Slashdot Log In
CCC Create a Rogue CA Certificate
Posted by
CmdrTaco
on Tue Dec 30, 2008 12:14 PM
from the they-even-faked-this-dept dept.
from the they-even-faked-this-dept dept.
t3rmin4t0r writes "Just when you were breathing easy about Kaminsky, DNS and the word hijacking, by repeating the word SSL in your head, the hackers at CCC were busy at work making a hash of SSL certificate security. Here's the scoop on how they set up their own rogue CA, by (from what I can figure) reversing the hash and engineering a collision up in MD5 space. Until now, MD5 collisions have been ignored because nobody would put in that much effort to create a useful dummy file, but a CA certificate for phishing seems juicy enough to be fodder for the botnets now."
Related Stories
[+]
New Elliptic Curve Cryptography Record 43 comments
deian writes "Cryptography researchers Joppe W. Bos, Marcelo E. Kaihara, Thorsten Kleinjung, Arjen K. Lenstra and Peter L. Montgomery have just announced that they have set a new record for the elliptic curve discrete logarithm problem (ECDLP) by solving it over a 112-bit finite field. The previous record was for a 109-bit prime field and dates back from October 2002. Their calculation was done on the EPFL cluster of more than 200 PS3s (same one used to create the Rogue CA certificates and demonstrate a reproducible attack on MD5 algorithms). On the PS3, the effort is equivalent to about 14 full 56-bit DES key searches!"
[+]
Generating Fast MD5 Collisions With ATI Video Cards 72 comments
An anonymous reader writes "Yesterday at Black Hat USA 2009, a talk entitled
MD5 Chosen-Prefix Collisions on GPUs
(whitepaper) (Both PDFs)
presented an implementation written in assembly language for ATI video cards that achieves
1.6 billion MD5 hash/sec, or 2.2 billion MD5 hash/sec with reversing,
on an ATI Radeon HD 4850 X2. This is faster than the much-publicized 1.4-1.9 billion hash/sec figure that was
supposedly reached on a PlayStation 3 by Nick Breese at Black Hat Europe 2008 (he
later noticed an error in his benchmarking tool). Compared to the cluster of 215 PlayStation 3s that was used to
create a rogue CA in December 2008,
Marc Bevand claimed a cluster of 12 machines with 24 video cards would be
a bit faster, consume 5 times less power, and be 10 times cheaper."
This discussion has been archived.
No new comments can be posted.
The Fine Print: The following comments are owned by whoever posted them. We are not responsible for them in any way.
Full
Abbreviated
Hidden
Loading... please wait.
Alright this Internet is ruined (Score:5, Funny)
Let's go make a new one.
Re:Alright this Internet is ruined (Score:4, Interesting)
Parent
Re:Alright this Internet is ruined (Score:5, Informative)
"I wonder how broken the intarwebs would be to me if I simply deleted all the MD5-based root certificates from my box? Would I even notice?"
I think a better idea would be to simply delete all the certificates from your box (CA certs included!). Then start marking individual web certs as trusted after you inspect them yourself.
A.
Parent
Re: (Score:3, Insightful)
If you RTFA you'll note that there is only one known CA that is really vulnerable to this attack, RapidSSL (and also FreeSSL which is part of RapidSSL). This is due to the necessary timing of the validity period and the sequential serial numbers used by the CA.
Also of note is that it doesn't matter what encryption was used to sign the root cert, what matters is the type of encryption that the vulnerable CA uses to sign *your* cert. The CA's certificate could be signed with MD5, SHA1 or anything, really.
Re: (Score:3, Funny)
Will there be blackjack and hookers?
Rouge CA? (Score:5, Funny)
I prefer teal CAs, myself. Or possibly burnt sienna CAs. Sometimes fuschia CAs.
It's ROGUE you dumbass.
Re: (Score:3, Insightful)
It could be a rogue communist CA. That way, they're both!
Re:Rouge CA? (Score:5, Funny)
I prefer teal CAs, myself. Or possibly burnt sienna CAs. Sometimes fuschia CAs.
It's ROGUE you dumbass.
Surely you meant FUCHSIA
Parent
from the ... dept? (Score:4, Funny)
Oh noes! What department of Slashdot did this article come from? Its the end of the world as we know it! ;)
Re:from the ... dept? (Score:5, Funny)
Oh noes! What department of Slashdot did this article come from? ...
Hold on - I'll check the signature.
