Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Ssl.com: DCV bypass and issue fake certificates for any MX hostname

bugzilla.mozilla.org

Post reply on HN
Print view View original

31–40 of 66 posts

Re: Ssl.com: DCV bypass and issue fake certificates for any MX hostname

#31

Post by m_sahaf »

btown wrote: post #26

Public service announcement: CAA records exist and allow you to whitelist the CAs you trust to issue certificates for your domain. https://letsencrypt.org/docs/caa/ You can use https://www.entrust.com/resources/tools/caa-lookup (or e.g. `dig caa paypal.com`) to see if any domain is protected. https://isc.sans.edu/diary/26738 is a cautionary study from 2020 indicating only 3% of the Alexa top 1M had CAA records. And j…

I always wonder who/what checks if CAs respect CAA. I know some browsers now check the certificate transparency log, but are there any that check the CAA record against the issuer of the certificate?

Re: Ssl.com: DCV bypass and issue fake certificates for any MX hostname

#32

Post by remram »

0x0 wrote: post #6

So I guess you couldn't get certificates for any random (MX) domain, only for those where you can obtain an inbox / user account. Still really bad, especially for things like gmail.com, but also larger enterprises. Intense.

Or any domain for which you can read an email sent to an inbox. I remember a few years ago an attack where the attacker would read email because a ticket would be created for incoming emails, and he could guess the next ticket ID to read it. A lot of platform that aren't email providers still allow emails in (e.g. GitHub, GitLab). This looks like a rather widely-applicable attack.

edit: I was thinking about this: https://news.ycombinator.com/item?id=41818459

Re: Ssl.com: DCV bypass and issue fake certificates for any MX hostname

#33

Post by tgsovlerkhgsel »

btown wrote: post #26

Public service announcement: CAA records exist and allow you to whitelist the CAs you trust to issue certificates for your domain. https://letsencrypt.org/docs/caa/ You can use https://www.entrust.com/resources/tools/caa-lookup (or e.g. `dig caa paypal.com`) to see if any domain is protected. https://isc.sans.edu/diary/26738 is a cautionary study from 2020 indicating only 3% of the Alexa top 1M had CAA records. And j…

The CAA whitelist is still enforced by the CAs themselves, so a malicious, compromised or buggy CA could ignore it. You still have to monitor CT. CAA mostly does two things:

1. It makes sure that nobody accidentally issues a cert from another CA (giving you better control, avoiding the "an engineer used a different CA" scenario, and meaning that if you see a cert from another CA, you know it's something Very Not Good).

2. It gives you a chance that an attacker able to bypass some but not all controls on a crappy CA won't be able to use that CA to get a cert for your site (if they don't manage to somehow also bypass the CAA check).

I'm not sure whether CAA would have prevented this CA from issuing for this domain. I think it's more likely than not, but not certain, that it would have helped in this case.

Re: Ssl.com: DCV bypass and issue fake certificates for any MX hostname

#34

Post by 9dev »

m_sahaf wrote: post #31
btown wrote: post #26

Public service announcement: CAA records exist and allow you to whitelist the CAs you trust to issue certificates for your domain. https://letsencrypt.org/docs/caa/ You can use https://www.entrust.com/resources/tools/caa-lookup (or e.g. `dig caa paypal.com`) to see if any domain is protected. https://isc.sans.edu/diary/26738 is a cautionary study from 2020 indicating only 3% of the Alexa top 1M had CAA records. And j…

I always wonder who/what checks if CAs respect CAA. I know some browsers now check the certificate transparency log, but are there any that check the CAA record against the issuer of the certificate?

Wouldn’t that be an obvious quick win?

Re: Ssl.com: DCV bypass and issue fake certificates for any MX hostname

#35

Post by agwa »

m_sahaf wrote: post #31
btown wrote: post #26

Public service announcement: CAA records exist and allow you to whitelist the CAs you trust to issue certificates for your domain. https://letsencrypt.org/docs/caa/ You can use https://www.entrust.com/resources/tools/caa-lookup (or e.g. `dig caa paypal.com`) to see if any domain is protected. https://isc.sans.edu/diary/26738 is a cautionary study from 2020 indicating only 3% of the Alexa top 1M had CAA records. And j…

I always wonder who/what checks if CAs respect CAA. I know some browsers now check the certificate transparency log, but are there any that check the CAA record against the issuer of the certificate?

