An update on attempted man-in-the-middle attacks

Re:An update on attempted man-in-the-middle attacks by fragsworth on Tuesday August 30, 2011 @12:54AM (#2940171)

This seems like a very expensive, targeted, specific attack. The perpetrators will likely succeed (or have already succeeded) at breaking into their intended target.

Someone high-profile in Iran is probably going to get screwed as a result.

[ Parent | on HN ]

Re:An update on attempted man-in-the-middle attacks by gst on Tuesday August 30, 2011 @01:28AM (#2940239)

That does not necessarily need to be the case.

I don't know how the CA in question works, but for many CAs it's sufficient to be able to receive mails at the postmaster address of the domain in order to receive a certificate.

So basically you only need to find a single CA that uses this techniques and which uses a DNS server vulnerable to cache poisoning. Probing all of the CAs may be a little bit of an effort, but it's something even a single individual could manage. I would not find it suprising if this was the technique applied in that case.

[ Parent | on HN ]