Re:An update on attempted man-in-the-middle attacks
by gst on Tuesday August 30, 2011 @01:28AM
(#2940239)
That does not necessarily need to be the case.
I don't know how the CA in question works, but for many CAs it's sufficient to be able to receive mails at the postmaster address of the domain in order to receive a certificate.
So basically you only need to find a single CA that uses this techniques and which uses a DNS server vulnerable to cache poisoning. Probing all of the CAs may be a little bit of an effort, but it's something even a single individual could manage. I would not find it suprising if this was the technique applied in that case.
I don't know how the CA in question works, but for many CAs it's sufficient to be able to receive mails at the postmaster address of the domain in order to receive a certificate.
So basically you only need to find a single CA that uses this techniques and which uses a DNS server vulnerable to cache poisoning. Probing all of the CAs may be a little bit of an effort, but it's something even a single individual could manage. I would not find it suprising if this was the technique applied in that case.