[PPT] - In Log We Trust: Revealing Poor Security Practices with Certificate PowerPoint Presentation

SLIDE 1

Chair of Network Architectures and Services Department of Informatics Technical University of Munich

In Log We Trust: Revealing Poor Security Practices with Certificate Transparency Logs and Internet Measurements

Oliver Gasser, Benjamin Hof, Max Helm, Maciej Korczynski, Ralph Holz, Georg Carle

Tuesday 27th March, 2018 Passive and Active Measurement Conference 2018 Berlin, Germany Chair of Network Architectures and Services Department of Informatics Technical University of Munich

SLIDE 2

Joint work

O. Gasser, B. Hof, M. Helm, M. Korczynski, R. Holz, G. Carle — In Log We Trust

2

SLIDE 3

Why should I care about CT?

What is Certificate Transparency (CT) in a nutshell?

CT provides a repository of certificates to make misissuance detectable
Pushed by Google and others
RFC 6962
O. Gasser, B. Hof, M. Helm, M. Korczynski, R. Holz, G. Carle — In Log We Trust

3

SLIDE 4

Why should I care about CT?

What is Certificate Transparency (CT) in a nutshell?

CT provides a repository of certificates to make misissuance detectable
Pushed by Google and others
RFC 6962

Why is CT interesting for researchers?

CT offers a timeline of issued certificates
Allows to analyze current state and evolution of certificate ecosystem
O. Gasser, B. Hof, M. Helm, M. Korczynski, R. Holz, G. Carle — In Log We Trust

3

SLIDE 5

Why should I care about CT?

What is Certificate Transparency (CT) in a nutshell?

CT provides a repository of certificates to make misissuance detectable
Pushed by Google and others
RFC 6962

Why is CT interesting for researchers?

CT offers a timeline of issued certificates
Allows to analyze current state and evolution of certificate ecosystem

Why do we need measurements?

Not all certificates are in CT (yet)
Find discrepancies between certificates in CT and certificates deployed in the wild
O. Gasser, B. Hof, M. Helm, M. Korczynski, R. Holz, G. Carle — In Log We Trust

3

SLIDE 6

Why should I care about CT?

What is Certificate Transparency (CT) in a nutshell?

CT provides a repository of certificates to make misissuance detectable
Pushed by Google and others
RFC 6962

Why is CT interesting for researchers?

CT offers a timeline of issued certificates
Allows to analyze current state and evolution of certificate ecosystem

Why do we need measurements?

Not all certificates are in CT (yet)
Find discrepancies between certificates in CT and certificates deployed in the wild

What if I don’t care about security at all?

Wait for the bonus slide at the end
O. Gasser, B. Hof, M. Helm, M. Korczynski, R. Holz, G. Carle — In Log We Trust

3

SLIDE 7

Certificate Transparency

What problem is CT trying to solve?

Misissued certificates pose a threat to TLS security
Example: DigiNotar hack in 2011 resulted in unauthorized certificate issuance
Timely detection of misissued certificates is hard
Domain owner or CA might not be aware of misissuance
CA might not go public about misissuance
Idea: All CAs publish a list of issued certificates
Others can then look at those lists and detect misissued certificates
O. Gasser, B. Hof, M. Helm, M. Korczynski, R. Holz, G. Carle — In Log We Trust

4

SLIDE 8

Certificate Transparency

What problem is CT trying to solve?

Misissued certificates pose a threat to TLS security
Example: DigiNotar hack in 2011 resulted in unauthorized certificate issuance
Timely detection of misissued certificates is hard
Domain owner or CA might not be aware of misissuance
CA might not go public about misissuance
Idea: All CAs publish a list of issued certificates
Others can then look at those lists and detect misissued certificates

Involved parties in CT

Log: Public, untrusted, append-only certificate store
Monitor: Service evaluating certificates found in logs
Auditor
O. Gasser, B. Hof, M. Helm, M. Korczynski, R. Holz, G. Carle — In Log We Trust

4

SLIDE 9

Certificate Transparency

What problem is CT trying to solve?

