Rogue digital certificates strike blow to Internet security |
 |
By Dennis Fisher, Executive Editor
30 Dec 2008 | SearchSecurity.com |
|
|
A team of seven security researchers has found a way to exploit a weakness in the MD5 hash function to construct a rogue certificate authority and issue digital certificates that will be trusted by all of the common Web browsers in use today.
|
| SearchSecurity.com: |
| To get security news and tips delivered to your inbox, click here to sign up for our free newsletter. |
|
|
|
|
The results of the researchers' work are a blow to the security and trust infrastructure on the Internet, making it difficult for users to know which sites and certificates are trustworthy. However, because most certificate authorities (CA)have already have moved away from MD5 in favor of the newer SHA-1 hash function, the attack cannot be used against those CAs. Still, as long as certificate authorities continue to use the weaker MD5 function the discovery looms as a serious potential exploit.
And this is a real attack, not a theoretical one that has yet to be proven and may never be used in the real world. The method is likely within reach of well-funded criminal groups with the time to devote to it. But it would still take a lot of resources to accomplish, experts say. The computational power required to generate the colliding MD5 streams is significant and the calculations must be done quickly. Part of the attack requires that the attackers be able to predict the sequence numbers that will be assigned to the certificates, and that requires that they be submitted to the CA within a specific time window.
"It's definitely within reach of cybercriminals that have access to a botnet," said Dino Dai Zovi, an independent security researcher who was briefed on the group's work. "The computations have to be done relatively quickly, and the equivalent time could be purchased from Amazon or done more easily with a botnet. Access to a relatively small botnet is enough to do this relatively quickly," Dai Zovi said.
The researchers, who plan to deliver their results in a talk at the Chaos Communication Congress in Berlin on Tuesday, expanded on previous work done by a team of Chinese experts in 2004 and were able to overcome some of the technical hurdles the group faced in its work. The earlier work showed that it was possible to create two separate messages using MD5 that would have identical digital fingerprints. The result of these collision attacks is that there is no way to tell which one is the authentic message. The latest work, done by a group of European and American researchers, greatly reduces the amount of time it takes to produce a collision and also take it a step farther by using the attack to create a rogue CA.
Using this method, the researchers were able to generate two digital certificates for a legitimate domain owned by one of the researchers: a Web server certificate and a CA certificate. They sent the server certificate to a legitimate CA, had it signed, then pasted the digital signature from the signed certificate onto the rogue CA certificate. This creates a trusted intermediate CA certificate. Because of the collision weakness in MD5, the rogue certificate is validated as being legitimate. Once the rogue certificate authority is up and running, the researchers can then issue any other digital certificates they choose.
"We're a real CA at that point. We can issue any kind of certificate we want," said Alex Sotirov, an independent security researcher and member of the team that developed the method. The other researchers include Marc Stevens of the Centrum Wiskinde & Informatica in the Netherlands, Jacob Applebaum of Noisebridge and the Tor Project, Arjen Lenstra of the Ecole Polytechnique Federale de Lausanne, David Molnar of UC Berkeley, Dag Arne Osvik of the EPFL and Benne de Weger of the Eindhoven University of Technology.
"The reason we could do this is because some real CAs use MD5 even though it's been broken since 2004," Sotirov said. "There are about 50 CAs that browsers trust and we found that five of them are still using MD5."
The researchers have spoken with both Microsoft and Mozilla about the attack and both organizations are aware of the details. Sotirov said that Microsoft is going to work with the group to help encourage the remaining CAs to abandon MD5 as soon as possible.
"If an attacker is able to put one of these certificates in a network path, he could transparently man-in-the-middle SSL communications," said Dai Zovi. "You could even issue extended validation SSL certificates. If someone has a rogue CA, your browser only gives you very minimal information about the validity of the certificate. It tells you who signed it, but if it's signed by someone one day and by someone else the next day, it doesn't alert you. All of the trusted CAs are trusted equally, which makes no sense."
To implement their attack, the group used a cluster of about 200 commercially available PlayStation 3 game consoles, which Sotirov said were excellent for number crunching and had the power of about 40 single-core processors.
The group's work represents a rare example of collaboration between academic security experts and those, like Sotirov, who work on offensive security research. The two groups don't often have common interests or methods, and Sotirov said the group has been working on the attack since late summer. Part of the delay in publishing the results has been caused by the group's concerns about possible legal action from vendors affected by the attack. As of Monday, no legal challenges to the presentation's content had surfaced.
|
|
|
|