Parent
Re:from the ... dept? (Score:5, Informative)
Alan Cox Leaves Red Hat
Posted by CmdrTaco on 10:11 AM -- Tuesday December 30 2008
from the bet-wherrever-he's-going-he'll-have-electricity-and-heat dept.
The Fight Over NASA's Future
Posted by CmdrTaco on 08:15 AM -- Tuesday December 30 2008
from the still-no-power-at-my-house dept.
Storm Causes AT&T Outage Across Midwest
Posted by CmdrTaco on 08:55 AM -- Monday December 29 2008
from the guess-who-this-includes dept.
So he's without power and worse no internet at his home, aww poor CmdrTaco. Somebody please think of the slashdot editors! Anybody got a spare generator and fuel?
Parent
Re:from the ... dept? (Score:5, Funny)
Parent
Missing option (Score:5, Funny)
I'll set fire to CowboyNeal. That kills two birds with one stone: fuel and food.
Parent
Re: (Score:3, Funny)
Re: (Score:3, Funny)
Rouge CA? (Score:3, Funny)
The commies are creating their own CA!! PANIC!!!
Why trust the PKI? (Score:5, Interesting)
Why does your bank not give you a compact disc with their public key on it when you sign up for an account?
Re: (Score:2)
Or a usb key :)
Re: (Score:3, Interesting)
Sounds like a great plan to me. Plus have a "Use only my bank's CA" mode built into your browser so you know damn well it's them and nobody else.
Re: (Score:3, Insightful)
I know, what if they just installed secured computers which allow exclusive access to their system, in various locations throughout the country so there was always one near by!
They could even install cash dispensing devices to allow you to withdraw funds from your account, maybe call them Automated Teller Machines or something along those lines. Wow, I should totally patent this idea
collision attacks are easy to identify (Score:5, Interesting)
note that the collision attack requires a bit of junk in the cert to make the hash be the same as for the original... this means the junk will not look like the rest of the cert. the rest of the cert is formatted and the collision noise will look mostly random. a simple test for unexpected randomness in the cert data (including Netscape comments) would reveal this sort of mischief. it just takes a bit of code on the browser to look for it. shouldn't even degrade browsing performance too much.
Parent
Re:Why trust the PKI? (Score:5, Informative)
My bank at least also uses a one-time pad system, namely a numbered list of 100 pre-generated codes. So I log in using a username and pass, and then to actually do something with the on-line banking system I'm asked to provide the code that relates to a randomly chosen number between 0000 and 0099. A code can only be used once. So basically if the phishing site manages to get hold of a few numbers from a user's passcode list, the chances are still pretty slim they'll be able to do anything with them.
Of course, if they scam hundreds of people, they will get a few successes, but not very many.
Parent
Re: (Score:3, Interesting)
"This is Mr. Soandso from &BANK NAME&. We have had a recent error in the code cards and would like to verify that you have one of the ones that is not a problem. Could you read line &LINE NUMBER& to me so I can check to see if you have a valid code list?"
Sure it is a little extra effort, but not so much that nobody would attempt it.
Re: (Score:3, Insightful)
People need to be trained. If somebody claiming to be your bank calls you, ask at which extension he can be reached from the number you have for your bank, and call back. Simple.
Re: (Score:3, Insightful)
Re: (Score:3, Insightful)
This is exactly what I do. When a bank or CC issuer calls (usually to verify a purchase) I call the number listed on the back of the card, not the number left in the message.
Reality check for Mozilla (Score:5, Interesting)
First, this issue is about banks (for instance) verifying themselves to the client, not the other way around, so not sure how OTPs and such figure into this.
Overall, between the drama over one of Comodo's trustee CAs handing out certs without verification (for mozilla.com no less) and this MD5 attack, there is a lesson on this for Mozilla:
Trusted CAs aren't the epitome of web safety. In fact, they are LESS safe than one of those "Invalid" (to use Mozilla's ill-chosen words) self-signed certificates under some circumstances.
I put the ranking of https safety as follows:
1. Any self-generated cert (even self-signed) which has been directly copied from the service provider (bank, etc.) and imported into the browser.
Though this is the most secure, it is a shame that the user may receive warnings from other Firefox users who visited the site about the cert being "Invalid", undermining confidence in this most secure method of using certs.
