Stories with Tag Bugzilla

• Ssl.com: DCV bypass and issue fake certificates for any MX hostname

  permalink

  Posted: 2025-04-19 18:44:17

  Verbose tl;dr

  A vulnerability was reported against SSL.com, a Certificate Authority (CA), allowing fraudulent issuance of SSL certificates for arbitrary MX hostnames. Their domain control validation (DCV) process was flawed: by setting specific TXT records, an attacker could bypass verification checks and obtain certificates for domains they didn't own, potentially enabling man-in-the-middle attacks. SSL.com confirmed and addressed the issue, revoking the fraudulently issued certificates. Mozilla subsequently added SSL.com to their CA incident database.

  This Mozilla bug report details a critical vulnerability discovered within the SSL.com certificate issuance process, potentially enabling malicious actors to fraudulently obtain SSL/TLS certificates for arbitrary mail exchange (MX) hostnames. The core issue stems from SSL.com's flawed domain control validation (DCV) procedures, specifically related to their handling of DNS-based DCV for email domains. Legitimate certificate issuance requires applicants to prove they control the domain for which they are requesting a certificate. One common method involves adding specific DNS records to the domain's DNS zone file. SSL.com purportedly offered a DCV method allowing applicants to create a specific DNS record within the _smtp._tcp service record of their MX domain.

  However, the report reveals that SSL.com's system apparently failed to properly validate the actual MX record resolution. This oversight allowed an attacker, without any control over a target domain, to create the necessary DCV DNS record on a domain they controlled, point an MX record at that domain, and successfully complete the DCV process. This effectively bypassed the intended domain ownership verification, allowing the attacker to obtain a valid certificate for the target's MX hostname, even though they held no legitimate authority over it. Such a fraudulent certificate could then be used to intercept and decrypt email traffic destined for the target domain, posing a significant security risk.

  The reporter demonstrated this vulnerability by successfully obtaining a certificate for mx.mozilla.com without having any legitimate control over the mozilla.com domain. They highlighted that this issue could affect any domain utilizing SSL.com's specific MX-based DCV method. The severity of the vulnerability was underscored by the potential for widespread email interception and the undermining of trust in digital certificates issued by SSL.com. The reporter strongly urged prompt action to address this flaw and revoke any potentially fraudulently issued certificates.

  • SSL
  • TLS
  • Certificate Authority
  • CA
  • SSL.com
  • Domain Control Validation
  • DCV
  • MX Record
  • Hostname
  • Fake Certificate
  • Security Vulnerability
  • Bugzilla
  • Mozilla
  • Phishing
  • Spoofing

  Summary of Comments ( 58 )
  https://news.ycombinator.com/item?id=43738485

  Verbose tl;dr

  Hacker News commenters discuss the severity and implications of the SSL.com vulnerability, with some downplaying its impact due to the requirement of compromising an email account first. Several highlight the unusual nature of DCV through email, questioning its security compared to other methods like DNS or HTTP. The discussion also touches on the complexities of certificate issuance and the potential for abuse, with one commenter suggesting the core issue lies in the CA's trust and the difficulty of verifying domain ownership reliably. Others point out that this vulnerability isn't new and express frustration with the slow response from CAs. The conversation also drifts towards the broader issue of CA trust and the need for better systems, with some suggesting decentralized solutions. Finally, a few comments mention the irony of a security company like SSL.com having such a vulnerability.

  The Hacker News post titled "Ssl.com: DCV bypass and issue fake certificates for any MX hostname" (https://news.ycombinator.com/item?id=43738485) has several comments discussing the implications of the vulnerability described in the linked Bugzilla report.

  Several commenters express surprise and concern over the severity of the vulnerability, allowing the issuance of fake certificates for arbitrary MX hostnames. One commenter highlights the potential for significant damage, noting that email servers could be impersonated, leading to interception of sensitive information. The ease with which the vulnerability could be exploited is also mentioned, emphasizing the risk it posed.

  The discussion delves into the technical details of the vulnerability, with commenters explaining how the Domain Control Validation (DCV) process was bypassed. Specifically, the comments mention how ssl.com's system misinterpreted specific responses, allowing an attacker to claim control over a domain they didn't own. The conversation also touches upon the complexities of properly implementing and securing the various DCV methods.

  Some commenters question the responsibility of Certificate Authorities (CAs) in preventing such vulnerabilities, suggesting more rigorous checks and validation procedures. The impact on trust in the certificate ecosystem is also a point of discussion, with concerns raised about the potential erosion of user confidence in online security.

  One commenter questions the response time and transparency of ssl.com in addressing the issue. Others speculate on the potential motivations and technical capabilities of actors who might exploit such a vulnerability.

  The comments also explore the broader implications for email security and the challenges of maintaining a secure online environment in the face of constantly evolving threats. The vulnerability is framed within the context of larger systemic issues surrounding digital certificate issuance and validation.

