Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Symantec Issues Intermediate CA Certificate for Blue Coat Public Services

crt.sh

Post reply on HN
Print view View original

71–80 of 118 posts

Re: Symantec Issues Intermediate CA Certificate for Blue Coat Public Services

#71

Post by maulwuff »

throwaway2048 wrote: post #67
maulwuff wrote: post #61

TL;TR: Don't get wild for no reason. Take instead a look at the certificate. pathlen=0 I doubt that this certificate will be used on BlueCoat appliances to MITM connections. It has a pathlen of 0 which means that it can be used to sign leaf certificates (i.e. for servers) but it cannot be used to create an additional CA. Thus in order to use this CA certificate for MITM on BlueCoat devices BlueCoat would install this…

not true, bluecoat devices could simply ask a bluecoat server with the CA for arbitrary certs.

That's actually a possibility but I very much doubt this would be used in practice. Apart from the scaling problem there is a more serious problem which would make use of this certificate for lots of MITM impossible:

- today's browsers use certificate pinning, i.e. Chrome, Firefox... have predefined lists of sites where they know which public key to expect. One example of such a site is google.com.

- The browser will usually complain if the certificate for this site is not the expected one.

- The browser will not complain on pinned certificates if the CA issuing this certificate was explicitly added as trusted into the browser. This is to allow legal SSL interception, i.e. the one done in lots of companies to protect against malware and data leakage and done by several desktop AV products for the same reason.

Thus, if the certificate is signed by the BlueCoat CA which is implicitly trusted due to derived trust then the browser will complain because the certificate does not match the expected (pinned) one. If instead the certificate was signed by an explicitly installed CA the browser will not complain.

That's actually the way the usage of misissued certificates in Iran was detected (ComodoHacker). So this behavior would make the use of this BlueCoat CA for many MITM attacks impractical.

Re: Symantec Issues Intermediate CA Certificate for Blue Coat Public Services

#72

Post by devishard »

prdonahue wrote: post #58
acveilleux wrote: post #47

Earlier quoted context omitted.

The big question is does the emperor have any clothes? My guess is they'd settle for blocking certs issued after a specific date, at least for a transition period. The alternative would block too much of the internet.

Trust me, Google would take action almost immediately after realizing what happened (if this were to actually go down). Take a look at Ryan Sleevi's previous posts on Symantec: 1. https://security.googleblog.com/2015/10/sustaining-digital-c... 2. https://security.googleblog.com/2015/12/proactive-measures-i... Ryan takes egregious violations of the BRs quite seriously. The CAs cross Google at their own risk. One day y…

Blue Coat need only issue MITM certificates for one large client for a few days to both do a lot of damage and make a lot of money, and if that's their plan, what do they care if they aren't trusted in Chrome afterward?

Re: Symantec Issues Intermediate CA Certificate for Blue Coat Public Services

#73

Post by devishard »

maulwuff wrote: post #61

TL;TR: Don't get wild for no reason. Take instead a look at the certificate. pathlen=0 I doubt that this certificate will be used on BlueCoat appliances to MITM connections. It has a pathlen of 0 which means that it can be used to sign leaf certificates (i.e. for servers) but it cannot be used to create an additional CA. Thus in order to use this CA certificate for MITM on BlueCoat devices BlueCoat would install this…

That's a ridiculous claim. It would be trivial to implement a MITM-as-a-service on a server that Blue Coat devices can connect to. You're providing factually incorrect information.

Re: Symantec Issues Intermediate CA Certificate for Blue Coat Public Services

#74

Post by Dylan16807 »

Spooky23 wrote: post #55
bigiain wrote: post #45

Earlier quoted context omitted.

I'm good with my work or school owned/issued device trusting a root cert installed by that device's owner. I'm _not good with a school or employer's network being able to generate arbitrary certs for my email, bank, social networks, etc - WITHOUT ME KNOWING ABOUT IT ON MY PERSONAL DEVICES... Sure, MitM me if it's your network - but I 100% should be able to rely on my browser on my device reliably being able to tell m…

If you have a problem with that, use your own network.

Do you see no value in SSL at all, then?

Re: Symantec Issues Intermediate CA Certificate for Blue Coat Public Services

#75

Post by Canada »

homero wrote: post #63
Canada wrote: post #53

Earlier quoted context omitted.

I don't see the legitimate use case here. If they're dealing with inbound TLS connections to their cloud services then they can scan or modify the traffic on the cleartext side of the TLS connection. No need to be a CA. If they have clients on their network they want to MITM then that's not a legitimate use case for a CA at all. It doesn't matter if everything is on their network, it's unacceptable that my browser ac…

They needed the excuse to become a ca. Now they can mitm in third world countries

I agree... except replace third world countries with any network they or their customers can access.

