Attackers could use Internet route hijacking to get fraudulent HTTPS certificates

There's no easy fix, a security researcher said at the Black Hat security conference

Inherent insecurity in the routing protocol that links networks on the Internet poses a direct threat to the infrastructure that secures communications between users and websites.

The Border Gateway Protocol (BGP), which is used by computer network operators to exchange information about which Internet Protocol (IP) addresses they own and how they should be routed, was designed at a time when the Internet was small and operators trusted each other implicitly, without any form of validation.

If one operator, or autonomous system (AS), advertises routes for a block of IP addresses that it doesn't own and its upstream provider passes on the information to others, the traffic intended for those addresses might get sent to the rogue operator.

Such incidents are called BGP hijacking, when done intentionally by a malicious actor, or route leaking, when caused by human error or misconfiguration, and are increasingly common. Their impact can be local or global, depending on their particular circumstances.

While there are best security practices that could prevent such incidents, they are not implemented by all network operators around the world. The networks where these security practices are not implemented are also the ones that are most likely to have vulnerable border gateway routers that hackers could attack.

At the Black Hat security conference in Las Vegas Wednesday there were two talks dedicated to BGP hijacking, highlighting the importance of this topic to the security community. In one of them, a Russian security researcher, named Artyom Gavrichenkov, showed how attackers could perform a BGP hijacking attack that would affect only a small geographic region, but which could help them trick a certificate authority to issue a valid certificate for a domain name they don't own.

In order for this to work, the attackers would need to pick a target website whose IP address is part of an AS located in a different region of the world. For example attackers in Asia could decide to target Facebook. They would then need to pick a local certificate authority (CA) that is very close to the rogue autonomous system from where the attack will originate.

The goal of the attack would be to make the certificate authority's ISP believe that Facebook's IP address is owned by the rogue AS instead of Facebook's real AS. The goal of picking a far away target is to lower the chances that the real AS will notice the hijacking -- essentially that a small portion of the Internet believes Facebook is part of a different network.

The process of obtaining a TLS certificate for a domain involves proving that the person who requested the certificate has control of the domain name. This check can be done in an automated manner in several ways: by uploading a special CA-provided page to the server where the domain name is hosted so that the CA can check if it exists, by sending an email to the email address listed in the domain's WHOIS record or by creating a Domain Name System TXT record for the domain. Only one of these methods is enough to confirm ownership.

Creating a page on the server that hosts the domain is the easiest check to pass by using a BGP hijacking attack. The attacker would need to set up a Web server, create the page, then advertise rogue routes for Facebook's IP address. Those routes will propagate regionally affecting the certificate authority and tricking it into believing the page was actually hosted on Facebook's domain. The CA would then issue the SSL certificate.

The fraudulent, but nevertheless valid digital certificate, could then be used to launch man-in-the-middle attacks against Facebook users anywhere in the world, not just the region where the BGP hijacking happened.

The current digital certificate infrastructure that underpins secure communications on the Web doesn't take routing flaws into consideration, Gavrichenkov said. And because it is built into everything, from desktop computers to embedded devices and mobile phones, it can't be easily changed, he said.

The underlying problem is with the Internet routing protocol and the lack of implementation of recommended security practices. However, the BGP hijacking issue has been known for a very long time and the researcher believes it's unlikely to be fixed anytime soon either.

Efforts like the Certificate Transparency framework proposed by Google, or the certificate pinning mechanisms implemented in some browsers could help detect when rogue certificates are issued, but that's more of a workaround than a fix since they're not widely adopted yet.

Join the newsletter!

Or

Sign up to gain exclusive access to email subscriptions, event invitations, competitions, giveaways, and much more.

Membership is free, and your security and privacy remain protected. View our privacy policy before signing up.

Error: Please check your email address.

Tags online safetyblack hat

Keep up with the latest tech news, reviews and previews by subscribing to the Good Gear Guide newsletter.
Lucian Constantin

Lucian Constantin

IDG News Service
Show Comments

Brand Post

Most Popular Reviews

Latest Articles

Resources

PCW Evaluation Team

Jack Jeffries

MSI GS75

As the Maserati or BMW of laptops, it would fit perfectly in the hands of a professional needing firepower under the hood, sophistication and class on the surface, and gaming prowess (sports mode if you will) in between.

Taylor Carr

MSI PS63

The MSI PS63 is an amazing laptop and I would definitely consider buying one in the future.

Christopher Low

Brother RJ-4230B

This small mobile printer is exactly what I need for invoicing and other jobs such as sending fellow tradesman details or step-by-step instructions that I can easily print off from my phone or the Web.

Aysha Strobbe

Microsoft Office 365/HP Spectre x360

Microsoft Office continues to make a student’s life that little bit easier by offering reliable, easy to use, time-saving functionality, while continuing to develop new features that further enhance what is already a formidable collection of applications

Michael Hargreaves

Microsoft Office 365/Dell XPS 15 2-in-1

I’d recommend a Dell XPS 15 2-in-1 and the new Windows 10 to anyone who needs to get serious work done (before you kick back on your couch with your favourite Netflix show.)

Maryellen Rose George

Brother PT-P750W

It’s useful for office tasks as well as pragmatic labelling of equipment and storage – just don’t get too excited and label everything in sight!

Featured Content

Don’t have an account? Sign up here

Don't have an account? Sign up now

Forgot password?