Government Interception Attacks Against SSL

Researchers Christopher Soghoian and Sid Stamm have authored a paper, “Certified Lies: Detecting and Defeating Government Interception Attacks Against SSL” that is truly disturbing.  Here’s the Abstract:

This paper introduces a new attack, the compelled certificate creation attack, in which government agencies compel a certificate authority to issue false SSL certificates that are then used by intelligence agencies to covertly intercept and hijack individuals’ secure Web-based communications. We reveal alarming evidence that suggests that this attack is in active use. Finally, we introduce a lightweight browser add-on that detects and thwarts such attacks.

I have no problem with law enforcement agencies using their powers to deal with the bad guys, but this truly alarms me. If you read the paper, you’ll see why. Heck, just read this excerpt from the paper’s Introduction:

A pro-democracy dissident in China connects to a secure web forum hosted on servers outside the country. Relying on the training she received from foreign human rights groups, she makes certain to look for the SSL encryption lock icon in her web browser, and only after determining that the connection is secure does she enter her login credentials and then begin to upload materials to be shared with her colleagues. However, unknown to the activist, the Chinese government is able to covertly intercept SSL encrypted connections. Agents from the state security apparatus soon arrive at her residence, leading to her arrest, detention and violent interrogation. While this scenario is fictitious, the vulnerability is not.

Guess what? There’s an appliance being marketed to help facilitate this attack. The brochure is included in the report. But, there’s good news. These guys have developed a Firefox add-on (see the screen shot above):

In an effort to significantly reduce the impact of this attack upon end-users, we have created Certlock, a lightweight add-on for the Firefox browser. Our solution employs a Trust-On-First-Use(TOFU) policy, reinforced with enforcement that the country of origin for certificate issuing does not change in the future. Specifically, our solution relies upon caching CA information, that is then used to empower users to leverage country-level information in order to make common-sense trust evaluations.

Read the paper. Realize its implications. Then, change your habits accordingly. Believe me, until this add-on is released, I’m going to be very suspicious of any SSL connection.