Researchers presenting at the 25th Chaos Communication Congress (25C3) have
collisions to generate bogus, but trusted, SSL certificates
as reported by heise online.
This would allow nefarious web sites to generate a certificate purporting
to be from any other site—greatly increasing the reach of phishing
and other scams. "Using a weakness in the MD5 cryptographic hash
function, which allows different messages to generate the same MD5 hash –
known as an MD5 'collision', the international team of Alexander Sotirov,
Marc Stevens, Jacob Appelbaum, Arjen Lenstra, David Molinar, Dag Arne Osvik
and Benne De Weger, have used one attack scenario to create a certificate
which will be trusted by all browsers because it appears to be signed by
one of the root CAs that browsers trust by default. The certificate can
also be used to sign other certificates, which could allow attackers to
carry out 'practically undetectable phishing attacks'.
to post comments)