How to Prevent CA Security Breaches

Certificate authentication plays a major role in securing online resources, and most organizations utilize certificates to secure communication between both hosted resources and those that are accessed. It is a more secure way of authenticating users compared to the legacy username and password mechanism.

Certificate authentication uses asymmetric cryptography, meaning that it is able to separate out 1) those who can verify the link between the physical identity and the cryptographic public key and 2) Those who can authenticate the user. However, user certificates are only as good as the Certificate Authorities, or CAs, that identify them. Attackers have certainly targeted the CAs as a means to issue unauthorized certificates or impersonate certificates for authentication. Let’s take a look at compromised CA Certificate attacks and their impacts.

Implications of Compromised Certificate Authorities

Certificate Authorities issue the user certificate and validate that any certificates issued to a certain domain are actually from that domain. If an attacker is able to compromise the Certificate Authority, then any trust that comes along with the Certificate Authority is essentially gone. What are the ways that an attacker would be able to compromise a Certificate Authority or undermine its security mechanisms? Some of the more common ways include:

• Stealing the private key
• Issuing arbitrary certificates
• Impersonating and forging digital signatures

Stealing Сertificate Key Pair Private Key

SSL certificates use a public-key cryptography process that depends on a key pair which contains public and private key data. Data that is encrypted with the public key can only be decrypted with the private key; also, data encrypted with the private key can only be decrypted with the public key.  The owner of the key pair makes the public key available to anyone and keeps the private key secure. A certificate verifies that the public key belongs to the user, computer, or service identity contained within the certificate.

The common X.509 standard of certificates contains two different sections of information, including a data section and a signature section. The data section of the certificate includes the identity of the entity that owns the public key, as well as the identity of the entity that issued the certificate. Additionally, information regarding the period of time the certificate is valid, as well as the actual public key itself is contained in the certificate.

Organizations go through great lengths to protect the private keys of the public/private key pairs, even utilizing hardware security modules (HSMs) to do so. The HSM contains controls that provide tamper protection, logging, and alerting, and can even burn the private key if tampering is detected.

The security implications of an attacker having possession of a private key can be devastating. An attacker who possesses a compromised SSL private key can use it to host a malicious site with all the certificate legitimacy of the true owner. Visitors to an impostor site would receive the “green padlock” indicator showing that the certificate is valid, thus raising no red flags to the visitor. Malware can be injected, man-in-the-middle attacks carried out, and personal information stolen of those who visit a site hosted by an attacker posing as the legitimate owner.

Issuing Arbitrary Certificates

There have been previous attacks that allowed attackers the ability to issue unauthorized, publicly-trusted certificates for high profile domains. The year 2011 was an infamous year for certificate authority hacks that caused the breach of high profile domains as well as the end of business for some. One such breach involved the compromise of a Comodo reseller, which allowed attackers to issue trusted certificates for domains such as Google, Mozilla, and others. The Registration Authority partner of Comodo had a breach of credentials that allowed the attacker to issue fraudulent certificates. Comodo was able to quickly contain the breach, since it was the reseller, and not Comodo, that was compromised.

Another attack, which was even more serious, involved the Dutch Certificate Authority, DigiNotar. DigiNotar was completely compromised in an attack that resulted in hundreds of unauthorized certificates being issued containing even wildcard certificates for certain domains. This involved an attack on Google’s Gmail service. DigiNotar was cited to be grossly negligent in security practices within the company. DigiNotar certificates were revoked by all major browsers such as Google, Microsoft, Mozilla, and others.

Impersonation and Forged Digital Signatures

A used method of impersonating or forging digital signatures is by way of creating a certificate that has the same hash as a trusted certificate. The hash is used to take the message and replace it with a digest of the message that is unique, where the private key is used to sign and the public key to verify signatures.

In other words, the hash, like a “fingerprint,” can be added from the trusted certificate to a forged certificate, making it appear as trusted. An attacker can look for a message with the same hash value as a true signed message and then switch the legitimate message with one that has the same value. The signature will then verify correctly.

Much like the forgery of a someone’s signature on a document, the switched-out hash can make someone think that the proper identity “signed” a hash message that they didn’t. Even though this process would be extremely difficult to do, it is possible. The hash mechanism doesn’t always protect against impersonation or forgery of signatures.

How to Prevent CA Security Breaches using Blockchain Technology?

Spinbackup uses Blockchain approach to solving PKI problems. Spinbackup’s solution allows to implemented a very forward thinking and innovative mechanism to solve the problems of traditional PKI Infrastructure. By saving the certificate fingerprint of an issued certificate to the blockchain network, Spinbackup is creating an extra security mechanism to verify the owner of the certificate is who they say they are.  This checksum stored in the blockchain network must match exactly the one stored in the certificate itself. Due to the distributed nature of the blockchain network, where all nodes in the blockchain by necessity have to agree on the blocks contained therein, it would be impossible for someone to manipulate the stored checksum in such a way as to forge the fingerprint of the legitimate certificate.

Only by obtaining the permission access from the cloud provider, storing a checksum of the issued certificate in the decentralized blockchain network, and then verifying the permission with the provider, access is granted. Spinbackup has created an ultra-secure and trusted login mechanism for SaaS providers by utilizing the blockchain and PKI. By leveraging Spinbackup blockchain technology, organizations can have a secure Blockchain Single Sign On login process to access public cloud resources.

Thoughts

Public Key Infrastructure or PKI has been at the core of securing Internet communications for years now. However, as attackers are becoming smarter, and computing power is more readily available, public/private key mechanisms are not as secure as once thought. Attackers can use various means for compromising certificate authorities, including stealing the private key, issuing arbitrary certificates, and utilizing impersonation and forged digital signatures. Notable attacks in the past have involved the stealing of credentials and other security compromising means that allowed issuing unauthorized certificates. Organizations today must leverage the best security available in conjunction with digital certificates. Spinbackup’s blockchain approach to solving PKI problems presents a very innovative way to secure digital identity that verifies that the fingerprint of the certificate is legitimate. By using this solution, organizations ensure their digital identity is as safe as possible.

Try SpinOne for free