| ▲ | woodruffw 4 hours ago |
| The Web PKI uses certificate transparency, so we’ll have a definitive answer about whether this is/was exploited soon. (But in any case, CT ensures that it can’t be “quiet.”) |
|
| ▲ | agwa 4 hours ago | parent | next [-] |
| There were no certificates from the compromised intermediates logged to CT prior to remediation by the browsers. |
|
| ▲ | hbcdbff 4 hours ago | parent | prev | next [-] |
| CT is great for browsers. Largely irrelevant for anything being fetched outside of a browser. |
| |
| ▲ | woodruffw 4 hours ago | parent [-] | | That’s why I’m talking about it purely in the context of incident response/forensics. | | |
| ▲ | hbcdbff 4 hours ago | parent [-] | | You claimed CT would “definitive”ly prove whether it has or has not been exploited, which is false. The lack of CT entries only proves that (most likely) browsers were not MITM’d. | | |
| ▲ | cortesoft 3 hours ago | parent | next [-] | | We would still know if certs were issued, though, which is the thing we want to check | | |
| ▲ | tsimionescu 2 hours ago | parent | next [-] | | How would you know it? If the CA was compromised, why would the attacker publish the fake certificates in CT? Basically no one outside the major browsers verifies CT logs, so you can still attack a lot of people even without publishing. | | |
| ▲ | bigbuppo 4 minutes ago | parent [-] | | The baddies also take a look at the CT logs and look for fresh wordpress instances that haven't yet been configured and will helpfully configure them for you within a few minutes. |
| |
| ▲ | hbcdbff 2 hours ago | parent | prev [-] | | No we wouldn’t. |
| |
| ▲ | tptacek 3 hours ago | parent | prev [-] | | I'm not following. Browser or no browser, every cert eMudhra issues has to generate an SCT. | | |
| ▲ | eqvinox 3 hours ago | parent | next [-] | | Sure, but a client that doesn't do CT wouldn't care if they don't include a SCT promise. [ed.: this said "break the SCT promise", that doesn't quite make sense] Which you'd only notice if you see the certificate somewhere else afterwards… It's all rather hypothetical and unlikely, but you could certainly try attacking something like downloads.openwrt.org¹ like that — especially if you can tell apart the TLS client in opkg from a normal browser. (¹ luckily, OpenWRT and most other package repos don't actually rely on HTTPS for package integrity and authenticity. And OpenWRT would be the most susceptible due to the "exotic" TLS client stack, if any.) | |
| ▲ | hbcdbff 2 hours ago | parent | prev | next [-] | | I’m surprised to see this username above this comment. No, the cert can be issued with no (or invalid/junk) SCT and will work fine with clients who don’t check SCT, which is most non-browser interaction. | | |
| ▲ | fc417fc802 42 minutes ago | parent [-] | | To spell it out a bit further, an attack strictly in a non-browser context that is reasonably well targeted will most likely go undetected since what the attacker is up against is the chance of inadvertently running into a paranoid user who goes out of his way to perform verification. |
| |
| ▲ | tsimionescu 2 hours ago | parent | prev | next [-] | | No, it doesn't. A certificate may or may not include CT info, or include fake CT info. Most TLS clients accept certificates without checking for CT. | |
| ▲ | 2 hours ago | parent | prev | next [-] | | [deleted] | |
| ▲ | oasisbob 3 hours ago | parent | prev [-] | | SCT enforcement falls to the client though, yeah? What's stopping someone from signing a rogue cert silently which is accepted by CT-lenient clients? | | |
| ▲ | tptacek 3 hours ago | parent [-] | | Right, but you don't have to wait for some hapless random browser to check; you can write your own monitor, and people do that. | | |
| ▲ | tux3 2 hours ago | parent [-] | | I hold eMudhra's private key. I generate a cert signed by their intermediate on my box. eMudhra didn't issue the cert, so it is not sent to any CT logs, and I have no SCT to put in the cert. Am I missing what you mean by monitor? | | |
| ▲ | tptacek 2 hours ago | parent [-] | | I think I might just be talking past you. If your point is "anyone with these broken eMudhra keys can attack users without caring about CT", that's totally true --- it's just that browser/no-browser doesn't factor into it. I'm really only on this subthread because of the notion that CT enforcement requires browsers. | | |
| ▲ | tux3 2 hours ago | parent [-] | | Right, I think I'm with you that browser/no browser shouldn't be a factor. I think I'd like to hear from Rust and Go webpki people on whether we could help the ecosystem enforce CT. My point is more that as a user of a high-level library like reqwest, I'd like to talk safer defaults when root CAs are in use | | |
| ▲ | tptacek an hour ago | parent [-] | | Right, OK, I was misunderstanding the point you were making. Thanks! |
|
|
|
|
|
|
|
|
|
|
| ▲ | 2 hours ago | parent | prev | next [-] |
| [deleted] |
|
| ▲ | 4 hours ago | parent | prev | next [-] |
| [deleted] |
|
| ▲ | 0xbadcafebee 4 hours ago | parent | prev [-] |
| There are plenty of ways you would never be able to tell if a fake cert had been generated and used via this attack vector (let's ignore validation attacks): 1. CT does not do anything if a state actor demands a CA in its borders generate a cert without publishing to the CT logs (or a three-letter-agency doing this illicitly). They can put SCTs in the cert, and still not publish to the logs, nobody is auditing the logs for every cert every browser sees. 2. Browsers won't check for SCTs in certs if they come from a private CA. you can MITM any domain through ZScaler all day long and nobody will notice 3. Wildcard certs make it easy to make/renew a cert that looks normal but hides requests on new/different hosts 4. Non-Browsers do not validate SCTs |
| |
| ▲ | woodruffw 4 hours ago | parent | next [-] | | I feel somewhat confident in speculating that a bunch of people at large companies will, in fact, be auditing the logs following this. That’s their main value; they’re not really an online/active prophylactic. | |
| ▲ | mxey 3 hours ago | parent | prev [-] | | “They can put SCTs in the cert, and still not publish to the logs, nobody is auditing the logs for every cert every browser sees” I don’t think you can get the SCT from a log without the log publishing it? That would defeat the purpose. “Certificates that support certificate transparency must include one or more signed certificate timestamps (SCTs), which is a promise from a log operator to include the certificate in their log within a maximum merge delay (MMD).[4][3] At some point within the maximum merge delay, the log operator adds the certificate to their log.” | | |
| ▲ | teraflop 24 minutes ago | parent [-] | | > I don’t think you can get the SCT from a log without the log publishing it? Well you can, but only if the log cooperates. That is, the SCT is merely a promise to add the certificate to the log by some particular deadline. Nothing technically stops the log from disregarding that promise. But if it does fail to log the certificate, the SCT itself is proof of its misbehavior. And it's not enough to subvert a single log, because browsers require SCTs from multiple distinct operators in order to consider a certificate valid. | | |
|
|
