Hacker News Reader

Comment by pipo234 | Hacker News Reader

Or get someone to click on a spoofed domain, certified by our beloved LetsEncrypt! Apparently al that is needed is an HTTP 302/307 redirect response (or html redirect payload, maybe even DNS?) pointing the client toward c.betly[.]me

View on HN

I'm interested at your suggestion that Digicert et al are doing some sort of "keeping the streets safe" checking. I have zero experience of using them but I thought all they were doing was confirming the applicant represented some entity that matched the domain name. If I manage to get a company registered called G00gle, buy a corresponding domain and then send them my $500 are you suggesting they're going to refuse to issue a certificate?

My impression was the CA's made the likes of Standard and Poor look rigorous, but I'm happy to learn more from actual experience of them rejecting such an application.

I don't see GP claiming CAs should be checking reputability for domain issuance certificates. But the thread originator mentioned subverting CAs! Something to remember about even the most advanced attackers is that they value the continued effectiveness of their tactics, tools and procedures. Even nation-states in possession of CA subversion abilities won't burn their malicious CA on someone if they can conduct the attack with a legitimately-issued certificate, and they won't bother with a legitimately-issued cert if they can conduct the attack without even involving a CA.

I was referring to this comment https://news.ycombinator.com/item?id=37615985

You are absolutely right, that (for plain, domain attestation) paid CAs are exactly as trustworthy as LetsEncrypt, and often much less (remember the Diginotar debacle, for example). "Keeping the streets safe" is not their responsibility, except in a very limited sense. The $500 extended validation was mostly paper work and snake oil.

My point wasn't to discredit LetsEncrypt, but to point out that Google's claim to mitigate the MITM attack vector with https-first wasn't a very strong argument. I mean, yes, sure: if you can't intercept or downgrade to HTTP the MITM doesn't work. But all the HTTP seems to do was redirect to a malicious payload. But you can also do a redirect in HTTPS.

So if you can spoof someone to go to https://g00gle.com/ it should be just as easy to launch the attack chain from there.

As far as I can tell, the verification that DigiCert performs is 1. the company exists in various Business listings 2. the phone number listed in whois has a human behind it and the human confirms the phone number belogs to the company.

Source: Have to be that human from time to time

Only if you pay $$$$ for OV/EV.

If you get the normal DV cert they don't provide any more verification than Letsencrypt.

And since browsers have moved away from indicating OV/EV certs to end users, not many organizations are paying for those anymore.

Can confirm as someone who has to renew a non-Let’s Encrypt cert every year (for reasons). The CA sends an automated email to the email address listed in WHOIS, you click a link in the email, and they issue the certificate. No human interaction necessary.

EV certs have a slightly more rigorous approach. They’ll call the registered agent for the business as registered/licensed with the state, not the phone number from whois or an email to webmaster@

Yes, I’m just talking about regular DV certificates (the same type you’d get if you just used Let’s Encrypt).

Huge difference between being tricked into clicking a link vs just browsing the web and getting owned.

Is there?

Yes. The move from 0 to 1 click exploits (thanks to putting Flash/Java behind a click) in the early 2000s marked a massive negative shift in attacker capabilities and ultimately destroyed multiple (black market) exploit dev businesses.

“Click to play” bypasses became incredibly valuable as an enabler for Flash/Java exploits, for a while. They were also few and far between, and if memory serves me, unreliable as fuck.

It definitely matters. Just think about what sort of how much Dr. Evil would pay for an exploit that relies on user action versus one that doesn't.

https://nvd.nist.gov/vuln-metrics/cvss/v3-calculator

I can probably avoid bring tricked into clicking a link, I've avoided many many attempts to trick me in the past. I probably can't avoid browsing the internet though.

The vector is an image file. Put your image in a display ad, now you don't need the user to click anything

Coincidentally, the ACME DNS verification process that LetsEncrypt uses is vulnerable to the QUANTUM attack. If NSA injects a fake DNS response in the right spot, and have the their response arrive before the official response, they can get the domain verified.

OTOH, Certificate Transparency Logs will give the game away, so there's that.

Doesn't Let's Encrypt check the DNS record from multiple widely-distributed endpoints to avoid this attack?

> certified by our beloved LetsEncrypt

Are you saying that CAs should be refusing to issue certs for potentially spoofed domains?

...or Digicert, Globalsign, the Hongkong post office, whichever CA is in your truststore.

I just mentioned LetsEncrypt because it's free and exceptionally easy to use. I'm not implying in any way they aren't providing a great service, it's just that that service also gets misused because it's cheap and easy.

It really sounds that way, FYI. I interpreted it as a dig at LetsEncrypt in particular.

Please accept my apologies :-)

Consider your apologies accepted

Reply on news.ycombinator.com