Misissued certificates pose a threat to TLS security
Example: DigiNotar hack in 2011 resulted in unauthorized certificate issuance
Timely detection of misissued certificates is hard
Domain owner or CA might not be aware of misissuance
CA might not go public about misissuance
Idea: All CAs publish a list of issued certificates
Others can then look at those lists and detect misissued certificates

Involved parties in CT

Log: Public, untrusted, append-only certificate store → data source for this work
Monitor: Service evaluating certificates found in logs
Auditor
O. Gasser, B. Hof, M. Helm, M. Korczynski, R. Holz, G. Carle — In Log We Trust

4

SLIDE 10

Certificate Transparency

What problem is CT trying to solve?

Misissued certificates pose a threat to TLS security
Example: DigiNotar hack in 2011 resulted in unauthorized certificate issuance
Timely detection of misissued certificates is hard
Domain owner or CA might not be aware of misissuance
CA might not go public about misissuance
Idea: All CAs publish a list of issued certificates
Others can then look at those lists and detect misissued certificates

Involved parties in CT

Log: Public, untrusted, append-only certificate store → data source for this work
Monitor: Service evaluating certificates found in logs → us
Auditor
O. Gasser, B. Hof, M. Helm, M. Korczynski, R. Holz, G. Carle — In Log We Trust

4

SLIDE 11

Measurement methodology

Active measurements

600 M certificates downloaded from 30 CT logs
Active HTTPS scans of more than 200 M IPv4 and IPv6 hosts
Certificate Revocation List downloads resulting in 25 M entries
O. Gasser, B. Hof, M. Helm, M. Korczynski, R. Holz, G. Carle — In Log We Trust

5

SLIDE 12

Measurement methodology

Active measurements

600 M certificates downloaded from 30 CT logs
Active HTTPS scans of more than 200 M IPv4 and IPv6 hosts
Certificate Revocation List downloads resulting in 25 M entries

Performing measurements in an ethical way

Don’t annoy other people and take away their precious time
Limit query rate
Use incremental downloads for CT logs
Use conforming packets/requests
Don’t hide your intentions
Use dedicated measurement machine
Informing rDNS name, WHOIS entry, web site explaining measurements
O. Gasser, B. Hof, M. Helm, M. Korczynski, R. Holz, G. Carle — In Log We Trust

5

SLIDE 13

Primary analysis goals

What we wanted to find out:

1. Who are the issuers of certificates in CT logs?
O. Gasser, B. Hof, M. Helm, M. Korczynski, R. Holz, G. Carle — In Log We Trust

6

SLIDE 14

Primary analysis goals

What we wanted to find out:

1. Who are the issuers of certificates in CT logs?
2. How secure are certificates in CT logs?
O. Gasser, B. Hof, M. Helm, M. Korczynski, R. Holz, G. Carle — In Log We Trust

6

SLIDE 15

Primary analysis goals

What we wanted to find out:

1. Who are the issuers of certificates in CT logs?
2. How secure are certificates in CT logs?
3. How do certificates in CT logs differ from those found in the wild?
O. Gasser, B. Hof, M. Helm, M. Korczynski, R. Holz, G. Carle — In Log We Trust

6

SLIDE 16

Primary analysis goals

What we wanted to find out:

1. Who are the issuers of certificates in CT logs?
2. How secure are certificates in CT logs?
3. How do certificates in CT logs differ from those found in the wild?
4. Do we find old and non-HTTPS certificates in CT logs?
O. Gasser, B. Hof, M. Helm, M. Korczynski, R. Holz, G. Carle — In Log We Trust

6

SLIDE 17

1. Who are the issuers of certificates in CT logs?

1 9 9 6

1

1 9 9 8

1

2

1

2 2

1

2 4

1

2 6

1

2 8

1

2 1

1

2 1 2

1

2 1 4

1

2 1 6

1

2 1 8

1

2 2

1

Time 100 101 102 103 104 105 106 107 108 Valid CT certificates at time Let's Encrypt GoDaddy Geotrust COMODO AddTrust

