Dozens of rogue self-signed SSL certificates used to impersonate high-profile sites

The certificates could be used to launch man-in-the-middle attacks against desktop and mobile apps with poor certificate validation

Dozens of self-signed SSL certificates created to impersonate banking, e-commerce and social networking websites have been found on the Web. The certificates don't pose a big threat to browser users, but could be used to launch man-in-the-middle attacks against users of many mobile apps, according to researchers from Internet services firm Netcraft who found the certificates.

"The fake certificates bear common names (CNs) which match the hostnames of their targets (e.g.," the Netcraft researchers said Wednesday in a blog post. "As the certificates are not signed by trusted certificate authorities, none will be regarded as valid by mainstream web browser software; however, an increasing amount of online banking traffic now originates from apps and other non-browser software which may fail to adequately check the validity of SSL certificates."

Among the self-signed certificates found by Netcraft were certificates for domain names belonging to Facebook, Google, Apple, Russian bank Svyaznoy and large Russian payment services provider

If an application doesn't properly validate the authenticity of certificates it encounters, attackers can use self-signed certificates that are not issued by legitimate certificate authorities (CAs) to launch man-in-the-middle attacks against that application's users.

Such attacks involve intercepting the connections between targeted users and SSL-enabled services and re-encrypting the traffic with fake or forged certificates. Unless victims manually check the certificate details, which is not easy to do in mobile apps, they would have no idea that they're not communicating directly with the intended site.

In order to pull-off man-in-the-middle attacks, hackers need to gain a position that would allow them to intercept traffic. This is relatively easy to do on wireless networks using techniques like ARP spoofing, but can also be done by compromising a router or by hijacking the victim's DNS settings.

Web browsers are generally safe against man-in-the-middle attacks if attackers don't use valid certificates obtained illegally by theft or by compromising certificate authorities. That's because over the years the SSL implementations in browsers have been thoroughly tested, patched and strengthened.

If modern browsers encounter a self-signed certificate, they will prompt a hard-to-ignore warning that will force users to either stop or manually confirm that they want to proceed despite the security risks. However, that's not the case with many other desktop or mobile applications.

In 2012 a team of researchers from Stanford University and the University of Texas at Austin investigated the SSL implementations in many non-browser applications, both desktop and mobile. "Our main conclusion is that SSL certificate validation is completely broken in many critical software applications and libraries," they said in their research paper at the time. "When presented with self-signed and third-party certificates -- including a certificate issued by a legitimate authority to a domain called -- they establish SSL connections and send their secrets to a man-in-the-middle attacker."

That same year another team of researchers from the Leibniz University of Hannover and Philipps University of Marburg in Germany analyzed 13,500 popular Android applications from Google Play and found that 1,074 of those applications contained SSL code that either accepted all certificates -- including self-signed ones -- or accepted certificates issued by legitimate authorities for domain names different than the ones the apps connected to.

It doesn't seem things have changed too much over the past two years. Researchers from security firm IOActive recently analyzed mobile banking apps for iOS devices from 60 financial institutions from around the world and found that while most of them used SSL, 40 percent of them did not did not validate the authenticity of digital certificates they received from servers, making them vulnerable to man-in-the-middle attacks.

Some of the self-signed certificates found by Netcraft tried to mimic legitimate certificates down to the name of certificate authorities that supposedly issued them, which suggests they were specifically created for malicious purposes.

One rogue certificate for * was crafted to appear as if it were issued by America Online Root Certification Authority 42, closely mimicking a legitimate AOL CA trusted in all browsers, the Netcraft researchers said.

A certificate for claimed to have been issued by Thawte, another legitimate certificate authority, and the rogue certificate for claimed it had been issued by SecureTrust, a CA operated by Trustwave. The certificate for * was crafted to appear as if it was signed by VeriSign.

This is in clear contrast with some self-signed certificates for high-profile domain names that were also found, but don't appear to be serving a malicious purpose. One such certificate, issued for several Google-owned domains, was signed by a made-up certificate authority called Kyocast Root CA. KyoCast is a third-party modification for rooted Chromecast devices that allows them to access services outside of Google. It intentionally redirects connections that should normally go to Google's services to servers operated by KyoCast and the self-signed the certificate is used in that operation.

There have been signs lately of cybercriminals becoming interested in large-scale man-in-the-middle attacks. The Polish Computer Emergency Response Team (CERT Polska) reported last week that attackers were exploiting vulnerabilities in home routers in Poland to change their DNS settings and intercept online banking traffic from users.

Those particular attacks used a technique called SSL stripping to overcome banks using HTTPS on their sites, but certificate chain validation weaknesses in mobile banking apps could easily be exploited to achieve the same result, and with fewer indications to victims that an attack is in progress.

Join the PC World newsletter!

Error: Please check your email address.

Tags online safetysecurityNetcraftCERT PolskaencryptionExploits / vulnerabilitiesprivacyIOActivepki

Our Back to Business guide highlights the best products for you to boost your productivity at home, on the road, at the office, or in the classroom.

Keep up with the latest tech news, reviews and previews by subscribing to the Good Gear Guide newsletter.

Lucian Constantin

IDG News Service
Show Comments

Most Popular Reviews

Latest News Articles


PCW Evaluation Team

Azadeh Williams

HP OfficeJet Pro 8730

A smarter way to print for busy small business owners, combining speedy printing with scanning and copying, making it easier to produce high quality documents and images at a touch of a button.

Andrew Grant

HP OfficeJet Pro 8730

I've had a multifunction printer in the office going on 10 years now. It was a neat bit of kit back in the day -- print, copy, scan, fax -- when printing over WiFi felt a bit like magic. It’s seen better days though and an upgrade’s well overdue. This HP OfficeJet Pro 8730 looks like it ticks all the same boxes: print, copy, scan, and fax. (Really? Does anyone fax anything any more? I guess it's good to know the facility’s there, just in case.) Printing over WiFi is more-or- less standard these days.

Ed Dawson

HP OfficeJet Pro 8730

As a freelance writer who is always on the go, I like my technology to be both efficient and effective so I can do my job well. The HP OfficeJet Pro 8730 Inkjet Printer ticks all the boxes in terms of form factor, performance and user interface.

Michael Hargreaves

Windows 10 for Business / Dell XPS 13

I’d happily recommend this touchscreen laptop and Windows 10 as a great way to get serious work done at a desk or on the road.

Aysha Strobbe

Windows 10 / HP Spectre x360

Ultimately, I think the Windows 10 environment is excellent for me as it caters for so many different uses. The inclusion of the Xbox app is also great for when you need some downtime too!

Mark Escubio

Windows 10 / Lenovo Yoga 910

For me, the Xbox Play Anywhere is a great new feature as it allows you to play your current Xbox games with higher resolutions and better graphics without forking out extra cash for another copy. Although available titles are still scarce, but I’m sure it will grow in time.

Featured Content

Latest Jobs

Don’t have an account? Sign up here

Don't have an account? Sign up now

Forgot password?