Forum for Science, Industry and Business

Spoofed Web Certificates

A research team at the Fraunhofer Institute for Secure Information Technology SIT in Darmstadt, Germany, has found a way to issue fraudulent website certificates that are used to ensure trustworthiness of Internet domains.

The team lead by Dr. Haya Shulman has shown that the weakness in the domain validation can be exploited in real life and that the security of Internet infrastructures needs to be improved. To do so the researchers have informed Web CAs (Certificate Authorities) and suggest a new method and implementation that Web CAs may use to mitigate the attack. Further information at https://www.sit.fraunhofer.de/en/dvpp/

Web certificates are the basis of the SSL/TLS protocol which protects most web sites, such as online mail and office apps, online retailing and online banking. If a web site presents a valid certificate, the user’s browser will signal to the user that the web site’s identity is verified and can be trusted, e.g. by showing a green padlock.

The research team at Fraunhofer SIT showed that this trust is actually ill-founded and users can easily be tricked into sending their secret passwords and data to fraudulent phishing web sites.

Certificates are issued by so-called Web CAs, and virtually all popular Web CAs are using a method called Domain Validation (DV) to verify a web site’s identity before issuing a certificate to that web site. The Fraunhofer team demonstrated that Domain Validation is fundamentally flawed, and consequently they could trick many Web CAs into issuing fraudulent certificates.

A cybercriminal could use this attack to obtain a fraudulent certificate, e.g., for a popular online retailer, set up a web site that perfectly mimics that online retailer’s store, and then phish usernames and passwords.

The Fraunhofer team led by Dr. Haya Shulman exploited a number of well known vulnerabilities in the Domain Name System (DNS), which is the Internet’s yellow pages mapping domain names to Internet addresses. Cybersecurity researchers were well aware of these vulnerabilities in the DNS and their potential impact on Domain Validation, but so far this was considered a rather theoretical risk and something only very powerful, e.g., nation state-level attackers could exploit.

The team demonstrated for the first time that this risk is actually very real. “While the details of our attack are technically quite sophisticated, executing the attack does not require any specific compute power or any capability to intercept Internet traffic. Nothing more is needed than a laptop and an Internet connection.” says Dr. Haya Shulman of Fraunhofer SIT.

The team informed German security authorities and Web CAs. As a mitigation the researchers developed an improved version of DV, called DV++, which could replace DV without any further modifications and which is provided free of charge here: https://www.sit.fraunhofer.de/en/dvpp/ . A research paper describing the details of this attack as well as DV++ will be presented at the ACM Conference on Computer and Communications Security (ACM CCS) in Toronto, Canada, in October 2018.

Wissenschaftliche Ansprechpartner:

Dr. Haya Shulman, Prof. Michael Waidner

Oliver Küch | Fraunhofer-Institut für Sichere Informationstechnologie SIT
Further information:
http://www.sit.fraunhofer.de/

Im Focus: (Re)solving the jet/cocoon riddle of a gravitational wave event

An international research team including astronomers from the Max Planck Institute for Radio Astronomy in Bonn, Germany, has combined radio telescopes from five continents to prove the existence of a narrow stream of material, a so-called jet, emerging from the only gravitational wave event involving two neutron stars observed so far. With its high sensitivity and excellent performance, the 100-m radio telescope in Effelsberg played an important role in the observations.

In August 2017, two neutron stars were observed colliding, producing gravitational waves that were detected by the American LIGO and European Virgo detectors....

Im Focus: Light from a roll – hybrid OLED creates innovative and functional luminous surfaces

Up to now, OLEDs have been used exclusively as a novel lighting technology for use in luminaires and lamps. However, flexible organic technology can offer much more: as an active lighting surface, it can be combined with a wide variety of materials, not just to modify but to revolutionize the functionality and design of countless existing products. To exemplify this, the Fraunhofer FEP together with the company EMDE development of light GmbH will be presenting hybrid flexible OLEDs integrated into textile designs within the EU-funded project PI-SCALE for the first time at LOPEC (March 19-21, 2019 in Munich, Germany) as examples of some of the many possible applications.

The Fraunhofer FEP, a provider of research and development services in the field of organic electronics, has long been involved in the development of...

Im Focus: Regensburg physicists watch electron transfer in a single molecule

For the first time, an international team of scientists based in Regensburg, Germany, has recorded the orbitals of single molecules in different charge states in a novel type of microscopy. The research findings are published under the title “Mapping orbital changes upon electron transfer with tunneling microscopy on insulators” in the prestigious journal “Nature”.

The building blocks of matter surrounding us are atoms and molecules. The properties of that matter, however, are often not set by these building blocks...

Im Focus: University of Konstanz gains new insights into the recent development of the human immune system

Scientists at the University of Konstanz identify fierce competition between the human immune system and bacterial pathogens

Cell biologists from the University of Konstanz shed light on a recent evolutionary process in the human immune system and publish their findings in the...

Im Focus: Transformation through Light

Laser physicists have taken snapshots of carbon molecules C₆₀ showing how they transform in intense infrared light

When carbon molecules C₆₀ are exposed to an intense infrared light, they change their ball-like structure to a more elongated version. This has now been...