• DigiCert: Threat of legal action to stifle Bugzilla discourse

  permalink

  Posted: 2025-02-25 01:40:14

  Verbose tl;dr

  DigiCert, a Certificate Authority (CA), issued a DMCA takedown notice against a Mozilla Bugzilla post detailing a vulnerability in their certificate issuance process. This vulnerability allowed the fraudulent issuance of certificates for *.mozilla.org, a significant security risk. While DigiCert later claimed the takedown was accidental and retracted it, the initial action sparked concern within the Mozilla community regarding potential censorship and the chilling effect such legal threats could have on open security research and vulnerability disclosure. The incident highlights the tension between responsible disclosure and legal protection, particularly when vulnerabilities involve prominent organizations.

  This Bugzilla report, titled "DigiCert: Threat of legal action to stifle Bugzilla discourse," details a concerning interaction between Mozilla developers and representatives of DigiCert, a prominent Certificate Authority (CA). The issue at hand revolves around public discussion on the Mozilla Bugzilla platform regarding a specific certificate issuance incident involving DigiCert. The report alleges that DigiCert, instead of engaging in open and constructive dialogue about the technical aspects and potential security implications of the incident being discussed on the platform, resorted to legal threats aimed at suppressing further conversation and removing existing commentary.

  The author of the Bugzilla report expresses apprehension that such actions by a trusted CA like DigiCert could have a chilling effect on the vital role Bugzilla plays in fostering transparency and collaborative security research. They argue that open discussion of potential vulnerabilities and certificate issuance problems is paramount to maintaining the integrity and security of the internet ecosystem. The report highlights the potential conflict between the desire of a CA to protect its reputation and the broader community interest in openly analyzing and addressing potential weaknesses in certificate issuance processes. The author underscores the importance of Bugzilla as a crucial platform for facilitating this essential public discourse and argues that legal threats against such discourse are detrimental to the collective security efforts of the internet community. The report concludes by calling for a reaffirmation of Mozilla's commitment to maintaining an open and transparent platform for discussing security issues, even in the face of pressure from external entities. The implication is that succumbing to such pressure could set a dangerous precedent, potentially discouraging future disclosures and hindering the collaborative identification and resolution of security vulnerabilities.

  • DigiCert
  • Bugzilla
  • Mozilla
  • Certificate Authority
  • CA
  • Legal Threat
  • Censorship
  • Open Source
  • Security
  • SSL/TLS
  • Web Security
  • privacy
  • vulnerability disclosure
  • Free Speech

  Summary of Comments ( 125 )
  https://news.ycombinator.com/item?id=43167087

  Verbose tl;dr

  HN commenters largely express outrage at DigiCert's legal threat against Mozilla for publicly disclosing a vulnerability in their software via Bugzilla, viewing it as an attempt to stifle legitimate security research and responsible disclosure. Several highlight the chilling effect such actions can have on vulnerability reporting, potentially leading to more undisclosed vulnerabilities being exploited. Some question the legality and ethics of DigiCert's response, especially given the public nature of the Bugzilla entry. A few commenters sympathize with DigiCert's frustration with the delayed disclosure but still condemn their approach. The overall sentiment is strongly against DigiCert's handling of the situation.

  The Hacker News post "DigiCert: Threat of legal action to stifle Bugzilla discourse" (linking to a Mozilla Bugzilla report about DigiCert's revocation of a certificate used for WireGuard) sparked a lively discussion with several compelling comments.

  Many commenters expressed outrage and concern over DigiCert's handling of the situation, viewing their legal threat as an attempt to suppress legitimate discussion of a potential security issue. They saw it as a heavy-handed response that discouraged responsible disclosure and could have chilling effects on future vulnerability reporting. Some specifically criticized the use of legal threats in response to public interest concerns around certificate revocation practices, arguing it sets a bad precedent.

  Several comments focused on the technical aspects of certificate revocation, debating the merits of DigiCert's actions and whether the revocation was justified. Some questioned if the key compromise was genuine or a result of a misunderstanding, while others discussed the broader challenges and limitations of certificate revocation mechanisms. This sparked a back-and-forth about best practices and responsibilities in such scenarios.

  A few comments highlighted the potential implications for WireGuard users, expressing concern about the disruption caused by the revocation and the potential for similar incidents in the future. They discussed the importance of clear communication and transparency from Certificate Authorities (CAs) during such events.

  Some commenters questioned the Bugzilla forum as the appropriate venue for this discussion, suggesting that a more private channel might have been more suitable for addressing the legal concerns raised by DigiCert. However, others countered that the public nature of the discussion was crucial for transparency and accountability.

  There was also discussion about the legal aspects of the situation, with commenters speculating about the basis of DigiCert's legal threat and the potential outcomes. Some pointed to potential defamation or tortious interference claims, while others questioned the validity of such claims in this context.

  Finally, several commenters offered alternative interpretations of DigiCert's actions, suggesting they might have been motivated by a desire to protect their reputation or avoid potential liability, rather than to stifle legitimate discourse. They encouraged considering the perspectives of all involved parties.