Using BGP for TLS Certificate Acquisition
Using BGP to Acquire Bogus TLS
Certificates
Henry Birge-Lee, Yixin Sun, Annie Edmundson, Jennifer Rexford,
Prateek Mittal
Digital certificates as a root of trust
●
Root of trust
on the internet
●
Bootstraps trust on
first time connections
●
The
keys
to all web encryption
Trusted Root Certificate
Domain of website certificate is valid for
The chain of trust validating the public key for fed.princeton.edu
Digital certificates as a root of trust
●
Root of trust
on the internet
●
Bootstraps trust on
first time connections
●
The
keys
to all web encryption
Trusted Root Certificate
Domain of website certificate is valid for
BGP attacks compromise this root of trust
The chain of trust validating the public key for fed.princeton.edu
Overview
●
Domain control validation
●
BGP Attacks
●
Launching an Interception Attack
●
Countermeasures
●
Takeaways
Domain Control Verification
Could I get a certificate for example.com?
(Certificate Signing Request)
Certificate Authority
Server at example.com
Owner of example.com
Domain Control Verification
Upload this document to example.com/verify.html
(Domain Control Verification Challenge)
Certificate Authority
Server at example.com
Owner of example.com
Domain Control Verification
Server modifications
Certificate Authority
Server at example.com
Owner of example.com
Domain Control Verification
I did it!
HTTP GET example.com/verify.html
Certificate Authority
Server at example.com
Owner of example.com
Domain Control Verification
Here is your certificate
Certificate Authority
Server at example.com
Owner of example.com
HTTP Response containing document
Where BGP Comes In
I did it!
HTTP GET example.com/verify.html
Certificate Authority
Server at example.com
Owner of example.com
If an adversary sees this request
they can get a certificate
Overview
●
Domain control validation
●
BGP Attacks
●
Launching an Interception Attack
●
Countermeasures
●
Takeaways
Original BGP route to victim
AS 1
AS 3
AS 4
AS 2
Adversary
Original BGP route to victim
Adversary
I own 2.2.2.2/23
AS 1
AS 3
AS 4
AS 2
BGP route to victim under attack
Adversary
I
o
w
n
2
.
2
.
2
.
2
/
2
4
I own 2.2.2.2/23
AS 1
AS 3
AS 4
AS 2
BGP route to victim under attack
Adversary
I
o
w
n
2
.
2
.
2
.
2
/
2
4
I own 2.2.2.2/23
AS 4
HTTP GET example.com/verify.html
goes to adversary
AS 1
AS 3
AS 2
BGP route to victim under attack
Adversary
I
o
w
n
2
.
2
.
2
.
2
/
2
4
I own 2.2.2.2/23
●
Routers prefer more
specific announcements
●
Everyone sees
announcements
●
Connectivity Broken
●
Not very stealthy
AS 1
AS 3
AS 4
AS 2
A local (equally-specific prefix) attack
AS 5
Adversary
I
o
w
n
2
.
2
.
2
.
2
/
2
3
I own 2.2.2.2/23
AS 1
AS 3
AS 4
A. Gavrichenkov. Breaking HTTPS with BGPhijacking. Black Hat USA Briefings, 2015
A local (equally-specific prefix) attack
AS 5
Adversary
I
o
w
n
2
.
2
.
2
.
2
/
2
3
I own 2.2.2.2/23
AS 1
AS 3
AS 4
A. Gavrichenkov. Breaking HTTPS with BGPhijacking. Black Hat USA Briefings, 2015
Intercepted portion
Unaffected portion
Adversary
AS 5
AS 1
AS 3
AS 4
I own 2.2.2.2/23
I
o
w
n
2
.
2
.
2
.
2
/
2
3
A local (equally-specific prefix) attack
●
Equally specific
announcements compete
for traffic
●
Announcement localized
●
Local broken connectivity
●
Potentially stealthy
A. Gavrichenkov. Breaking HTTPS with BGPhijacking. Black Hat USA Briefings, 2015
Adversary
AS 1
AS 3
AS 4
I own 2.2.2.2/23
I
o
w
n
2
.
2
.
2
.
2
/
2
3
A local (equally-specific prefix) attack
●
Equally specific
announcements compete
for traffic
●
Announcement localized
●
Local broken connectivity
●
Potentially stealthy
●
N
o
t
a
l
l
A
S
e
s
c
a
n
p
e
r
f
o
r
m
AS 2
A. Gavrichenkov. Breaking HTTPS with BGPhijacking. Black Hat USA Briefings, 2015
AS path poisoning
Adversary
I
c
a
n
g
e
t
t
o
2
.
