Let's Encrypt Flaw Allowed Hackers to Hijack Certificates

itman · Jan 15, 2018

The organization behind Let’s Encrypt has moved quickly to fix a vulnerability which could have allowed attackers to obtain certificates for domains they did not own.

The Certificate Authority (CA), which hands out free SSL and TLS certificates to make the internet a safer place, was notified of the bug last week by Detectify researcher Frans Rosén.

The problem was identified in the ACME protocol’s TLS-SNI-01 challenge process.

During that process, the ACME server validates a domain name by generating a random token and communicating it to the ACME client. That client then creates a self-signed certificate with a specific, invalid hostname and configures the web server on the domain to be validated to serve that certificate.

For its part, the Internet Security Research Group (ISRG) disabled TLS-SNI-01 as soon as it was informed of the vulnerability.

Hari Nair, director of cryptographic research at Venafi, argued that the issue stems from weak security practices at some hosting providers.

“Let’s Encrypt has mitigated the damage to a certain extent, but ultimately, how effective those steps will be depends on how well hosting providers implement certificate security on their end,” he added.
Click to expand...

https://www.infosecurity-magazine.com/news/lets-encrypt-flaw-hackers-to/

ronjor · Jan 15, 2018

Posted here. https://www.wilderssecurity.com/threads/lets-encrypt.373823/page-3#post-2730627

Log in or Sign up

Let's Encrypt Flaw Allowed Hackers to Hijack Certificates

itman Registered Member

ronjor Global Moderator

Log in or Sign up

Let's Encrypt Flaw Allowed Hackers to Hijack Certificates

itman Registered Member

ronjor Global Moderator

Useful Searches