It's all about certificate authorities and hate.
T t p s s d p s relies on certificates for it and location that the site is real and the public key
belongs to that site without a certificate.
The security of Haiti to use doesn't work is broken.
The problem is the whole certificate ecosystem is weak and vulnerable to attack.
The security of HTP S is only as strong as the weakest link and in such a large ecosystem of chains
of trust a broken link is inevitable vulnerabilities within the ecosystem could enable the creation
of bogus certificates.
The Everybody then trusts.
If someone can issue a fake certificate that your browser trusts you'll have no idea that hey CPS can
be intercepted and read the hated CPS that you associate with in the U L will still be there.
The padlock will still appear as normal the traffic will be sent encrypted as normal and the certificate
will look valid and everything will look fine.
Whoever issued the fake certificate can decrypt the traffic as they know the private key.
Let me give you some examples of how this is possible and why typically it can't be fully relied on
and therefore hate.
Yes can't really be fully relied on.
Probably the most concerning is the practices of the certificat authorities and vulnerabilities.
Jus certificate authority mistakes.
Or if we have a look here.
This section on the failing of certificate authorities was recorded in 2015.
I'll provide a 20:18 update at the end.
It is very interesting to see what I said in 2015 and the consequences of what happened by 2018.
See the headline.
Google issued ultimatum to Symantec over an authorized Hastey TPSAC figures.
So what's happened here is semantic as issued certificates proclaiming to be from Google.
Google in fact never requested those certificates and semantic is really the market leader in terms
of typical authority.
It's the big daddy if you like of certificate authorities these should be the guys setting the standards
and if we scroll down a little bit go here initially Symantec said that 23 certificates were issued
and when it means 23 certificates it means 23 certificates that shouldn't have been issued.
But then Google has disputed this number saying it is much higher following further examination semantic
said that there was a further 164 certificates over 76 domains and 2000 458 certificates for domains
not even registered.
So that's the degree of the current level of concern over the practices of certificate authorities and
the mistakes that's typical authorities make and this is semantic supposed to be the market leader and
this is not an isolated incident.
If we look here we can see five months ago a separate batch of bogus difficulties that have been issued
for several of Google's domains including which is pretty much all of Google dot com.
See all these other Google domains they are issued by an NGO based MCSA holdings an intermediate certificate
authority that operates under the China Internet Network Information Center.
So you can understand the smallest Devika or authorities are likely to make mistakes and even the bigger
certificate authorities are making mistakes and these hypocrites that would be issued or have been issued
would have been trusted by your browser and everyone else's browser.
So what happened by 2018.
Symantec made repeated violations and top of those mentioned including mis issuing thirty thousand eighty
to be a certificate while Symantec continued to go she ate with both Google and Mozilla over the sanctions
sematic was unable to meet the security demands and ultimately had to sell the business.
Did you see it.
The acquisition included the planned timeline to distrust established by Google and Mozilla Firefox
and Chrome deprecated trust in the semantics Dipika authority including semantic own brands.
So one of the largest certificat authorities was ultimately able to securely issue certificates re-emphasizing
my early point in 2015 that certificates and Hastey CPS cannot be fully relied upon due to the bad practices
of certificate authorities and vulnerabilities.
You typical authorities.
There's also far too many trusted parties.
Let me show you this.
This is the tree of trust for scientific authorities and we can zoom in here and see all of the different
troughs and trust relationships
so civil authorities exist in about 50 something countries there's over 1400 certificate authorities
trustable by Microsoft and Mozilla.
Therefore Firefox you've even got it's typical authorities like the Hong Kong post office.
This is typical authority you've got.
You have subsidiary certificate authorities like the U.S. Department of Homeland Security and U.S. defense
contractors who are supposed CIA's which leads onto another key witness.
Nation states will have influence over certificat authorities if not actually be able to just issue
certificates themselves and be able to claim to be whoever they want to be.
Facebook Apple your bank and your browser will trust that certificate as it would be issued by a trusted
CA or subordinate CIA that's within your browser's certificates that it trusts.
This means the U.S. U.K. China Russia the 14 eyes they're all like to be able to issue fake certificates
that your browser will trust and therefore be able to view Haiti CPS encrypted traffic that will look
absolutely normal to you that they will be able to decrypt it.
So you'll think that you have end to end encryption but not these guys can issue fake certificates than
to be it's completely broken.
Something else of concern is the X5 09 standard for certificates themselves.
This is pretty poorly designed and it's just too flexible in the writing of the standard.
Somebody accidentally copied and pasted the wrong thing and they ended up missing out parts of the standard
that was supposed to be in there.
So you ended up having a standard and then there's the things that should be in it that weren't in the
standard.
There was a complete disaster and you can have vulnerabilities in the process of getting certificates.