Re: Symantec Issues Intermediate CA Certificate for Blue Coat Public Services

#76

Post by kerkeslager »

Aoreias wrote: post #14

This isn't necessarily as nefarious as it seems - Blue Coat is going to have to comply with Symantec's Certification Practice Statement(CPS) which prohibits the issuance of MitM certificates. In all likelihood it's to allow Blue Coat to roll out a service that allows it to create certificates for clients of its security services. Any deviation from that CPS would necessitate revoking this intermediate certificate. Th…

"This isn't necessarily as nefarious as it seems" is nowhere near an acceptable level of trust for a certificate authority.

Re: Symantec Issues Intermediate CA Certificate for Blue Coat Public Services

#77

Post by 0x0 »

inopinatus wrote: post #65
0x0 wrote: post #43

You know, the main job for a web CA is to verify the owner of a domain. What if... domain registrars had that job instead? They definitively know the domain registrant, no need to play games with email verification tokens or http challenges.

Domain registries & registrars do not generally verify the identity of the registrant. It can occur, but only if trademark protection mechanisms are invoked. By testing the DNS, you really verify the domain operator, which in practice means anyone who can update the NS/DS/glue records. It's arguably quite a weak assertion. Similarly this explains why DV certificates are cheap and EV certificates are less cheap.

I was talking about DV certificates. The registrar is in the perfect position to provide this. You could probably even set it up so nobody but the real registrar can issue certificates for a given domain, as opposed to the current free-for-all.

Re: Symantec Issues Intermediate CA Certificate for Blue Coat Public Services

#78

Post by prdonahue »

maulwuff wrote: post #71
throwaway2048 wrote: post #67

Earlier quoted context omitted.

not true, bluecoat devices could simply ask a bluecoat server with the CA for arbitrary certs.

That's actually a possibility but I very much doubt this would be used in practice. Apart from the scaling problem there is a more serious problem which would make use of this certificate for lots of MITM impossible: - today's browsers use certificate pinning, i.e. Chrome, Firefox... have predefined lists of sites where they know which public key to expect. One example of such a site is google.com. - The browser will…

> today's browsers use certificate pinning, i.e. Chrome, Firefox... have predefined lists of sites where they know which public key to expect. One example of such a site is google.com.

Yes, this may be true, but the list is quite small. You may not be able to trick Chrome into connecting to a fake google.com certificate but there's lots other "high security site[s]" as Adam Langley suggests[1] should apply when they opened this up:

> Can I get this for my site? If you run a large, high security site and want Chrome to include pins, let me know.

The reason why this list is small is because key pinning in practice is difficult — and risky. Look to comments on Twitter from Sleevi et al. as to how easy it is to shoot yourself in the foot. HPKP is a terrific idea, but has complicated implementation challenges.

[1] https://www.imperialviolet.org/2011/05/04/pinning.html

Re: Symantec Issues Intermediate CA Certificate for Blue Coat Public Services

#79

Post by prdonahue »

Laforet wrote: post #66
prdonahue wrote: post #59

Earlier quoted context omitted.

Notwithstanding key pinning (which I believe is even overridden by installed private roots), they can issue for google.com as long as they want so long as they get their users to install a private root.

This, MITM using voluntarily installed trust anchors is one thing and explicitly allowed by google, creating a certificate for google.com that will be accepts by all TLS clients is not and Symantec have got in trouble before for doing this.

Completely agree. But there's virtually no way Symantec would turn them loose without confidence in their audit and controls around issuance processes, domain control validation, etc.

I say "virtually" as if they do, Google will drop the hammer on them (again), this time a much heavier one. It's a business risk I just don't see them taking — they have too big of a revenue base to jeopardize it this way.

Re: Symantec Issues Intermediate CA Certificate for Blue Coat Public Services

#80

Post by beedogs »

AaronFriel wrote: post #2

I'm posting this because within the past year, Symantec has gotten in hot water for issuing rogue certificates[1]. While Symantec has agreed to certificate transparency, Blue Coat is a known operator of MITM services they sell to nation-states, and this certificate would allow Blue Coat to issue arbitrary MITM certificates. It's not clear to me why Blue Coat would need to be a trusted CA by all systems and browsers,…

Wow. I knew there was a reason I've always done all my work browsing via a tethered 4g connection and an SSH proxy.
Post reply on HN