Invalid SSL certification exploitation

Internet usage is growing dramatically, but the vast majority of Internet users don't have any security backgrounds. Nor do a large majority of companies care about information security, and the severity of any attack could harm the valuable assets of these companies. They don't give their employees security awareness sessions, either. For these reasons, humans are the weakest link in the information security chain.

In this article we will talk about SSL protocol and SSL certificates, which will help webmasters make sure that users' information travels safely through the Internet in a secure manner. Moreover we will talk about invalid SSL certificates which could lead to stealing users' credentials or stealing sensitive information which could be used in further attacks.

FREE role-guided training plans

Get 12 cybersecurity training plans — one for each of the most common roles requested by employers.

Download Now

SSL protocol is in widespread use in applications such as Web browsing, electronic mail, Internet faxing, instant messaging and voice-over-IP (VoIP).

Information security principles

As we know, the main practice of information security is to defend information from unauthorized access, disclosure, disruption, modification, recording or destruction. Moreover, the major role of the information security engineer is to find, track and manage risks of our asset, which could be a server, network or/and people. The impact of these risks could affect the confidentiality, integrity or availability of this asset, so these three (CIA triad) are the core principles of information security.

What is SSL?

SSL is the acronym for Secure Sockets Layer; it is a cryptographic protocol which is specially designed for providing secure channels for communication over the Internet. SSL usage is for assuring whom clients are talking with. In other words, SSL is used for verifying the identity of the remote server. For example, if you are talking to https://www.example.com and the SSL certificate for example.com is valid, it means that you are talking to the real server.

Why use SSL?

As we mentioned earlier, Webmasters, Web application developers and administrators usually use SSL protocol for making sure that user information travels safely through the Internet in a secure manner. This helps prevent an evil-intentioned attacker or script kiddy from sniffing the network to steal confidential information like users' credentials, which an attacker could use later for accessing the same application or using the username and password combination to try to figure out the credentials of the same user on any other application. The vast majority of users always use the same username and the same password combination as a credential for logging to other applications, for example the credentials that the user uses to login to Facebook will be the same credentials that the user uses to login to his Gmail account, or he may slightly change the password by appending some numbers or special characters to the password, which also will be an easy task to guess the password by using hybrid attack (appending numbers and special characters to the dictionary words).

SSL is a cryptographic protocol. SSL provides data confidentiality by creating a secure channel for communication over the Internet for transferring the data confidentially. Moreover, SSL provides data integrity because the SSL certificates must be signed by a third party called Certificate Authority, so the attacker can't sign the fake certificate by itself, and if the attacker uses a certificate of another entity to fool the victim, the browser will warn the user that the website uses an invalid certificate (someone else's certificate), which is a clear clue that someone is trying to attack him.

How SSL protocol works

SSL is initialized at layer 5 (the session layer) then works at layer 6 (the presentation layer) as the following:

Invalid SSL certificate reasons

There are many reasons for an SSL certificate to become invalid. Some of these reasons might be the following:

• Revoked certificate:
  • Certificate or its signature is revoked.
  • Failure to check the revocation status.
• Fake certificate:
  • The certificate is subscribed illegally.
• Certificate chain is broken:
  • The chain consists of one self-signed certificate.
  • The chain does not end with a trusted root certificate.
  • The chain contains certificates which are not meant to sign other certificates.
  • Root or intermediate certificate has expired or its time has not come yet.
  • The chain was not built.
  • The domain specified in the certificate does not match the website to which connection is established.
• Certificate time violation:
  • Action time has expired.
  • Action time has not come yet.
• Certificate structure is broken:
  • The structure is damaged.
  • Signature checking error.

If you are surfing a website which usually uses a valid SSL certificate and the browser shows that the website uses an invalid SSL certificate, it's highly recommended to not continue working with the website, because it may be a clue that someone is attacking you.

Why is it dangerous to use an invalid SSL certificate?

Nowadays some webmasters are using invalid SSL certificates to create a secure communication channel between the server and the application users. They think it'll provide the same security posture as a valid SSL certificate, which is not the case, because using an invalid SSL certificate will put the application users in a huge risk, the same risk as sending users' credentials through clear communication channels because any evil-intentioned attacker can sniff the credentials and session ID for the application users.

Demonstration for exploiting an invalid SSL certificate

Now we are going to demonstrate how an attacker can exploit this vulnerability. We will use the Cain & Abel tool for exploiting it. According to the official website, Cain & Abel is a password recovery tool for Microsoft Operating Systems. It allows easy recovery of various kinds of passwords by sniffing the network, cracking encrypted passwords using Dictionary, Brute-Force and Cryptanalysis attacks, recording VoIP conversations, decoding scrambled passwords, recovering wireless network keys, revealing password boxes, uncovering cached passwords, and analyzing routing protocols.

The latest version is faster and contains a lot of new features like APR (ARP Poison Routing),

which enables sniffing on switched LANs and Man-in-the-Middle attacks. The sniffer in this

version can also analyze encrypted protocols such as SSH-1 and HTTPS, and contains filters

to capture credentials from a wide range of authentication mechanisms. For more information, please visit the official website of Cain & Abel, mentioned in the references section at the end of this article.

An attacker will exploit this vulnerability using the following scenario:

1. The attacker and the victim must be residing in the same physical network segment.
2. The attacker will install and run Cain software.
3. The attacker will perform ARP poisoning to sniff the network traffic between the victim and the gateway.
4. The victim tries to access a web application which uses an invalid SSL certificate.
5. Cain will send the victim an invalid SSL certificate which belongs to Cain.
6. The browser will inform the victim that the SSL certificate is invalid.
7. Once the user adds an exception for accepting this certificate, the attacker can capture the victim credentials and session identifiers and any other activities as a clear text.
8. The attacker can use a network traffic analyzer tool such as Wireshark to filter the traffic searching for the victim's application requests, and then the attacker can extract the cookies and referrer parameters from the request. In addition, Cain itself stores all HTTPS traffic as a text file format that has the whole conversation between the client and the server in a folder called HTTPS inside the Cain folder, seen in the screenshot below.

Conclusion

Most webmasters are using an invalid SSL certificate, which is a dangerous issue because it could lead to impersonating application users by stealing users' credentials and session cookies information. To solve this issue, the SSL certificate must be signed by a valid certificate from a trusted CA like VeriSign.

Become a Certified Ethical Hacker, guaranteed!

Get training from anywhere to earn your Certified Ethical Hacker (CEH) Certification — backed with an Exam Pass Guarantee.

Learn More

Sources

• Basic principles - Wikipedia
• Secure sockets layer - Wikipedia
• Oxid
• Support Kaspersky