As a “spy” company, it made its way into the Mozilla certificate store and what came of it
A truly detective story unfolded in recent months around the company DarkMatter , which has applied for the inclusion of its certification authority in the trusted root certificate store Mozilla. The fact is that this is not a simple company, but a developer of “spyware” software from the UAE. Previously, it was seen in the purchase of 0day-exploits . In principle, this in itself is not a crime. Many companies, including Russian, are engaged in the creation of hacking tools using 0day. They sell these programs, for example, to law enforcement agencies for hacking phones (forensic examination) or hidden installation of Trojans (operational observation). But the generally accepted rules are such that hacker firms cooperate only with democratic governments, that is, they are “on the side of good”.
Passions ran high in February 2019, when the Reuters investigation came out that DarkMatter was selling software to repressive regimes in the Middle East.
Mozilla was instantly under pressure .
Mozilla’s trusted root certificate store is used, including some Linux distributions. Many were afraid that once they got into the Mozilla Root Store, DarkMatter would start issuing TLS certificates that can be used to intercept users' Internet traffic. Such cases have already been in countries with repressive regimes, although DarkMatter claims that it has never participated in such operations. Although now the problem could affect only certain Linux-systems, but it is Linux that runs on the servers of cloud providers and is deployed in data centers. In discussing the situation on Google Groups, representatives of DarkMatter assured that they are never going to do anything like that.
')
At the same time, DarkMatter certificates have come under close scrutiny. And strangeness was quickly discovered: for consecutive numbers of certificates, random numbers from 63-bit space were used instead of 64-bit, as it is required by the specification. This violates the CA / B Forum's minimum entropy requirements (64 bits). Thus, Mozilla has a formal reason to refuse "spies" to be included in the trusted certificate store.
However, it turned out that such a violation allowed not only DarkMatter, but about a dozen certification authorities, including GoDaddy, Apple and Google. The reason is that all the affected CAs used the popular open source PKI-solution EJBCA with the wrong settings.
Began a massive review from leading centers. The procedure took a long time (up to 30 days) due to the huge number of certificates. They had to break RFC5280, which obliges them to revoke incorrect certificates within five days. As a result, according to some estimates, several million pieces were withdrawn.
This is how the spy company DarkMatter did a good job: it helped to detect serious cryptographic vulnerability. But she herself was injured. In fact, the accusations in the investigation of Reuters have no serious grounds: perhaps it’s just the journalist’s conjectures. However, her application for inclusion in the trusted root repository Mozilla has already been rejected, which the company’s representatives are sincerely outraged . And some agree with them.
According to experts from the SSL / PKI industry, the sudden revocation of certificates also demonstrates the important role of automation in the management of company certificates. After all, in fact, you can revoke a certificate at any time because of such a critical event.
It is good if it is a certificate on one server, but the problem becomes serious if you instantly revoke hundreds of certificates on IoT devices. And if it is thousands of devices, tens of thousands? To solve this problem, GlobalSign has entered into a technology partnership agreement with Xage Security . It will implement the IoT Identity Platform automatic certificate management system, capable of issuing 3000 certificates per second.
Join today for developers and innovators in the field of the Internet of Things and manage various PKI-based IoT devices with GlobalSign solutions .
Need more information? We are always happy to advise you by phone +7 499-678-2210.
Passions ran high in February 2019, when the Reuters investigation came out that DarkMatter was selling software to repressive regimes in the Middle East.
Mozilla was instantly under pressure .
Mozilla’s trusted root certificate store is used, including some Linux distributions. Many were afraid that once they got into the Mozilla Root Store, DarkMatter would start issuing TLS certificates that can be used to intercept users' Internet traffic. Such cases have already been in countries with repressive regimes, although DarkMatter claims that it has never participated in such operations. Although now the problem could affect only certain Linux-systems, but it is Linux that runs on the servers of cloud providers and is deployed in data centers. In discussing the situation on Google Groups, representatives of DarkMatter assured that they are never going to do anything like that.
')
At the same time, DarkMatter certificates have come under close scrutiny. And strangeness was quickly discovered: for consecutive numbers of certificates, random numbers from 63-bit space were used instead of 64-bit, as it is required by the specification. This violates the CA / B Forum's minimum entropy requirements (64 bits). Thus, Mozilla has a formal reason to refuse "spies" to be included in the trusted certificate store.
However, it turned out that such a violation allowed not only DarkMatter, but about a dozen certification authorities, including GoDaddy, Apple and Google. The reason is that all the affected CAs used the popular open source PKI-solution EJBCA with the wrong settings.
Began a massive review from leading centers. The procedure took a long time (up to 30 days) due to the huge number of certificates. They had to break RFC5280, which obliges them to revoke incorrect certificates within five days. As a result, according to some estimates, several million pieces were withdrawn.
This is how the spy company DarkMatter did a good job: it helped to detect serious cryptographic vulnerability. But she herself was injured. In fact, the accusations in the investigation of Reuters have no serious grounds: perhaps it’s just the journalist’s conjectures. However, her application for inclusion in the trusted root repository Mozilla has already been rejected, which the company’s representatives are sincerely outraged . And some agree with them.
"Strange situation. On the one hand, the refusal of the DarkMatter application on the basis of these articles in the press will create a precedent for refusing the obvious good faith of a member of the industry based solely on rumors and without evidence, ” writes well-known security expert Nadim Cobeissi. - On the other hand, deciding to act in good faith, transparently and on factual evidence, we in reality run the risk of long-term undermining public confidence in the process of including TC.
It really seems to me that both decisions will cause damage. In the first case, it will look discriminatory (and even a bit xenophobic) ... and in the second there will be a serious cloud of uncertainty over the security of the root directory of the CA as a whole. And I don’t even know how anyone can ever dispel it.
As a bystander, I honestly do not know what to do Mozilla at the moment ...
In fact, I would like to have serious evidence against the charges brought against DarkMatter (if it exists). They would help Mozilla to take a strong defensive position. ”
According to experts from the SSL / PKI industry, the sudden revocation of certificates also demonstrates the important role of automation in the management of company certificates. After all, in fact, you can revoke a certificate at any time because of such a critical event.
It is good if it is a certificate on one server, but the problem becomes serious if you instantly revoke hundreds of certificates on IoT devices. And if it is thousands of devices, tens of thousands? To solve this problem, GlobalSign has entered into a technology partnership agreement with Xage Security . It will implement the IoT Identity Platform automatic certificate management system, capable of issuing 3000 certificates per second.
Join today for developers and innovators in the field of the Internet of Things and manage various PKI-based IoT devices with GlobalSign solutions .
Need more information? We are always happy to advise you by phone +7 499-678-2210.
Source: https://habr.com/ru/post/449098/
All Articles