securepki.org Open in urlscan Pro
129.10.123.70  Public Scan

Form analysis
0 forms found in the DOM

Text Content

Toggle navigation SSL Research
 * Home
 * Who We Are
 * Research
   * SSL/IMC'14
   * SSL/IMC'15
   * SSL/CCS'16
   * SSL/IMC'16
   * SSL/IMC'18
   * SSL/CCS'19
   * DNSSEC/SEC'17
   * DNSSEC/IMC'17
   * RPKI/IMC'19
 * Press


RESEARCH ON THE SSL/TLS ECOSYSTEM

EVERY DAY, WE USE SECURE SOCKETS LAYER (SSL) AND TRANSPORT LAYER SECURITY (TLS)
TO SECURE OUR INTERNET TRANSACTIONS SUCH AS NAME RESOLUTION (DNS LOOKUP),
BANKING, E-MAIL AND E-COMMERCE. ALONG WITH A PUBLIC KEY INFRASTRUCTURE (PKI),
THEY ALLOW OUR COMPUTERS TO AUTOMATICALLY VERIFY THAT OUR SENSITIVE INFORMATION
(E.G., CREDIT CARD NUMBERS AND PASSWORDS) ARE HIDDEN FROM EAVESDROPPERS AND SENT
TO TRUSTWORTHY SERVERS.



HEARTBLEED

IN MID-APRIL, 2014, A SOFTWARE VULNERABILITY CALLED HEARTBLEED WAS ANNOUNCED. IT
ALLOWS MALICIOUS USERS TO CAPTURE INFORMATION THAT WOULD ALLOW THEM TO
MASQUERADE AS TRUSTED SERVERS AND POTENTIALLY STEAL SENSITIVE INFORMATION FROM
UNSUSPECTING USERS. THE PKI PROVIDES MULTIPLE WAYS TO PREVENT SUCH AN ATTACK
FROM OCCURRING, AND WE SHOULD EXPECT WEB SITE OPERATORS TO USE THESE
COUNTERMEASURES.

FOR MORE DETAILS, PLEASE SEE OUR PROJECTS PUBLISHED AT IMC'14 AND IMC'15.


PRIVATE KEY SHARING

WE FOUND THAT THE PREVALENCE WITH WHICH WEBSITES TRUST THIRD-PARTY HOSTING
PROVIDERS WITH THEIR SECRET KEYS, AS WELL AS THE IMPACT THAT THIS TRUST HAS ON
RESPONSIBLE KEY MANAGEMENT PRACTICES, SUCH AS REVOCATION. OUR RESULTS REVEAL
THAT KEY SHARING IS EXTREMELY COMMON, WITH A SMALL HANDFUL OF HOSTING PROVIDERS
HAVING KEYS FROM THE MAJORITY OF THE MOST POPULAR WEBSITES. WE ALSO FIND THAT
HOSTING PROVIDERS OFTEN MANAGE THEIR CUSTOMERS' KEYS, AND THAT THEY TEND TO
REACT MORE SLOWLY YET MORE THOROUGHLY TO COMPROMISED OR POTENTIALLY COMPROMISED
KEYS.

FOR MORE DETAILS, PLEASE SEE OUR PROJECT PUBLISHED AT CCS'16.


INVALID CERTIFICATES

SSL AND TLS ARE USED TO SECURE THE MOST COMMONLY USED INTERNET PROTOCOLS. AS A
RESULT, THE ECOSYSTEM OF SSL CERTIFICATES HAS BEEN THOROUGHLY STUDIED, LEADING
TO A BROAD UNDERSTANDING OF THE STRENGTHS AND WEAKNESSES OF THE CERTIFICATES
ACCEPTED BY MOST WEB BROWSERS.
PRIOR WORK HAS NATURALLY FOCUSED ALMOST EXCLUSIVELY ON "VALID"
CERTIFICATES€”THOSE THAT STANDARD BROWSERS ACCEPT AS WELL-FORMED AND
TRUSTED€”AND HAS LARGELY DISREGARDED CERTIFICATES THAT ARE OTHERWISE "INVALID."
SURPRISINGLY, HOWEVER, THIS LEAVES THE MAJORITY OF CERTIFICATES UNEXAMINED: WE
FIND THAT, ON AVERAGE, 65% OF SSL CERTIFICATES ADVERTISED IN EACH IPV4 SCAN THAT
WE EXAMINE ARE ACTUALLY INVALID.

FOR MORE DETAILS, PLEASE SEE OUR PROJECT PUBLISHED AT IMC'16.


OCSP MEASUREMENT

WE STUDY WHETHER TODAY'S WEB IS READY FOR OCSP MUST-STAPLE.
SPECIFICALLY, WE MEASURE EACH OF THE THREE MAJOR PRINCIPALS-WEB SERVERS, OCSP
RESPONDERS, AND BROWSERS-TO ASCERTAIN WHETHER THEY ARE DOING WHAT WOULD BE
NECESSARY FOR OCSP MUST-STAPLE TO SUCCEED, AND WHAT IMPACT THEIR FAILURES WOULD
HAVE ON WEBSITE AVAILABILITY.

FOR MORE DETAILS, PLEASE SEE OUR PROJECT PUBLISHED AT IMC'18.


DOMAIN IMPERSONATION

ATTACKERS OFTEN TRICK USERS WITH DOMAINS THAT LOOK SIMILAR, BUT AREN'T
IDENTICAL, TO HIGH-VALUE TARGET WEBSITES. LEGITIMATE CERTIFICATES CAN BE
OBTAINED FOR THESE DOMAINS, AS AN ATTACKER CAN EASILY PROVE OWNERSHIP OF A
DOMAIN THEY LEGITIMATELY OWN. WHY CIRVUMVENT THE PKI WHEN YOU CAN FOOL USERS
WITHOUT HAVING TO BREAK THE RULES?
USING CERTIFICATE TRANSPARENCY (CT) LOGS, WE MEASURE THE PREVELANCE OF
IMPERSONATING DOMAINS IN THE PKI.

FOR MORE DETAILS, PLEASE SEE OUR PROJECT PUBLISHED AT CCS'19.


DNSSEC

THE DOMAIN NAME SYSTEM (DNS) PROVIDES A SCALABLE, FLEXIBLE NAME RESOLUTION
SERVICE. UNFORTUNATELY, ITS UNAUTHENTICATED ARCHITECTURE HAS PROVEN TO BE THE
VECTOR FOR MANY SECURITY ATTACKS. TO ADDRESS THIS, DNS SECURITY EXTENSIONS
(DNSSEC) WERE INTRODUCED IN 1997.
AT ITS CORE, DNSSEC IS A HIERARCHICAL PUBLIC KEY INFRASTRUCTURE (PKI) THAT
LARGELY MIRRORS THE DNS HIERARCHY AND IS ANCHORED IN THE DNS ROOT ZONE. DNSSEC
ENABLES CLIENTS (TYPICALLY DNS RESOLVERS) WHO SUPPORT IT TO AUTHENTICATE DNS
RECORDS FOR DOMAINS THAT ALSO SUPPORT DNSSEC.

FOR MORE DETAILS, PLEASE SEE OUR PROJECTS PUBLISHED AT SEC'17 AND IMC'17.