Penetration Testing mailing list archives
RE: Can you impersonate a client side cert??
From: "charl van der walt" <charl () sensepost com>
Date: Mon, 28 Jan 2002 20:24:24 +0200
Hi,
I have been reading a paper which was published back in Feb 2001 by a company call Sensepost which says that there is a way to impersonate a users client side cert by using the same common name. Does anybody have any experience of doing this or is it even possible considering that the users public part of the cert would be installed on the web server?
I'm the author of the paper being referred to... We really have had such experience, and it is very possible. The mistake you're making is in thinking that the user's public key is stored on the web server; its not. The CA's public key is stored on the web server, along with a number of other public keys from other CAs that are installed by default. In authenticating a user using certificates, the server has to ask itself two questions (simplest case): 1) Does the 'Common Name' (CN) of this cert have access? 2) Do I trust the CA that issued this certificate The second question is answered by looking in the list of trusted CAs that have been configured. *Any* CA that has been left remaining on the list will qualify as 'trusted'. This typically includes a number of public CAs like Verisign and Thawte. Thus, unless the administrator has specifically removed non-trusted CAs from the list then such an attack is possible. Ofcourse, there are some challenges: a) You have to be able to derive the CN of the user you are trying to impersonate. On an NT system there's a fair chance that there may be a user called 'Administrator'. b) You have to convince the CA to issue you a certificate in the format that you require. For example: I know that Verisign no longer issues certificates where the surname field is not blank. I'm not sure about other CAs though... c) Etc... Regards charl ======================================================================== charl van der walt +27 83 454 4203 SensePost Information Security www.hackrack.com ======================================================================== ---------------------------------------------------------------------------- This list is provided by the SecurityFocus Security Intelligence Alert (SIA) Service. For more information on SecurityFocus' SIA service which automatically alerts you to the latest security vulnerabilities please see: https://alerts.securityfocus.com/
Current thread:
- RE: Can you impersonate a client side cert?? Ed Moyle (Jan 28)
- <Possible follow-ups>
- RE: Can you impersonate a client side cert?? Jason Brvenik (Jan 28)
- RE: Can you impersonate a client side cert?? charl van der walt (Jan 28)
- Can you impersonate a client side cert?? Darren Craig (Jan 28)
- RE: Can you impersonate a client side cert?? Bryan Allerdice (Jan 28)
- RE: Can you impersonate a client side cert?? L Williams (Jan 28)
- RE: Can you impersonate a client side cert?? pmawson (Jan 28)
- RE: Can you impersonate a client side cert?? Ed Moyle (Jan 29)
- RE: Can you impersonate a client side cert?? Cushing, David (Jan 30)
- RE: Can you impersonate a client side cert?? Michael Howard (Jan 30)