Bamboozling Certificate Authorities with BGP
summary
Shows that BGP manipulations let an adversary obtain real CA-signed certificates by hijacking validation traffic: experiments use peering testbed prefixes to perform subprefix, equally-specific and path-poisoning hijacks, request certificates from top CAs, and succeed quickly with no human interaction. Analysis of 1.8 million certificates finds most domains vulnerable; effective resilience falls to median 0.25 (≈75% attack viability) when adversaries pick a CA. Proposes CA multi-vantage verification and BGP monitoring; demonstrates Let’s Encrypt staging deployment.
AI-written summary · about
chapters (5)
- 0:00Start
- 1:43Domain Control Verification
- 8:39AS path poisoning attack demonstration
- 13:26Quantifying Vulnerability
- 18:35Takeaways
related talks
24mOff-Path Attacks Against PKI
16mPKI problem: who we actually trust
48mChain of Fools: An Exploration of Certificate Chain Validation Mishaps
35mRoute to Bugs: Analyzing the Security of BGP Message Parsing
35mDomain Borrowing: Catch My C2 Traffic if You Can
30mMalicious Code-signing at Scale: How Attackers Impersonate Thousands of Real Businesses
51mCertificate Transparency Logs: Roadmaps to Riches or Ruin?
21mStealth BGP Hijacks with uRPF Filtering