O. Gasser, B. Hof, M. Helm, M. Korczynski, R. Holz, G. Carle — In Log We Trust

7

SLIDE 18

1. Who are the issuers of certificates in CT logs?

1 9 9 6

1

1 9 9 8

1

2

1

2 2

1

2 4

1

2 6

1

2 8

1

2 1

1

2 1 2

1

2 1 4

1

2 1 6

1

2 1 8

1

2 2

1

Time 100 101 102 103 104 105 106 107 108 Valid CT certificates at time Let's Encrypt GoDaddy Geotrust COMODO AddTrust

Let’s Encrypt is the dominating issuer of CT log certificates
Certificates in logs from before standardization of CT began
O. Gasser, B. Hof, M. Helm, M. Korczynski, R. Holz, G. Carle — In Log We Trust

7

SLIDE 19

Insecure certificates

Baseline Requirements (BRs)

Rules regarding certificates and issuing processes which CAs adhere to
Devised within the CA/Browser Forum
Each requirement has an enforcement date
Example: RSA key size ≥ 2048 bits for certificates starting 2014
O. Gasser, B. Hof, M. Helm, M. Korczynski, R. Holz, G. Carle — In Log We Trust

8

SLIDE 20

Insecure certificates

Baseline Requirements (BRs)

Rules regarding certificates and issuing processes which CAs adhere to
Devised within the CA/Browser Forum
Each requirement has an enforcement date
Example: RSA key size ≥ 2048 bits for certificates starting 2014

Analysis

Analyze BR adherence of all collected certificates
Use tool cablint
Group violations into four categories
Identity (e.g. invalid domain in SAN)
Signature (e.g. SHA-1)
Keys (e.g. 1024 bit RSA key)
Time-validity (e.g. validity too long)
O. Gasser, B. Hof, M. Helm, M. Korczynski, R. Holz, G. Carle — In Log We Trust

8

SLIDE 21

2. How secure are certificates in CT logs?

1 9 9 6

1

1 9 9 8

1

2

1

2 2

1

2 4

1

2 6

1

2 8

1

2 1

1

2 1 2

1

2 1 4

1

2 1 6

1

2 1 8

1

2 2

1

Time 101 102 103 104 105 106 107 108 Valid CT certificates at time 1024-bit RSA keys SHA-1 sig. alg. Only CN, no SAN

O. Gasser, B. Hof, M. Helm, M. Korczynski, R. Holz, G. Carle — In Log We Trust

9

SLIDE 22

2. How secure are certificates in CT logs?

1 9 9 6

1

1 9 9 8

1

2

1

2 2

1

2 4

1

2 6

1

2 8

1

2 1

1

2 1 2

1

2 1 4

1

2 1 6

1

2 1 8

1

2 2

1

Time 101 102 103 104 105 106 107 108 Valid CT certificates at time 1024-bit RSA keys SHA-1 sig. alg. Only CN, no SAN

Enforcement of stricter rules helps curb the number of insecure certificates
But: Many insecure certificates remain in CT logs
O. Gasser, B. Hof, M. Helm, M. Korczynski, R. Holz, G. Carle — In Log We Trust

9

SLIDE 23

BR violations per CA

Identity Signature Keys Time-Validity Error type 10

5

10

4

10

3

10

2

10

1

100 Percentage of certs with error per CA GoDaddy COMODO RapidSSL CloudFlare WoSign

O. Gasser, B. Hof, M. Helm, M. Korczynski, R. Holz, G. Carle — In Log We Trust

10

SLIDE 24

BR violations per CA

Identity Signature Keys Time-Validity Error type 10

5

10

4

10

3

10

2

10

1

100 Percentage of certs with error per CA GoDaddy COMODO RapidSSL CloudFlare WoSign

Some CAs with high violations in specific categories
Let’s Encrypt with no found violation
O. Gasser, B. Hof, M. Helm, M. Korczynski, R. Holz, G. Carle — In Log We Trust

