Rogue CA Certificate Using PlayStations and MD5 Collisions

Alex Sotirov and Jacob Appelbaum presented "MD5 Considered Harmful Today: Creating a rogue CA Certificate" at the 25th Chaos Communication Congress (or 25C3). Their process, which relied on a cluster of 200 PS3 consoles creates a valid rogue CA certificate that will be accepted by major browsers. The only real fix for this is for browsers to move to SHA-1, which will avoid the known collision errors in MD5. In the short term, this is unlikely to be exploited, but the proof of concept does point to a need to move to a more secure verification method.

ZDNet has more, including details from Sotirov and Appelbaum, as well as a link to their demo site which uses a backdated CA from 2004 to demonstrate the issue.

Reminder: Set your gmail to require SSL

Gmail's new setting to require SSL makes the habit of typing "https" unnecessary. Simply select "Settings" from the top of your Gmail page, then at the bottom click the radio button:


Your session will expire, but a page reload will drop you back in, and you'll be using SSL from there

This is one quick and easy fix that I'll be emailing quite a few people about.

Reminder: Your Third Part Certificates May Need Replaced

If you have certificates issued from one of the major Certificate Authorities, you may have received an email as a follow-up to the ongoing issue with Debian and Ubuntu OpenSSL certificate generation.

Per Verisign's letter:

If you are running Debian operating systems and derivatives (such as Ubuntu) released between September 17, 2006 and May 12, 2008 you should deploy a recently replaced Debian patch and revoke and replace all SSL and Code Signing certificates for which the keys were created on these operating systems.

It looks like Thawte and Verisign are replacing certificates at no charge - and Comodo is using it as an opportunity to attract more customers by offering to replace other's certificates free of charge.

SSL testing: Foundstone's SSLDigger

If you're required to be PCI-DSS compliant, or you just want to check the SSL settings for your site, Foundstone provides a great free tool: SSLDigger. It checks certificate details, encryption and cipher settings, and is generally a good way to double check your SSL setup. Note that it does require the .NET package to be installed first.