Analyzing Forged SSL Certificates in the Wild

The SSL man-in-the-middle attack uses forged SSL certificates to intercept encrypted connections between clients and servers. However, due to a lack of reliable indicators, it is still unclear how commonplace these attacks occur in the wild. In this work, we have designed and implemented a method to...

Full description

Saved in:
Bibliographic Details
Published in2014 IEEE Symposium on Security and Privacy pp. 83 - 97
Main Authors Lin Shung Huang, Rice, Alex, Ellingsen, Erling, Jackson, Collin
Format Conference Proceeding
LanguageEnglish
Published IEEE 01.05.2014
Subjects
Browsers
certificates
Cryptography
Java
man-in-the-middle attack
Protocols
Servers
Sockets
SSL
Online AccessGet full text

Cover

More Information
Summary:The SSL man-in-the-middle attack uses forged SSL certificates to intercept encrypted connections between clients and servers. However, due to a lack of reliable indicators, it is still unclear how commonplace these attacks occur in the wild. In this work, we have designed and implemented a method to detect the occurrence of SSL man-in-the-middle attack on a top global website, Facebook. Over 3 million real-world SSL connections to this website were analyzed. Our results indicate that 0.2% of the SSL connections analyzed were tampered with forged SSL certificates, most of them related to antivirus software and corporate-scale content filters. We have also identified some SSL connections intercepted by malware. Limitations of the method and possible defenses to such attacks are also discussed.
ISSN:1081-6011
2375-1207
DOI:10.1109/SP.2014.13