10

SLIDE 25

3. How do certificates in CT logs differ from those found in the wild?

Certificates

CT logs: 216.8 M certificates
Active scans: 128.1 M certificates
O. Gasser, B. Hof, M. Helm, M. Korczynski, R. Holz, G. Carle — In Log We Trust

11

SLIDE 26

3. How do certificates in CT logs differ from those found in the wild?

Certificates

CT logs: 216.8 M certificates
Active scans: 128.1 M certificates

Overlap between CT logs and in the wild certificates

86 % of certificates in the wild are logged in CT
Good milestone towards CT becoming mandatory in Chrome in April 2018
O. Gasser, B. Hof, M. Helm, M. Korczynski, R. Holz, G. Carle — In Log We Trust

11

SLIDE 27

3. How do certificates in CT logs differ from those found in the wild?

Certificates

CT logs: 216.8 M certificates
Active scans: 128.1 M certificates

Overlap between CT logs and in the wild certificates

86 % of certificates in the wild are logged in CT
Good milestone towards CT becoming mandatory in Chrome in April 2018

Baseline Requirements

More adherence in CT logs (95 %) compared to in the wild (90 %)
CT can help increase the security of certificates
O. Gasser, B. Hof, M. Helm, M. Korczynski, R. Holz, G. Carle — In Log We Trust

11

SLIDE 28

4a. Do we find old certificates in CT logs?

Previous HTTPS scans

Conducted between 2009 and 2015
Targets: Alexa Top 1M and IPv4-wide
O. Gasser, B. Hof, M. Helm, M. Korczynski, R. Holz, G. Carle — In Log We Trust

12

SLIDE 29

4a. Do we find old certificates in CT logs?

Previous HTTPS scans

Conducted between 2009 and 2015
Targets: Alexa Top 1M and IPv4-wide

Logged HTTPS certificates obtained from active scans over time

2009: 22 %
2015: 35 %
O. Gasser, B. Hof, M. Helm, M. Korczynski, R. Holz, G. Carle — In Log We Trust

12

SLIDE 30

4a. Do we find old certificates in CT logs?

Previous HTTPS scans

Conducted between 2009 and 2015
Targets: Alexa Top 1M and IPv4-wide

Logged HTTPS certificates obtained from active scans over time

2009: 22 %
2015: 35 %
2017: 86 %
Non-linear increase towards Google Chrome’s inclusion deadline
O. Gasser, B. Hof, M. Helm, M. Korczynski, R. Holz, G. Carle — In Log We Trust

12

SLIDE 31

4b. Do we find non-HTTPS certificates in CT logs?

TLS scan focusing on messaging protocols

Conducted in 2015
TLS-enabled versions of SMTP

, IMAP , POP3, FTP , XMPP , IRC

O. Gasser, B. Hof, M. Helm, M. Korczynski, R. Holz, G. Carle — In Log We Trust

13

SLIDE 32

4b. Do we find non-HTTPS certificates in CT logs?

TLS scan focusing on messaging protocols

Conducted in 2015
TLS-enabled versions of SMTP

, IMAP , POP3, FTP , XMPP , IRC Non-HTTPS certificates in CT logs

Overlap with certificates from HTTPS scan between 19 % (IRC) and 31 % (SMTP)
Very low presence in CT logs
Highest: SMTP with 3.5 %
Lowest: XMPP with 2.0 %
O. Gasser, B. Hof, M. Helm, M. Korczynski, R. Holz, G. Carle — In Log We Trust

13

SLIDE 33

4b. Do we find non-HTTPS certificates in CT logs?

