Measuring and Applying Invalid SSL Certificates

Chung, Tae-Sun; Liu, Yabing; Choffnes, David; Levin, Dave; Maggs, Bruce M.; Mislove, Alan; Wilson, Christo

doi:10.1145/2987443.2987454

Cited by 66 publications

(30 citation statements)

References 27 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…In a broader context, our work builds on extensive related work on active DNS measurements [2,32,[70][71][72]83], as well as more recent work aimed at understanding the role of domain registrars and DNS operators [24]. For a background on TLS and Web Security, we recommend prior work [3,22,25].…”

Section: Related Work and Backgroundmentioning

confidence: 99%

A First Look at Certification Authority Authorization (CAA)

Scheitle

Chung

Hiller

et al. 2018

SIGCOMM Comput. Commun. Rev.

Self Cite

View full text Add to dashboard Cite

Shaken by severe compromises, the Web's Public Key Infrastructure has seen the addition of several security mechanisms over recent years. One such mechanism is the Certification Authority Authorization (CAA) DNS record, that gives domain name holders control over which Certification Authorities (CAs) may issue certificates for their domain. First defined in RFC 6844, adoption by the CA/B forum mandates that CAs validate CAA records as of September 8, 2017. The success of CAA hinges on the behavior of three actors: CAs, domain name holders, and DNS operators. We empirically study their behavior, and observe that CAs exhibit patchy adherence in issuance experiments, domain name holders configure CAA records in encouraging but error-prone ways, and only six of the 31 largest DNS operators enable customers to add CAA records. Furthermore, using historic CAA data, we uncover anomalies for already-issued certificates. We disseminated our results in the community. This has already led to specific improvements at several CAs and revocation of mis-issued certificates. Furthermore, in this work, we suggest ways to improve the security impact of CAA. To foster further improvements and to practice reproducible research, we share raw data and analysis tools.

show abstract

Section: Related Work and Backgroundmentioning

confidence: 99%

A First Look at Certification Authority Authorization (CAA)

Scheitle

Chung

Hiller

et al. 2018

SIGCOMM Comput. Commun. Rev.

Self Cite

View full text Add to dashboard Cite

show abstract

“…We then identify 5,067,476 valid leaf certificates using these root and intermediate certificates, covering 2,552,936 unique domains (including domains in SAN lists). 6 We ignore invalid certificates in this paper [6].…”

Section: Ssl Certificatesmentioning

confidence: 99%

Measurement and Analysis of Private Key Sharing in the HTTPS Ecosystem

Cangialosi

Chung

Choffnes

et al. 2016

Proceedings of the 2016 ACM SIGSAC Conference on Computer and Communications Security

Self Cite

View full text Add to dashboard Cite

The semantics of online authentication in the web are rather straightforward: if Alice has a certificate binding Bob's name to a public key, and if a remote entity can prove knowledge of Bob's private key, then (barring key compromise) that remote entity must be Bob. However, in reality, many websites-and the majority of the most popular ones-are hosted at least in part by third parties such as Content Delivery Networks (CDNs) or web hosting providers. Put simply: administrators of websites who deal with (extremely) sensitive user data are giving their private keys to third parties. Importantly, this sharing of keys is undetectable by most users, and widely unknown even among researchers. In this paper, we perform a large-scale measurement study of key sharing in today's web. We analyze the prevalence with which websites trust third-party hosting providers with their secret keys, as well as the impact that this trust has on responsible key management practices, such as revocation. Our results reveal that key sharing is extremely common, with a small handful of hosting providers having keys from the majority of the most popular websites. We also find that hosting providers often manage their customers' keys, and that they tend to react more slowly yet more thoroughly to compromised or potentially compromised keys.

show abstract

“…Different works examine TLS deployments, i.e., the TLS and certificate configuration of Internet-facing embedded devices [57], the spread of flaws in key generation [27] or TLS implementations [61], and the shift to newer versions and features [1]. Further, related work analyzed security certificates regarding configuration [32], validity [7], wrong issuance [38], and certificate transparency logs [22]. Besides HTTPS deployments, also communication services [31] and SSH were examined [23].…”

Section: Related Workmentioning

confidence: 99%

Easing the Conscience with OPC UA

Dahlmanns

Lohmöller

Fink

et al. 2020

Proceedings of the ACM Internet Measurement Conference

View full text Add to dashboard Cite

Due to increasing digitalization, formerly isolated industrial networks, e.g., for factory and process automation, move closer and closer to the Internet, mandating secure communication. However, securely setting up OPC UA, the prime candidate for secure industrial communication, is challenging due to a large variety of insecure options. To study whether Internet-facing OPC UA appliances are configured securely, we actively scan the IPv4 address space for publicly reachable OPC UA systems and assess the security of their configurations. We observe problematic security configurations such as missing access control (on 24% of hosts), disabled security functionality (24%), or use of deprecated cryptographic primitives (25%) on in total 92% of the reachable deployments. Furthermore, we discover several hundred devices in multiple autonomous systems sharing the same security certificate, opening the door for impersonation attacks. Overall, in this paper, we highlight commonly found security misconfigurations and underline the importance of appropriate configuration for security-featuring protocols.

show abstract

Measuring and Applying Invalid SSL Certificates

Cited by 66 publications

References 27 publications

A First Look at Certification Authority Authorization (CAA)

A First Look at Certification Authority Authorization (CAA)

Measurement and Analysis of Private Key Sharing in the HTTPS Ecosystem

Easing the Conscience with OPC UA

Contact Info

Product

Resources

About