full-disclosure - Five Ways to Screw Up SSL

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date: Tue May 23 15:35:42 2006
From: eaton.lists at gmail.com (Brian Eaton)
Subject: Five Ways to Screw Up SSL

On 5/23/06, Dude VanWinkle <dudevanwinkle@...il.com> wrote:
> I guess you would hijack their machines with a bug that would edit the
> local cache, refresh the cache, then report to you about the websites
> the victim's machine had visited, and you could request an ssl cert
> for those sites.

If you can get this far, why not just trojan IE and be done with it?

http://isc.sans.org/presentations/banking_malware.pdf

> The only problem I see with this scenario from a freessl perspective
> is that they require verification in the form of an email sent to
> admin@...ain.com or from an email sent to the admin from the upstream
> DNS provider. This would be a little tricky to get around as you would
> have to munge freessl's DNS records.

This implies that you trust every server that relays the e-mail.

Regards,
Brian