Tuesday on the Deeplinks Blog on the Electronic Frontier Foundation website, an article titled “How secure is HTTPS today? How often is it attacked?” was published.
The EFF post doesn’t focus on bugs in specific implemenations of TLS that could allow forged certificates to be accepted in only a subset of vulnerable browsers. Rather, it tackles the number of ways a Certificate Authority (CA) could be compromised. A Certificate Authority publishes digital certificates, which are documents that assert that a public key indeed belongs to a given host. A modern web browser will trust certificates handed out by any one of over 600 CAs, and the compromisation of even one CA means that a malicious entity could pose as a trusted host, even if the trusted host has configured everything correctly.
The article lists the following ways a CA could be compromised:
- Using a vulnerability in the CA to sign your own certificates.
- Compromising network infrastructure near a CA to forge packets going in and out, thus forcing the CA to generate a certificate for you.
- Forging a DNS entry in a way that makes a domain point to your IP address.
- Spoofing TCP or BGP packets to route traffic for a domain to your IP.
- Having a government intervene on your behalf and ordering a CA to issue a certificate. (Trusted CAs, as a side note, are located in over 52 countries.)
This article should be a powerful wake-up call to anyone who thinks that HTTPS is a completely secure method for transporting data. SSL, when implemented and configured correctly, is fairly foolproof, but there is still no comprehensive way to verify the integrity of a DNS record or digital certificate. The article is part 1 of a series that promises to examine “the security of HTTPS and TLS/SSL.” It is definitely a series of posts to keep your eye on if you are concerned about security on the Web.