Null Character Hack Allows SSL Spoofing 280
eldavojohn writes "Two researchers, Dan Kaminsky and Moxie Marlinspike, came up with exact same way to fake being a popular website with authentication from a certificate authority. Wired has the details: 'When an attacker who owns his own domain — badguy.com — requests a certificate from the CA, the CA, using contact information from Whois records, sends him an email asking to confirm his ownership of the site. But an attacker can also request a certificate for a subdomain of his site, such as Paypal.com\0.badguy.com, using the null character \0 in the URL. The CA will issue the certificate for a domain like PayPal.com\0.badguy.com because the hacker legitimately owns the root domain badguy.com. Then, due to a flaw found in the way SSL is implemented in many browsers, Firefox and others theoretically can be fooled into reading his certificate as if it were one that came from the authentic PayPal site. Basically when these vulnerable browsers check the domain name contained in the attacker's certificate, they stop reading any characters that follow the "\0 in the name.'"
\0wned (Score:5, Funny)
\0\0ps.
Re:\0wned (Score:5, Funny)
I don't get it, you didn't post anything.
Re:\0wned (Score:5, Funny)
Re:Is the null character valid in a domain name? (Score:3, Funny)
Dan Kaminski, would you STOP ALREADY !! (Score:5, Funny)
Go do something else for a while. If it were not for you we all would be safer !!
So now... (Score:5, Funny)
All we have to do is get the CAs to pay attention to the certs they issue, correct?
Uh-oh. We're screwed.
MS BSTR and null terminated strings (Score:1, Funny)
It's a shame that the Microsoft BSTR didn't become the dominant form of string, then these problems wouldn't be occurring.
Re:When C Strings Attack! (Score:3, Funny)
Re:When C Strings Attack! (Score:4, Funny)
The first string says to the bartender, "Give me a beer." The bartender turns to the second string and says, "and what about for you?" To which the second string replies, "I would also like a beer#@a9101gb230b81;kajf3#$B89*#()*13!$%#@$"" and goes on and on spewing gibberish.
The bartender, shocked, asks the first string, "What is your buddy's problem?"
The first string answers, "Oh, you'll have to excuse him, he isn't null terminated."
Re:\0wned (Score:1, Funny)
Better than Moxie CrimeFighter (daughter of Penn Jillette)?
Or, given the subject, Robert'); DROP TABLE Students; -- (aka Little Bobby Tables [xkcd.com])...
Paypal.com versus Badguy.com (Score:5, Funny)
I don't get it.
Isn't this just the same company?
Re:And we trust CAs *why* again? (Score:3, Funny)
Really? It seems to me that with a centralized system, you have one entity controlling trust. If you want to subvert that, you have to convince that entity that you are trust worthy. If you have a decentralized system, you could have 1000 entities controlling trust. That's 9999 more chances you have to trick someone.
Well, one thing I certainly can't trust is Slashdot users' ability to do arithmetic.
Hmmm... (Score:3, Funny)
Or would that be Slashdot's good twin?