Internal-use SSL certificates pose security risk for upcoming domain extensions
CAs have issued certificates for internal domain names that could become public soon, causing conflicts, ICANN warns
IDG News Service - The practice of issuing SSL certificates for internal domain names with unqualified extensions could endanger the privacy and integrity of HTTPS communications for upcoming generic top-level domains (gTLDs), according to a security advisory from the Internet Corporation for Assigned Names and Numbers (ICANN).
The advisory was finalized by ICANN's Security and Stability Advisory Committee (SSAC) last week and warns that existing SSL certificates which have been issued for non-public domain names like those used to identify servers inside private networks, could be used to hijack HTTPS traffic for real domain names as new gTLDs become operational. ICANN oversees the Internet's top-level domain name space.
SSAC gave the example of an SSL certificate issued by a Certificate Authority (CA) to Australian clothing retailer Quiksilver for its webmail.quiksilver.com.au domain. That certificate is also valid for alternative non-publicly-recognizable domain names like qsauhub01, qsauhub01.sea.quiksilver.corp, qsauhub02, qsauhub02.sea.quiksilver.corp, and autodiscover.sea.quiksilver.corp.
The .corp domain extension has been used internally on private corporate networks for a very long time, but is currently being considered for future public use as a new gTLD. According to ICANN's website there are six different organizations that applied to become .corp registries.
"If an attacker obtains a certificate before the new TLD is delegated, he/she could surreptitiously redirect a user from the original site to the attacker site, present his certificate and the victim would get the Transport Layer Security/SSL (TLS/SSL) lock icon," the SSAC said in the advisory. "This poses a significant risk to the privacy and integrity of HTTPS communications as well as other protocols that use X.509 certificates (e.g. TLS/SSL-based email communication)."
In a test case, a researcher working with SSAC successfully applied for and obtained an internal-use certificate for www.site from a CA. While .site is not a gTLD yet, it will most likely become one. Some .site registry applicants already offer the possibility to pre-register domain names with this extension.
The researcher set up https://www.site with the newly obtained certificate and verified that various browsers recognized the certificate as valid.
The SSAC also searched SSL certificate data collected in 2010 by the Electronic Frontier Foundation's SSL Observatory project and found 37,244 internal name certificates issued by 157 CAs. Out of those, 1,053 certificates were for domains that ended in one of 63 applied-for gTLDs.
The real number of existing internal name certificates that would conflict with upcoming gTLDs is probably much higher, the SSAC said. The SSL Observatory data is from 2010 and only contains publicly available certificates on the IPv4 (Internet Protocol version 4) network, like the Quiksilver one, that are valid for both public and non-public domain names, it said.
- Best iPhone, iPad Business Apps for 2014
- 14 Tech Conventions You Should Attend in 2014
- 10 Desktop Apps to Power Your Windows PC
- How to Add New Job Skills Without Going Back to School
- Slideshow: 7 security mistakes people make with their mobile device
- iOS vs. Android: Which is more secure?
- 11 sure signs you've been hacked
Red Hat Enterprise Linux - The Original Cloud Operating System
Linux adoption is growing against a number of measures, such as the
number of supercomputers that run Linux and the size of the contributing...
- OpenStack Hype vs. Reality: CIO Quick Pulse Open-source architecture can enable IT departments to build infrastructure-as-a-service (IaaS) clouds running on standard hardware.
- Building a Bridge to the Next Generation Data Center Selecting a widely adopted operating system is a foundational component of a standardization strategy.
- OpenStack and Red Hat: IDC White paper Most OpenStack deployments are by public cloud providers that are early adopters of technology and use OpenStack in a do-it-yourself deployment and support...
- Webinar: Building a Big Data solution that's production-ready Big data solutions are no longer just a nice-to-have.
- Meg Whitman presents Unlocking IT with Big Data During this Web Event you will hear Meg Whitman, President and CEO, HP discuss HAVEn - the #1 Big Data platform, as well... All Cyberwarfare White Papers | Webcasts