full-disclosure - Five Ways to Screw Up SSL

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Date: Tue May 23 19:14:13 2006
From: dudevanwinkle at gmail.com (Dude VanWinkle)
Subject: Five Ways to Screw Up SSL

On 5/23/06, Brian Eaton <eaton.lists@...il.com> wrote:
> On 5/23/06, Dude VanWinkle <dudevanwinkle@...il.com> wrote:
> > I guess you would hijack their machines with a bug that would edit the
> > local cache, refresh the cache, then report to you about the websites
> > the victim's machine had visited, and you could request an ssl cert
> > for those sites.
>
> If you can get this far, why not just trojan IE and be done with it?
>
> http://isc.sans.org/presentations/banking_malware.pdf

Agreed. If you get to this point, you might as well just install a
keylogger and be done with it.

> > The only problem I see with this scenario from a freessl perspective
> > is that they require verification in the form of an email sent to
> > admin@...ain.com or from an email sent to the admin from the upstream
> > DNS provider. This would be a little tricky to get around as you would
> > have to munge freessl's DNS records.
>
> This implies that you trust every server that relays the e-mail.

I dont trust any server that relays email ;-)

-JP