Dozens of rogue self-signed SSL certificates used to impersonate high-profile sites

snoopy · Feb 14, 2014

Dozens of rogue self-signed SSL certificates used to impersonate high-profile sites

Dozens of self-signed SSL certificates created to impersonate banking, e-commerce and social networking websites have been found on the Web. The certificates don’t pose a big threat to browser users, but could be used to launch man-in-the-middle attacks against users of many mobile apps, according to researchers from Internet services firm Netcraft who found the certificates.

“The fake certificates bear common names (CNs) which match the hostnames of their targets (e.g. www.facebook.com),” the Netcraft researchers said Wednesday in a blog post. “As the certificates are not signed by trusted certificate authorities, none will be regarded as valid by mainstream web browser software; however, an increasing amount of online banking traffic now originates from apps and other non-browser software which may fail to adequately check the validity of SSL certificates.”

Among the self-signed certificates found by Netcraft were certificates for domain names belonging to Facebook, Google, Apple, Russian bank Svyaznoy and large Russian payment services provider Qiwi.ru.
Click to expand...

Full story here: http://www.pcworld.com/article/2097...es-used-to-impersonate-highprofile-sites.html

Log in or Sign up

Dozens of rogue self-signed SSL certificates used to impersonate high-profile sites

snoopy Registered Members

Share This Page

Log in or Sign up

Dozens of rogue self-signed SSL certificates used to impersonate high-profile sites

snoopy Registered Members

Share This Page

Useful Searches