Skip to content

Instantly share code, notes, and snippets.

@joepie91

joepie91/.md Secret

Created September 2, 2016 20:39
Show Gist options
  • Save joepie91/3117bc6c5272433ec4118bcab95078af to your computer and use it in GitHub Desktop.
Save joepie91/3117bc6c5272433ec4118bcab95078af to your computer and use it in GitHub Desktop.
Download ZIP
Raw
.md

ANSSI

  • December 3, 2013: Google finds fraudulent certificates for Google domains, signed by ANSII. The certificates are used for MITM attacks. (source)

CNNIC

  • March 3, 2015: An intermediate CA operating under CNNIC (named MCS Holdings) is found issuing fraudulent certificates for various Google domains, for the purpose of MITM attacks. This delegation should have never occurred, as MCS Holdings was not fit to hold this kind of authority. (source)

Comodo

  • May 16, 2009: Comodo is found issuing issuing certificates to malware sites. While this in and of itself is not a problem (see the explanation at the top of this page), Comodo allegedly asked the reporter to "keep quiet" about these issuances. (source)
  • March 23, 2011: Comodo is found issuing 9 fraudulent certificates for high-profile properties including Google and Skype. (source, source)
  • February 2015: Comodo is found to be involved in PrivDog, an advertisement blocking application. PrivDog used an MITM approach to scan and modify traffic, but turned out to essentially break certificate validation entirely, in a way that is reminiscent of the Lenovo/Superfish incident. (source)
  • January 22, 2016: Chromodo, Comodo's customized Chromium browser, is found to disable the same origin policy, creating a critical security issue. The installation and workings of the browser also resemble common malware practices. (source)
  • June 23, 2016: Comodo attempts to file three different trademarks relating to the term "Let's Encrypt" (which is the name of a competing, non-profit, free certificate provider). Its CEO then tried to argue that Let's Encrypt "copied" Comodo's "90 days free" business model - despite Comodo's "free" certificates being non-renewable trial certificates, whereas Let's Encrypt certificates are truly free and renewable. (source, source)
  • July 25, 2016: Comodo is found to allow UI redressing attacks in their domain validation e-mails, allowing an attacker to obtain a fraudulent certificate for a target of choice. (source)
  • August 3, 2016: A Comodo employee edits the "Comodo Group" Wikipedia article to include a poorly written advertisement. (source, source)

DigiNotar (now defunct)

  • July 10, 2011: DigiNotar issues fraudulent wildcard certificate for Google that is later used in an MITM attack. (source)
  • August 2011: It becomes clear that hundreds of fraudulent certificates were created. The total count of fraudulent certificates is at least 531. (source)
  • September 3, 2011: The Dutch government withdraws their earlier statement that the intermediate CA for Dutch government services was not affected, after an investigation by Fox-IT. (source)

Gemnet (owned by KPN)

  • December 2011: Gemnet is compromised through an unsecured and passwordless public instance of PHPMyAdmin. It is unclear whether fraudulent certificates were issued, or whether confidential information was leaked. (source)

Getronics (owned by KPN)

  • November 2011: Evidence surfaces that Getronics was compromised 4 years earlier, but Getronics claims that no production servers were affected. (source)

GlobalSign

  • September 2011: A webserver at GlobalSign is compromised. GlobalSign notes that there was no evidence of fraudulent certificate issuance, and that the issuance systems were airgapped and thus not affected. (source)

Kazakh Government

  • December 2015: The Kazakh government announces that it will require each citizen to install a custom Certificate Authority root, that will allow MITM attacks by the government. It's unclear what organization is tasked with maintaining the CA. (source, source)

StartCom (now likely owned by WoSign)

  • April 2014: StartCom refuses to revoke certificates that were (potentially) compromised through HeartBleed. (source)
  • June 18, 2016: StartCom launches a service named "StartEncrypt", which is essentially a clone of Let's Encrypt - however, it requires the installation of a binary, with no ability to inspect the source code. (source: see sources/startencrypt.txt)
  • June 30, 2016: StartEncrypt is found to have numerous vulnerabilities, including multiple critical vulnerabilities that resulted in the possibility of misissuance for high-profile domains such as google.com, facebook.com, live.com, paypal.com, and dropbox.com. (source)
  • July 2016: StartCom, in its StartEncrypt API, allows issuance of SHA1 certificates, in violation of CA requirements. The certificates are also backdated to December 20, 2015, and signed by WoSign rather than StartCom. The incident was not reported to Mozilla as it should have been. (source)
  • July 2016: It is reported that WoSign has quietly acquired StartCom, but is trying to keep this under wraps (see the WoSign section for details).

Trustwave

  • February 2012: Trustwave is found to have issued subordinate certificates to customers for the purpose of executing MITM attacks. (source)

TÜRKTRUST

  • Late 2011: TÜRKTRUST hands out subordinate certificates to the Turkish government and a Turkish bank and fails to disclose the existence of these certificates, allowing these organizations to issue their own (CA-validated) certificates. One of these certificates was used to issue a certificate for gmail.com. (source)

WoSign

  • April 23, 2015: WoSign incorrectly issues a certificate for a university system by allowing the applicant to verify their ownership on a high port - while not in violation of CA requirements at the time, this is widely understood to be a bad idea. The incident was not reported to Mozilla as it should have been. (source)
  • June 2015: WoSign incorrectly issues certificates for the base domains www.ucf.edu, github.com, github.io, and www.github.io, after an applicant verified their control of a subdomain. All of these certificates appear to have not been revoked at the time of writing (September 2016). The incident was, again, not reported to Mozilla as it should have been. (source, source)
  • July 2016: WoSign is reported to have acquired StartCom, the evidence of which is published at letsphish.org. (source, full WARC archive in sources/wosign-acquisition)
  • September 2016: WoSign threatens the author of letsphish.org with legal action, despite his publication being based on public information. They also attempt to prevent the information from spreading further by claiming that any third-party distribution will result in more penalties for the original author. (source, source)
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment