Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Let’s Encrypt Now Being Abused by Malvertisers

blog.trendmicro.com

Post reply on HN
Print view View original

21–30 of 71 posts

Re: Let’s Encrypt Now Being Abused by Malvertisers

#21

Post by jvdh »

aftbit wrote: post #5

>Let’s Encrypt only checks domains that it issues against the Google safe browsing API; in addition, they have stated that they do not believe CAs should act as a content filter. Security on the infrastructure is only possible when all critical players – browsers, CAs, and anti-virus companies – play an active role in weeding out bad actors. I agree strongly with Let's Encrypt's view. They should not be responsible f…

Exactly, their statement has been made in October already: https://letsencrypt.org/2015/10/29/phishing-and-malware.html

That statement did not contain anything on other kinds of reports. They do have an email address for reporting certificate abuse. So far, I have not been able to find any public statements on how they will handle that.

Re: Let’s Encrypt Now Being Abused by Malvertisers

#22

Post by nulagrithom »

qopp wrote: post #14
ponytech wrote: post #3

IMO the problem is more "attackers who have gained the ability to create subdomains under a legitimate domain" (not explained how) than Let's Encrypt.

There are sites that do this as part of their core ui, such as deviantart.

https://letsencrypt.org/howitworks/technology/#domain-valida...

There's a bit more to it than "allowing subdomain creation". You will need control over the DNS records, or ability arbitrarily change the page (essentially).

Re: Let’s Encrypt Now Being Abused by Malvertisers

#23

Post by cm2187 »

aftbit wrote: post #5

>Let’s Encrypt only checks domains that it issues against the Google safe browsing API; in addition, they have stated that they do not believe CAs should act as a content filter. Security on the infrastructure is only possible when all critical players – browsers, CAs, and anti-virus companies – play an active role in weeding out bad actors. I agree strongly with Let's Encrypt's view. They should not be responsible f…

In fact it's not more of an abuse of let's encrypt than it is an abuse of the linux, apache and openssl used to host these malicious websites. All of which are doing their job. The domain owner is the one not doing his.

Re: Let’s Encrypt Now Being Abused by Malvertisers

#24

Post by MrSwagga »

ars wrote: post #13

I'm unclear about what the problem is. So the traffic is encrypted. How does that make anything worse? It seems pretty irrelevant to me if it's encrypted or not.

Maybe because it can't be automatically detected by some layer 7 firewall filters/web proxies.

Re: Let’s Encrypt Now Being Abused by Malvertisers

#25

Post by lini »

ars wrote: post #13

I'm unclear about what the problem is. So the traffic is encrypted. How does that make anything worse? It seems pretty irrelevant to me if it's encrypted or not.

Not 100% sure, but if the malicious ad is put on an HTTPS page, it would not be possible to load additional scripts and data from an un-encrypted (HTTP) location as opposed to another valid HTTPS location. Having your malware on an HTTPS site goes around the browser's mixed content restrictions.

Re: Let’s Encrypt Now Being Abused by Malvertisers

#26

Post by erostrate »

ars wrote: post #13

I'm unclear about what the problem is. So the traffic is encrypted. How does that make anything worse? It seems pretty irrelevant to me if it's encrypted or not.

Indeed, trendmicro doesnt say anything about that. Let's Encrypt says "The concern most commonly expressed is that having valid HTTPS certificates helps these sites look more legitimate, making people more likely to trust them." I agree with Let's Encrypt position, they are not to blame here.

https://letsencrypt.org/2015/10/29/phishing-and-malware.html

Re: Let’s Encrypt Now Being Abused by Malvertisers

#27

Post by eridius »

zamalek wrote: post #20
aftbit wrote: post #5

>Let’s Encrypt only checks domains that it issues against the Google safe browsing API; in addition, they have stated that they do not believe CAs should act as a content filter. Security on the infrastructure is only possible when all critical players – browsers, CAs, and anti-virus companies – play an active role in weeding out bad actors. I agree strongly with Let's Encrypt's view. They should not be responsible f…

There is a way to avoid this issue: Let's Encrypt should disallow subdomain registrations unless a TXT record is present for the parent domain. For example, if I wanted to get a certificate for bar.foo.example.com there would need to be a Let's Encrypt TXT record for foo.example.com. Although it's not their responsibility, they can take steps to mitigate it.

Why is this something they should do? If I have complete control over a subdomain bar.foo.example.com, why do I need cooperation from the parent foo.example.com in order to set up something basic like an SSL certificate?

Re: Let’s Encrypt Now Being Abused by Malvertisers

#28

Post by supermatt »

I havent used Lets Encrypt, but other CAs would validate the owner of the TLD by sending an email to hostmaster. You wouldnt be able to have certificates issued on a subdomain unless you are verified as owner of the TLD. Is this not the case here, and if not, why not?

Re: Let’s Encrypt Now Being Abused by Malvertisers

#29

Post by droopybuns »

aftbit wrote: post #5

>Let’s Encrypt only checks domains that it issues against the Google safe browsing API; in addition, they have stated that they do not believe CAs should act as a content filter. Security on the infrastructure is only possible when all critical players – browsers, CAs, and anti-virus companies – play an active role in weeding out bad actors. I agree strongly with Let's Encrypt's view. They should not be responsible f…

Encrypting everything has consequences.

I recently had an IoT pairing issue between two devices. A normal human will not run wireshark to troubleshoot a pairing failure between two devices. I did. I was rewarded with a shitty protocol that could not be evaluated for errors and a moderated support forum that encouraged me to reboot my router.

Taken to its extreme conclusion- there are important networking problems that are amplified if we encrypt all the packets.

Sometimes, I feel like the EFF is composed of idealistic teenagers with limited understanding of how the world outside of their first hop works. I generally support them, but it is always at arms length.

Post reply on HN