An example of that was no bite poisoning where you were able to get certificates for domains that you
didn't own.
A nation states will definitely be working on discovering new vulnerabilities to subvert the process
of getting certificates.
So if they don't have new ways of doing that now they certainly will have potentially new ways in the
future.
And if you have a bogus certificate there's even free tools available you can use in order to insert
that.
So here we are SSL sniff.
So this was originally developed because of a weakness that was found in Internet Explorer but this
tool could be used to insert a different certificate if you were sat in the middle.
Obviously if you're a nation state you have your own version of this software where you can insert your
own certificate into the traffic.
And as you can see it says it is designed to map in the middle SSL connections on a LAN and dynamically
generates for the domains that are being accessed on the fly.
The new certificates are constructed in a certificate chain that is signed by any certificate that you
provide.
So what are ways to help prevent bogus certificates and therefore your traffic being decrypted.
Well you can reduce the number of certificates that you actually trust trigger here auctions.
Tranced certificates these certificates you can see the hundreds of certificates here that you actually
trust.
Now you can remove certificates that you feel are just not necessary.
What you'll find is that probably 95 percent of the places that you go only need a very small number
of certificates.
So if reducing the number of certificates is something that interests you I suggest this is something
you can google and have a look around.
Have a play around with removing certificates.
Obviously what's going to happen.
Is he going to come across sites that have a certificate chain is difficult that you may have deleted
that's something you really have to play around with.
It depends what sites you go to as close that and other thing you can do is you can watch for changes
in the certificates for the sites that you use.
So you can see here there's an add on for Firefox call certificate patrol.
Your browser has many certification authorities an intermediate civil authorities quietly.
Every time you enter and hasty CPS Web site this add on reveals when certificates are updated.
So you can ensure it was a legitimate change.
Let me go down here and you may or may not be able to see that but what it will show you is the fingerprint
of what it used to be for the certificate.
And what is the fingerprint is for the current certificate.
Now this may seem on the surface to be a good idea right.
Problem is not practical.
Certificates are changed all the time.
So you're going to get these pop up all the time and you are not going to know whether or not this tific
is genuine or not genuine.
I mean you can get clues because perhaps if they change the authority that they use so they move from
say Symantec to the Hong Kong post office they know that that's that's a clue that something is wrong.
These things if you install this extension you'll see you get these pop up all the time so it becomes
pretty you on practical clothes that.
Now there's another option if you are the server owner or if you have some sort of relationship with
what you're connecting to you're able to do what's called certificate pinning and what that is is as
it says here is pinning is a process of so chasing a host with their expected x 5 0 9 certificate or
public key.
There's varying methods of saying I will only accept one specific public key.
So for example you could tie it to a fingerprint or hash.
So then if somebody actually changes it it won't work.
If you use online banking apps for example because I was a security architect for a number of the banking
apps in the UK one of the security methods there is that you pin the certificates because your banking
app doesn't need to go to lots of sites.
You can say just only allow this one public certificate or a number of problems because their first
money in the middle tries to change their certificates.
It won't work because you Pindi it only those public keys and certificate printing works for more than
just Haiti DPF it can work for VPN and SSL and TLR and other protocols that you use with those.
Another method is to be anonymous in the first place.
So if you're concerned about somebody reading your traffic then if you're anonymous they won't be able
to tribute that traffic to you even if they can read it.
If this makes sense.
So for example if you are using an anonymizing method so perhaps a VPN or Tor or something like that
if they then issue a fake certificate and are able to read it they may not then be able to associate
that back to you.
It all depends on whether or not you care about them reading the data or you care about them associating
that data to you.
Being anonymous is another method and you can also use VPN is to get a VPN which only protects you so
more.
So here we have a diagram showing a VPN.
You've got a VPN to this VPN Terminator here.
And within that VPN tunnel this hasty CPS using SSL NTFS.
And then after it reaches the VPN Terminator the traffic comes out as Hastey t p s only if you've got
an attacker that is only able to get in the middle here is going to prevent them from being able to
change the certificate.
If they can get to the traffic here and obviously they can change the certificate.
An example where this might be useful.
So say you're in China you care about the Chinese government swapping out a fake certificate what you
can do is you can VPN out of China and then connect to your server again which will need to be out of
China and then you can more guarantee that your connection is end to end secure.
Because you know that they've not been able to change is difficult while it's been in China.
Now if you want to connect to a server that's within the domain of influence of your threat agent and
even a VPN can be a problem because once you break out of the vpn then they can decrypt traffic so that
certificate authorities and hayseed CPS and the issues that you have with them your main line of defense
is to have defense in depth.
You use multiple controls in order to minimize the risk and a control here being the the VPN and you
would add additional controls depending on your level of security your privacy need those controls which
we can to go through as part of the course.