mozilla is now available for the Linux platform.
-
Wayland and New App Menu Coming to KDE
The 2021 roadmap for the KDE desktop environment includes some exciting features and improvements.
-
Deepin 20.1 has Arrived
Debian-based Deepin 20.1 has been released with some interesting new features.
-
CloudLinux Commits Over 1 Million Dollars to CentOS Replacement
An open source, drop-in replacement for CentOS is on its way.
-
Linux Mint 20.1 Beta has Been Released
The first beta of Linux Mint, Ulyssa, is now available for downloading.
-
Manjaro Linux 20.2 has Been Unleashed
The latest iteration of Manjaro Linux has been released with a few interesting new features.
-
Patreon Project Looks to Bring Linux to Apple Silicon
Developer Hector Martin has created a patreon page to fund his work on developing a port of Linux for Apple Silicon Macs.
-
A New Chrome OS-Like Ubuntu Remix is Now Available
Ubuntu Web looks to be your Chrome OS alternative.
-
System76 Refreshes the Galago Pro Laptop
Linux hardware maker has revamped one of their most popular laptops.