2
.
2
.
2
/
2
4
t
h
r
o
u
g
h
A
S
4
AS 1
AS 3
AS 4
AS 2
I own 2.2.2.2/23
AS path poisoning
●
Everyone sees
announcement but looks
less suspicious
●
Connectivity preserved
●
Almost any AS can
perform
●
Very stealthy
●
Perfect setup to intercept
traffic with certificate
Adversary
I
c
a
n
g
e
t
t
o
2
.
2
.
2
.
2
/
2
4
t
h
r
o
u
g
h
A
S
4
AS 1
AS 3
AS 4
AS 2
I own 2.2.2.2/23
Overview
●
Domain control validation
●
BGP Attacks
●
Launching an Interception Attack
●
Countermeasures
●
Takeaways
Experimental Setup
●
Control IP block 184.164.226.0/23
●
Set up victim website
https://ctgen2.tk
with valid certificate
●
Ran ping and HTTPS clients
●
Established BGP sessions from adversarial AS
Demonstration: Launching an Interception Attack
Results from real world attacks
Results from real world attacks
All studied CAs were vulnerable
Overview
●
Domain control validation
●
BGP Attacks
●
Launching an Interception Attack
●
Countermeasures
●
Takeaways
Countermeasures
●
Fix the problem at the CA
○
n(clients) >> n(websites) >> n(CAs)
●
Multiple vantage points: make announcement global
●
Route age: give network operators time to respond
●
Engaging with Let’s Encrypt and Symantec
●
Developing open source implementation
Overview
●
Domain control validation
●
BGP Attacks
●
launching an Interception Attack
●
Countermeasures
●
Takeaways
Takeaways
●
Digital certificates are the foundation of secure internet
communications
●
Almost any
BGP speaking router can get a certificate for any domain
●
Adversary could begin intercepting TLS connections in
35 seconds
●
CAs must implement countermeasures soon
●
BGPsec
just as important in the world of PKI/TLS
Questions?
Digital certificates serve as the root of trust online, but BGP attacks can compromise this trust, leading to interception. Learn about domain control verification and countermeasures.
Download Presentation
Please find below an Image/Link to download the presentation.
The content on the website is provided AS IS for your information and personal use only. It may not be sold, licensed, or shared on other websites without obtaining consent from the author.If you encounter any issues during the download, it is possible that the publisher has removed the file from their server.
You are allowed to download the files provided on this website for personal or commercial use, subject to the condition that they are used lawfully. All files are the property of their respective owners.
The content on the website is provided AS IS for your information and personal use only. It may not be sold, licensed, or shared on other websites without obtaining consent from the author.
E N D
Presentation Transcript
Using BGP to Acquire Bogus TLS Certificates Henry Birge-Lee, Yixin Sun, Annie Edmundson, Jennifer Rexford, Prateek Mittal
Digital certificates as a root of trust Root of trust on the internet Bootstraps trust on first time connections The keys to all web encryption Trusted Root Certificate Domain of website certificate is valid for The chain of trust validating the public key for fed.princeton.edu
Digital certificates as a root of trust Root of trust on the internet Bootstraps trust on first time connections The keys to all web encryption BGP attacks compromise this root of trust Trusted Root Certificate Domain of website certificate is valid for The chain of trust validating the public key for fed.princeton.edu
Overview Domain control validation BGP Attacks Launching an Interception Attack Countermeasures Takeaways
Domain Control Verification Server at example.com Certificate Authority Owner of example.com
Domain Control Verification Server at example.com Certificate Authority Owner of example.com
Domain Control Verification Server at example.com Server modifications Certificate Authority Owner of example.com
Domain Control Verification Server at example.com Certificate Authority Owner of example.com
Domain Control Verification Server at example.com Certificate Authority Owner of example.com
Where BGP Comes In Server at example.com If an adversary sees this request they can get a certificate Certificate Authority Owner of example.com
Overview Domain control validation BGP Attacks Launching an Interception Attack Countermeasures Takeaways
