The security research blog of Trustwave's SpiderLabs, covering malware, web attacks, vulnerabilities, and certificate authority issues.
HN links it as a primary source for the Moar Pony malware post and in discussions of Trustwave's subordinate root certificate controversy.
Note TrustWave, a widely trusted certificate authority, has recently explicitly acknowledged selling devices with subordinate root certificates that allow them to spoof certs for any domain that they want in order to allow companies to snoop on their employees. http://blog.spiderlabs.com/2012/02/clarifying-the-trustwave-ca-policy-update.html
If they are willing to sell these to private organizations, who's to say that one of the many certificate authorities have not sold such devices or certificates to repressive governments?
SSL is basically a joke at this point. Because it requires you to trust every single certificate authority for every single domain, it basically means that you are only protected against the average script kiddie, not a dedicated attacker. There have been plenty of CAs compromised, who continued to issue MD5 signed certificates well after it was broken, who are within the control of authoritarian governments, or who are willing to sell subordinate root certs for the purpose of snooping to any company who is willing to pay enough.
And that's not to mention that even if the information is properly protected in transit, putting this information on your servers makes you that much more vulnerable to attackers who may want access to this information, the government of the country in which it is hosted, legal process, or any number of other threats. Even if they had properly secured the information in transit, and SSL were secure, it still vastly increases…
Do CRLs even work? My understanding is that the only browser that hard-fails to load a page if OCSP is blocked is Chrome for certs in CRLSets. Everyone else is vulnerable to MITM if access to the CRL / OCSP servers is blocked.
I would love to be wrong. Does anyone know if anything has changed for the better since 2011?
http://blog.spiderlabs.com/2011/04/certificate-revocation-behavior-in-modern-browsers.html
http://dev.chromium.org/Home/chromium-security/crlsets
https://www.imperialviolet.org/2011/03/18/revocation.html
In case anyone is interested the primary source for the article is the following blog post (it is slightly buried):
http://blog.spiderlabs.com/2013/12/look-what-i-found-moar-pony.html
What about this one? http://blog.spiderlabs.com/2013/12/look-what-i-found-moar-pony.html