No, because the CAA record only has to be in place at the time of issuance, rather than the whole lifetime of the certificate.

Even if the semantics of CAA were changed, the challenges described in paragraph 3 of this post would apply: https://www.imperialviolet.org/2015/01/17/notdane.html

Re: Ssl.com: DCV bypass and issue fake certificates for any MX hostname

#36

Post by tptacek »

jenny91 wrote: post #13

Wow... this is the most serious TLS issue I've seen since following these things.

It's bad, but the WebPKI of the oughts featured CA certificates issued to random big enterprise IT teams that could simply issue arbitrary certificates. We've come a long ways.

Re: Ssl.com: DCV bypass and issue fake certificates for any MX hostname

#37

Post by londons_explore »

agwa wrote: post #35
m_sahaf wrote: post #31

Earlier quoted context omitted.

I always wonder who/what checks if CAs respect CAA. I know some browsers now check the certificate transparency log, but are there any that check the CAA record against the issuer of the certificate?

No, because the CAA record only has to be in place at the time of issuance, rather than the whole lifetime of the certificate. Even if the semantics of CAA were changed, the challenges described in paragraph 3 of this post would apply: https://www.imperialviolet.org/2015/01/17/notdane.html

> No, because the CAA record only has to be in place at the time of issuance, rather than the whole lifetime of the certificate.

could we change this? Ie. if the CAA record disappears, it would be a reason to revoke a certificate?

Then 3rd parties could scan transparency logs and CAA records and flag discrepancies.

Re: Ssl.com: DCV bypass and issue fake certificates for any MX hostname

#38

Post by jchw »

tgsovlerkhgsel wrote: post #33
btown wrote: post #26

Public service announcement: CAA records exist and allow you to whitelist the CAs you trust to issue certificates for your domain. https://letsencrypt.org/docs/caa/ You can use https://www.entrust.com/resources/tools/caa-lookup (or e.g. `dig caa paypal.com`) to see if any domain is protected. https://isc.sans.edu/diary/26738 is a cautionary study from 2020 indicating only 3% of the Alexa top 1M had CAA records. And j…

The CAA whitelist is still enforced by the CAs themselves, so a malicious, compromised or buggy CA could ignore it. You still have to monitor CT. CAA mostly does two things: 1. It makes sure that nobody accidentally issues a cert from another CA (giving you better control, avoiding the "an engineer used a different CA" scenario, and meaning that if you see a cert from another CA, you know it's something Very Not Good…

Unfortunately the best solution there was for this problem was probably HPKP, which fell out of favor years ago. Would be nice to have some kind of solution for this some day; I think it would compliment CT very well.

Re: Ssl.com: DCV bypass and issue fake certificates for any MX hostname

#39

Post by londons_explore »

AdamJacobMuller wrote: post #14
tptacek wrote: post #7

Earlier quoted context omitted.

It is unlikely that SSL.com would issue a certificate for any major mail host; it would be malpractice for them not to have some kind of exclusion list. Issuing a Google certificate is a good way to get your whole CA killed.

Sure, gmail.com might be excluded, but its still a massive hole for a few reasons. This would affect ANY email provider who offers public email addresses. While I agree gmail.com is probably excluded (and maybe this doesn't bypass CAA -- maybe it does) there's a whole additional surface of anyone who has an email at any big enterprise getting a certificate for their domain. Even if I work at google.com, therefore hav…

plenty of companies have mailing lists which are listname@companydomain.com

Getting on those lists is often easy. Same with support ticketing systems, etc.

Re: Ssl.com: DCV bypass and issue fake certificates for any MX hostname

#40

Post by cortesoft »

btown wrote: post #26

Public service announcement: CAA records exist and allow you to whitelist the CAs you trust to issue certificates for your domain. https://letsencrypt.org/docs/caa/ You can use https://www.entrust.com/resources/tools/caa-lookup (or e.g. `dig caa paypal.com`) to see if any domain is protected. https://isc.sans.edu/diary/26738 is a cautionary study from 2020 indicating only 3% of the Alexa top 1M had CAA records. And j…

So CAS records are supposed to keep a CA from issuing a certificate if the CAA record exists and doesn't have that CA.

However, this is relying on the CA to properly check the record. If the CA has a bug where it isn't validating properly, they could also fail to check the CAA properly. Also, this doesn't help against a malicious or compromised CA.

Post reply on HN