2. Any self-generated cert (even self-signed) verified by SHA1 fingerprint "out of bank" (e.g. letter or phone call or even email) then imported into the browser. Unfortunately the easiest method to initiate this procedure (visit the site, verify then click on a button to import) is now somewhat broken in Firefox and will quite inappropriately undermine the user's confidence in what is otherwise a very secure cert.
3. Relying on the browser-trusted CAs. Unfortunately there now many of them which are obscure even in the tech community, and some are sloppy and incompetent.
Parent
Re: (Score:3, Insightful)
If the certificate is imported into the browser as a trusted certificate you don't get the warning, that's the point.
The invalid warnings ar
Re: (Score:3, Insightful)
If the certificate is imported into the browser as a trusted certificate you don't get the warning, that's the point.
The invalid warnings are for when the certificate has been sent over an untrusted connection and you have no assurance that the certificate is the correct one for the site. In this case, flashing a huge warning in the user's face is absolutely the right thing to do since at the moment, all legitimate online shops have a certificate verified by a third party.
Huge warning Yes; Incorrectly-worded warning that passes judgment on the cert before the user even wonders if it can be verified... NO.
The old behavior used a big warning without condemning the cert. Unfortunately it gave the used an option to just accept the cert and make a connect without even viewing it.
The correct change to make IMO would be to remove the "Continue" button and instead force the user to import the cert before continuing with a connection. Then the certs would be handled more like SSH key
Still using MD5 for this ? (Score:4, Interesting)
Re: (Score:3, Informative)
Implementing something more secure costs X, cost of fraud is Y, change when Y exceeds X, until then, leave everything untouched.
That's just how banks work. You can yell at them how insecure their online banking is 'til you're blue, but you won't change a thing. I've tried. More than one way.
Telling them won't change a thing. Magazines and newspapers don't report it because they don't want to risk those multi-page bank ads. What's left besides breaking the law and using the exploits to make a point?
Banking is typically slowest to change its crypto (Score:3, Insightful)
its only the CA's that use MD5 so the question is. (Score:3, Interesting)
some CA's use MD5 the question really should be which ones
they point to a rather doomsday scenario of having a problem with all SSL Certificate Authorities
this is not the case
only the ones that use MD5
so the question really is what is the list of SSL Certificate Authorities that do this ?
regards
John Jones
http://www.johnjones.me.uk [johnjones.me.uk]
Re:its only the CA's that use MD5 so the question (Score:5, Informative)
It's in their slides. As of 2008, there were some big names still using MD-5:
RapidSSL
FreeSSL
TrustCenter
RSA Data Security (!)
Thawte (!)
verisign.co.jp
Parent
Re:its only the CA's that use MD5 so the question (Score:5, Informative)
You don't have to create many rogue certs, all you have to to is create one rogue intermediate CA cert that can sign as many certs as you like, all of which will be accepted with the default browser config. This is what the CCC has done.
Parent
Re: (Score:3, Informative)
And that is what was done.
Link [wired.com]
CA's using MD5 (Score:5, Informative)
FTA, the following common CA's are still using MD5.
RapidSSL
C=US, O=Equifax Secure Inc., CN=Equifax Secure Global eBusiness CA-1
FreeSSL (free trial certificates offered by RapidSSL)
C=US, ST=UT, L=Salt Lake City, O=The USERTRUST Network, OU=http://www.usertrust.com, CN=UTN-USERFirst-Network Applications
TC TrustCenter AG
C=DE, ST=Hamburg, L=Hamburg, O=TC TrustCenter for Security in Data Networks GmbH, OU=TC TrustCenter Class 3 CA/emailAddress=certificate@trustcenter.de
RSA Data Security
C=US, O=RSA Data Security, Inc., OU=Secure Server Certification Authority
Thawte
C=ZA, ST=Western Cape, L=Cape Town, O=Thawte Consulting cc, OU=Certification Services Division, CN=Thawte Premium Server CA/emailAddress=premium-server@thawte.com
verisign.co.jp
O=VeriSign Trust Network, OU=VeriSign, Inc., OU=VeriSign International Server CA - Class 3, OU=www.verisign.com/CPS Incorp.by Ref. LIABILITY LTD.(c)97 VeriSign
The sky is not falling. (Score:4, Informative)
A nice piece of work (Score:5, Insightful)
That's a nice piece of work. I'm very impressed.
Practical conclusions:
Rouge students and some more insight (Score:4, Informative)
Strange bunch of hackers. Don't expect some rouge students here, one is Arjen Lenstra, which is a well known figure in the security scene.