Original BGP route to victim AS 1 AS containing exmaple.com Certificate Authority AS 2 AS 3 AS 4 Adversary
Original BGP route to victim I own 2.2.2.2/23 AS 1 AS containing exmaple.com Certificate Authority AS 2 AS 3 AS 4 Adversary
BGP route to victim under attack I own 2.2.2.2/23 AS 1 AS containing exmaple.com Certificate Authority AS 2 AS 3 AS 4 I own 2.2.2.2/24 Adversary
BGP route to victim under attack I own 2.2.2.2/23 AS 1 AS containing exmaple.com goes to adversary Certificate Authority HTTP GET example.com/verify.html AS 2 AS 3 AS 4 I own 2.2.2.2/24 Adversary
BGP route to victim under attack I own 2.2.2.2/23 AS 1 AS containing exmaple.com exmaple.com AS containing Routers prefer more specific announcements Certificate Authority Everyone sees announcements AS 2 AS 3 AS 4 Connectivity Broken Not very stealthy I own 2.2.2.2/24 Adversary
A local (equally-specific prefix) attack I own 2.2.2.2/23 AS 5 AS 1 AS containing exmaple.com AS 3 AS 4 Certificate Authority I own 2.2.2.2/23 Adversary A. Gavrichenkov. Breaking HTTPS with BGPhijacking. Black Hat USA Briefings, 2015
A local (equally-specific prefix) attack I own 2.2.2.2/23 AS 5 AS 1 AS containing exmaple.com Unaffected portion Intercepted portion AS 3 AS 4 Certificate Authority I own 2.2.2.2/23 Adversary A. Gavrichenkov. Breaking HTTPS with BGPhijacking. Black Hat USA Briefings, 2015
A local (equally-specific prefix) attack I own 2.2.2.2/23 AS 5 AS 1 AS containing exmaple.com Equally specific announcements compete for traffic Announcement localized AS 3 AS 4 Local broken connectivity Certificate Authority Potentially stealthy I own 2.2.2.2/23 Adversary A. Gavrichenkov. Breaking HTTPS with BGPhijacking. Black Hat USA Briefings, 2015
A local (equally-specific prefix) attack I own 2.2.2.2/23 AS 1 AS containing exmaple.com Equally specific announcements compete for traffic Certificate Authority Announcement localized AS 2 AS 3 AS 4 Local broken connectivity Potentially stealthy Not all ASes can perform I own 2.2.2.2/23 Adversary A. Gavrichenkov. Breaking HTTPS with BGPhijacking. Black Hat USA Briefings, 2015
AS path poisoning I own 2.2.2.2/23 AS 1 AS containing exmaple.com Certificate Authority AS 2 AS 3 AS 4 I can get to 2.2.2.2/24 through AS 4 Adversary
AS path poisoning I own 2.2.2.2/23 AS 1 Everyone sees announcement but looks less suspicious AS containing exmaple.com Certificate Authority Connectivity preserved AS 2 AS 3 AS 4 Almost any AS can perform Very stealthy I can get to 2.2.2.2/24 through AS 4 Perfect setup to intercept traffic with certificate Adversary
Overview Domain control validation BGP Attacks Launching an Interception Attack Countermeasures Takeaways
Experimental Setup Control IP block 184.164.226.0/23 Set up victim website https://ctgen2.tkwith valid certificate Ran ping and HTTPS clients Established BGP sessions from adversarial AS
Demonstration: Launching an Interception Attack Interception demo v2.mov
Results from real world attacks GoDaddy Comodo Symantec GlobalSign Let s Encrypt Time to issue certificate 35 seconds < 2 min < 2 min < 2 min < 2 min Human interaction No No No No No Multiple Vantage Points No No No No No Validation Method Attacked HTTP HTTP Email Email Email
Results from real world attacks GoDaddy Comodo Symantec GlobalSign Let s Encrypt Time to issue certificate 35 seconds < 2 min < 2 min < 2 min < 2 min Human interaction No No No No No All studied CAs were vulnerable Multiple Vantage Points No No No No No Validation Method Attacked HTTP HTTP Email Email Email
Overview Domain control validation BGP Attacks Launching an Interception Attack Countermeasures Takeaways
Countermeasures Fix the problem at the CA n(clients) >> n(websites) >> n(CAs) Multiple vantage points: make announcement global Route age: give network operators time to respond Engaging with Let s Encrypt and Symantec Developing open source implementation
Overview Domain control validation BGP Attacks launching an Interception Attack Countermeasures Takeaways
Takeaways Digital certificates are the foundation of secure internet communications Almost any BGP speaking router can get a certificate for any domain Adversary could begin intercepting TLS connections in 35 seconds CAs must implement countermeasures soon BGPsec just as important in the world of PKI/TLS
