News for hackers. Stuff that matters.

A comment on Fox-IT hit by cyber attack. Parent comment

Re:Fox-IT hit by cyber attack by tomwas54 on Friday December 15, 2017 @08:07AM (#15931474)
No, it doesn't. As mentioned in the article, the attacker successfully requested a TLS certificate for the hostname, which was possible because he could pass a CA's domain validation.

I'm not entirely sure, but I think HPKP could have prevented this for returning customers, because Fox-IT would have been able to pin the key of their own certificate. Then the new certificate used by the attacker would have been rejected by the customer's browser.

[ Parent | on HN ]
Re:Fox-IT hit by cyber attack by ams6110 on Friday December 15, 2017 @08:54AM (#15931777)
Yes, it more highlights that the simple presence of a valid certificate does NOT guarantee that you are connecting to the service that you think you are.

EV certs would be harder to compromise, but likely not too difficult for a sophisticated attacker. And who really notices if a site that had an EV cert suddenly doesn't? I might for my bank, but likely would not for a software product website.

[ Parent | on HN ]
Re:Fox-IT hit by cyber attack by da_chicken on Friday December 15, 2017 @09:13AM (#15931893)
> he could pass a CA's domain validation

What! That's impossible! /s

[ Parent | on HN ]