TLS scan focusing on messaging protocols

Conducted in 2015
TLS-enabled versions of SMTP

, IMAP , POP3, FTP , XMPP , IRC Non-HTTPS certificates in CT logs

Overlap with certificates from HTTPS scan between 19 % (IRC) and 31 % (SMTP)
Very low presence in CT logs
Highest: SMTP with 3.5 %
Lowest: XMPP with 2.0 %
Much lower compared to 35 % of HTTPS
CT focused on HTTPS certificates
O. Gasser, B. Hof, M. Helm, M. Korczynski, R. Holz, G. Carle — In Log We Trust

13

SLIDE 34

Bonus slide: What if I am not interested in security at all?

CT logs as source for domains and IP addresses

TUM’s IPv6 hitlist available since 2016
Extract domains from certificates in CT logs, resolve for IP addresses
Adds 5.4 M IPv4 and 489 k IPv6 addresses
Increase of 70 % of IPv6 addresses
O. Gasser, B. Hof, M. Helm, M. Korczynski, R. Holz, G. Carle — In Log We Trust

14

SLIDE 35

Bonus slide: What if I am not interested in security at all?

CT logs as source for domains and IP addresses

TUM’s IPv6 hitlist available since 2016
Extract domains from certificates in CT logs, resolve for IP addresses
Adds 5.4 M IPv4 and 489 k IPv6 addresses
Increase of 70 % of IPv6 addresses

We make our CT-extended IPv6 hitlist publicly available:

https://www.net.in.tum.de/pub/ipv6-hitlist/
Feel free to use it as a source for IPv6 addresses for your own research
O. Gasser, B. Hof, M. Helm, M. Korczynski, R. Holz, G. Carle — In Log We Trust

14

SLIDE 36

Reproducible research

To encourage reproducibility in network measurement research we publish measurement tools, data, and analysis pipeline

Data set: https://mediatum.ub.tum.de/1422427
Source code: https://github.com/tumi8/pam18-inlogwetrust
O. Gasser, B. Hof, M. Helm, M. Korczynski, R. Holz, G. Carle — In Log We Trust

15

SLIDE 37

Reproducible research

To encourage reproducibility in network measurement research we publish measurement tools, data, and analysis pipeline

Data set: https://mediatum.ub.tum.de/1422427
Source code: https://github.com/tumi8/pam18-inlogwetrust

Benefits

Reproduce our results
Conduct additional analyses on vast HTTPS data set
Archive of the TUM University Library ensures long-term availability
O. Gasser, B. Hof, M. Helm, M. Korczynski, R. Holz, G. Carle — In Log We Trust

15

SLIDE 38

Conclusion

1. Who are the issuers of certificates in CT logs?
Let’s Encrypt issues most certificates found in CT logs
2. How secure are certificates in CT logs?
900 k certificates violating Baseline Requirements, decreasing over time
3. How do certificates in CT logs differ from those found in the wild?
More adherence to BR of certificates in CT logs compared to active scans
4. Do we find old and non-HTTPS certificates in CT logs?
One fifth of certificates scanned in 2009 are in CT logs
Only a few percent of non-HTTPS certificates are logged

*** What if I am not interested in security at all?

Use our CT-extended hitlist for your IPv6 research
O. Gasser, B. Hof, M. Helm, M. Korczynski, R. Holz, G. Carle — In Log We Trust

16

SLIDE 39

Conclusion

1. Who are the issuers of certificates in CT logs?
Let’s Encrypt issues most certificates found in CT logs
2. How secure are certificates in CT logs?
900 k certificates violating Baseline Requirements, decreasing over time
3. How do certificates in CT logs differ from those found in the wild?
More adherence to BR of certificates in CT logs compared to active scans
4. Do we find old and non-HTTPS certificates in CT logs?
One fifth of certificates scanned in 2009 are in CT logs
Only a few percent of non-HTTPS certificates are logged

*** What if I am not interested in security at all?

Use our CT-extended hitlist for your IPv6 research

Oliver Gasser <gasser@net.in.tum.de> https://www.net.in.tum.de/~gasser/

O. Gasser, B. Hof, M. Helm, M. Korczynski, R. Holz, G. Carle — In Log We Trust

16