Very interesting to see that not only do they issue certificates using MD5 signatures (a very stupid thing to do) but they haven't even bothered to make sure that only leaf certificates can be issued. Or there are probably other CA certificates already issued under these root CA's, making matters even worse.
The article was very well written and thus easy to read. I'm only concerned about the recommendation of the authors to do nothing if you've been issued an MD5 certificate yourself. Doing nothing does not seem to be a very good advice. I would myself go to another shop and get a SHA-1 signed certificate (or even a SHA-2 signed certificate for those not concerned with low level browsers). At least your customers will know that there is no man in the middle due to the MD5 issue, and you show that you care for your clients' security.
Hopefully SHA-1 will hold up a bit longer, because last time I looked (a year ago or somewhere in that order), there were zero (0!) certificates that were self signed using SHA-2, which is not a good indication of the current state at all.
Gosh, that's the second CA I've disabled within Firefox just this week. Interesting times.
Re: (Score:3, Insightful)
I would myself go to another shop and get a SHA-1 signed certificate (or even a SHA-2 signed certificate for those not concerned with low level browsers). At least your customers will know that there is no man in the middle due to the MD5 issue.
Unfortunately, no, they won't. An MD-5 signed intermediate cert can quite happily issue certs signed with SHA-1. (They did just this as part of their testing.) There's no requirement for the signing chain to be signed with the same algorithm.
The fact that your end certificate is SHA-1 signed really doesn't mean anything to the end user. If your cert is MD-5 signed, all that could possibly mean is that your CA at one time did something stupid. Whether it is still doing that stupid thing (or already did
Re: (Score:3, Insightful)
I don't think banks will be using MD5 at this point in time.
That is not important. CAs that use MD5 for their cert signing are already in the browsers list of trusted CAs. It is not important what CA the banks use for their own certs for this attack to work.
Re: (Score:2)
There's no way he'd fit in there. It would have to be at least... 3 times as big.
Re: (Score:3, Interesting)
Brute force? Not according to TFA:
In the interest of protecting the Internet against malicious attacks using our technique, we have omitted the critical details of our sophisticated and highly optimized method for computing MD5 collisions.
It says they compute collisions, which is indeed a weakness in MD5. Even if they use brute force, the fact that it's forceable is still a weakness.
Now, MD5 still probably makes for a pretty good checksum for utilities like Tripwire and such, but for security it's broken, broken, broken.
Re: (Score:3, Informative)
Since MD5 is 128 bits, if computing a collision takes on the order of 2^128 attempts, it is indeed brute force and is not a weakness of MD5 at all. A weakness is a property that allows you to perform some undesirable action -- say, compute a collision -- faster than absolute brute force.
Re: (Score:3, Informative)
If computing a collision takes on the order of 2^128 attempts, it won't happen. Anyway, you can make a collision of a 128-bit hash in 2^64 attempts, but even that is out of the reach for most people. Unfortunately you can generate collisions for MD5 much much faster than 2^64 operations.
Re:No weakness (Score:4, Insightful)
This is just to head off the inevitable screaming of "MD5 is broken for everything anyway!!!".
Why head that off when it's a perfectly valid criticism? MD5's been out of date for a few years now and it's been broken for nearly that long. Using MD5 eliminates the CA's credibility.
Parent
Re:No weakness (Score:5, Informative)
Maybe it's my naivety, but wouldn't a hash have to be of infinite length to be able to be used in a way that guarantees no collisions?
That's what I thought he was saying at first, but it's not. For an n-bit hash, the birthday paradox [wikipedia.org] says you'll need to try an average of (n/2) bits to find a hit. The problem with MD5 is that you can find collisions in much fewer than 2^64 attempts. So sayeth Wikipedia [wikipedia.org]:
So yes, all fixed-length hashes will have an infinite number of collisions. It's just that some hash algorithms make it a whole lot easier to find some of them.
Parent
Re:No weakness (Score:4, Informative)
Actually, yes it is. You just need a strong enough cipher.
The way I understand it, for example, 4096-bit RSA either requires a dramatically new approach (quantum computing), or, with current technologies, requires every atom in the Universe to be assembled into a massive compute cluster, and that cluster needs to run for longer than the heat death of the Universe.
Botnets do change some things, but they don't change basic mathematics.
Parent
Re: (Score:3, Funny)
You're on /. and you've actually seen panties?
Stop making shit up.....