Certified Lies: Detecting and Defeating Government Interception Attacks Against SSL

January 31st, 2011

Via: Cloud Privacy [PDF]:

This paper introduces the compelled certificate creation attack, in which government agencies may compel a certificate authority to issue false SSL certificates that can be used by intelligence agencies to covertly intercept and
hijack individuals’ secure Web-based communications. Although we do not have direct evidence that this form of active surveillance is taking place in the wild, we show how products already on the market are geared and marketed towards this kind of use—suggesting such attacks may occur in the future, if they are not already occurring. Finally, we introduce a lightweight browser add-on that detects and thwarts such attacks.

Related: Governments Using Forged SSL Certificates for Man in the Middle Attack on “Secure” Web Sessions

Research Credit: neverwas

Posted in Covert Operations, Surveillance, Technology | Top Of Page

One Response to “Certified Lies: Detecting and Defeating Government Interception Attacks Against SSL”

  1. shoe2one says:
    February 2, 2011 at 2:13 am

    I’m commenting only because no one else has.

    I’m not bright enough to understand how this mechanism actually works but think its not a good sign at all.

    I feel that even using Win7 opens up a number of ports on my computer. I really have nothing to hide, but it does piss me off!

Leave a Reply

You must be logged in to post a comment.