I'm very late to this story (Ars Technica last updated it eight months ago): apparently an Arizona company, Packet Forensics, "was covertly selling a piece of hardware designed to perform ... man-in-the-middle attacks" against SSL/TLS connections.
What is a man-in-the-middle (MITM) attack? It's a conceptually straightforward, decidedly dangerous subversion of the initial negotiation that is needed to set up so-called "secure" online connections. The idea is to interpose oneself between the two communicating parties, not to disrupt the conversation, but to listen to it.
Secure Web communications, those denoted by "https" and typically described as "secured by SSL," require the communicating parties to identify one another before they send real data, precisely to prevent MITM attacks. (In practice, servers often do not bother to verify the client's identity, however.) The identification process depends on trusted third parties known as certificate authorities, or CAs. In theory, a MITM attack should be exceedingly difficult against an SSL (or rather, TLS) connection. However, if you can subvert the CA so it's willing to issue fraudulent certificates for you, you have solved 90% of the MITM problem. Your CA can issue a certificate attesting that you are amazon.com, or Bill Gates, or whoever you need to be; the end user will verify that your CA "confirms" the certificate belongs to Amazon or Bill Gates or whomever. Neither the end user nor Amazon (or Bill Gates, or whoever) will detect your successful MITM attack.
So for Packet Forensics' box to have a market, one or more CAs must be betraying their core mission, and therefore, all of us. All of us.
As Ars Technica (and Wired, in a better article on this topic) notes, Verisign and GoDaddy, two of the largest CAs, both deny they would ever issue a fake certificate, and indeed claim they've never been asked to do so. That doesn't mean other CAs, particularly those that belong to governments, wouldn't agree to do so. In fact, the truly suspicious (and I step into and out of that camp, depending on the weather) will not discount the possibility that Verisign and GoDaddy simply are lying, by choice or under pressure.
I'd guess that when the EFF's concerns about untrustworthy CAs were discussed by the New York Times in August, the EFF was talking about Packet Forensics' hardware and the implications it had. As I mentioned back then, there is really no good technical solution to this problem.
There is one more aspect of this matter that needs to be aired. I said that a corrupt CA gets a malefactor 90% of the way to his desired aim of being able to execute a MITM attack. The other 10% lies in getting the corrupt CA's certificate into the major browsers. (I pulled those percentages out of my ... well, don't take them too seriously.)
To understand how the major browsers are involved, we need to look at how certificates are verified.
Certificate verification requires that one confirm the certificate's digital signature. The signature is a computed value which is (believed to be) proof against tampering: that is, any attempt to alter a signed document will invalidate the signature (as far as mathematicians know). The caveats are for precision: as a practical matter, we can consider a valid digital signature to guarantee a document's integrity and origin.
Every certificate is digitally signed by its issuer. To verify a certificate requires obtaining its issuer's public key, which means obtaining the issuer's certificate. Of course, this chain of verification cannot regress to infinity: in the real world, it terminates with a special certificate that has been self-signed. A self-signed certificate is a document that essentially asserts, "I am I."
As you can imagine, such a certificate either means absolutely nothing, or virtually everything. Why would you trust it?
The answer, for better or worse, is necessity. The chain of trust represented by certificates somehow must be bootstrapped, or the whole enterprise is a non-starter. Yet it is unwise to accept just any self-signed certificate, and in fact, we seldom if ever are asked to do so in our wanderings on the Web. The reason is that the makers of major browsers incorporate a set of self-signed certificates, also known as root certificates, that are automatically trusted by the browser. These root certificates have been issued by "recognized" CAs, and a browser considers certificate verification successful if the verification leads back to one of these root certificates.
How do the browser makers decide which root certificates to trust? That's the $64,000 question. I have suspicions that center around black goats, silver daggers, and hooded adepts chanting under the full moon, but these are mere suspicions. The bottom line is that if a root certificate from a corrupt CA is trusted by your browser, all of your secure Web interactions are at risk.
Regrettably, the browser makers likely don't have much better knowledge than anyone else of who the corrupt CAs are. You could argue that, by assuming responsibility for bootstrapping trust, the makers took upon themselves the responsibility for ensuring our safety, too, but if you push that argument hard enough the browser makers will simply stop shipping with any root certificates and we'll be left to fend for ourselves. That's a prospect that will please few.
No comments:
Post a Comment