No attack necessary
- 9 December 2013
- conference paper
- conference paper
- Published by Association for Computing Machinery (ACM) in Proceedings of the 29th Annual Computer Security Applications Conference
Abstract
Much of the Internet's end-to-end security relies on the SSL/TLS protocol along with its underlying X.509 certificate infrastructure. However, the system remains quite brittle due to its liberal delegation of signing authority: a single compromised certification authority undermines trust globally. Several recent high-profile incidents have demonstrated this shortcoming convincingly. Over time, the security community has proposed a number of counter measures to increase the security of the certificate ecosystem; many of these efforts monitor for what they consider tell-tale signs of man-in-the-middle attacks. In this work we set out to understand to which degree benign changes to the certificate ecosystem share structural properties with attacks, based on a large-scale data set of more than 17 billion SSL sessions. We find that common intuition falls short in assessing the maliciousness of an unknown certificate, since their typical artifacts routinely occur in benign contexts as well. We also discuss what impact our observations have on proposals aiming to improve the security of the SSL ecosystem.Keywords
Funding Information
- Army Research Office (MURI W911NF-09-1-0553)
- German Academic Exchange Service
- Advanced Cyberinfrastructure (ACI-1032889)
- U.S. Army Research Laboratory (MURI W911NF-09-1-0553)
This publication has 10 references indexed in Scilit:
- Analysis of the HTTPS certificate ecosystemPublished by Association for Computing Machinery (ACM) ,2013
- SoK: SSL and HTTPS: Revisiting Past Challenges and Evaluating Certificate Trust Model EnhancementsPublished by Institute of Electrical and Electronics Engineers (IEEE) ,2013
- Certified Lies: Detecting and Defeating Government Interception Attacks against SSL (Short Paper)Lecture Notes in Computer Science, 2012
- X.509 Forensics: Detecting and Localising the SSL/TLS Men-in-the-MiddleLecture Notes in Computer Science, 2012
- The SSL landscapePublished by Association for Computing Machinery (ACM) ,2011
- PKI Layer Cake: New Collision Attacks against the Global X.509 InfrastructureLecture Notes in Computer Science, 2010
- Browser interfaces and extended validation SSL certificatesPublished by Association for Computing Machinery (ACM) ,2009
- Exploring User Reactions to New Browser Cues for Extended Validation CertificatesLecture Notes in Computer Science, 2008
- Bro: a system for detecting network intruders in real-timeComputer Networks, 1999
- The base-rate fallacy and its implications for the difficulty of intrusion detectionPublished by Association for Computing Machinery (ACM) ,1999