1
00:00:00,000 --> 00:00:09,960
So today I'm going to explain to you how you can hijack a web application before it's even installed and use certificate transparency for that.

2
00:00:10,260 --> 00:00:29,220
So to get started, so you all know that we're using much more HTTPS these days, so there's a lot of effort to move the web to encrypted connections, like Google gives you a higher search ranking if your site is using HTTPS, and there have been initiatives like Let's Encrypt to make it easier.

3
00:00:29,820 --> 00:00:34,880
So yeah, so HTTPS is a very important piece of modern web security.

4
00:00:36,480 --> 00:00:39,420
And part of that is certificate authorities.

5
00:00:39,420 --> 00:00:47,160
So if you want to run a web page with HTTPS, you need a certificate and that needs to be signed by one of these certificate authorities.

6
00:00:47,480 --> 00:00:54,020
And here are some of the bigger ones, like Komodo, Symantec, and Let's Encrypt, which is like a new and free one.

7
00:00:55,700 --> 00:01:00,740
And one question that comes up quite often is, do we trust certificate authorities?

8
00:01:01,300 --> 00:01:06,280
And for many people, the answer to that question is just, no, we cannot trust them.

9
00:01:06,440 --> 00:01:18,520
Because like there have been a lot of incidents in the past where certificate authorities have issued certificates for domains where they haven't been asked for, or even for rogue purposes for attacking people.

10
00:01:19,220 --> 00:01:23,340
So many people don't trust the system very much.

11
00:01:24,800 --> 00:01:30,940
And something I hear very often is that people say, yeah, this whole system is broken.

12
00:01:30,940 --> 00:01:32,200
We need to get rid of it.

13
00:01:32,200 --> 00:01:35,220
We need to completely replace that with something else.

14
00:01:36,100 --> 00:01:40,840
That's something I hear very often, especially in the IT security community.

15
00:01:41,620 --> 00:01:52,900
The problem, however, with that is in reality, I think nobody really has a plan with what to replace certificate authorities, or at least not any plan that is realistically feasible.

16
00:01:54,680 --> 00:02:00,820
And so what has been happening a lot in the past couple of years that people have thought, how can we improve this system?

17
00:02:00,820 --> 00:02:03,760
How can we make the existing system more secure?

18
00:02:04,780 --> 00:02:08,300
One thing that has happened is the so-called baseline requirements.

19
00:02:08,300 --> 00:02:15,160
So that's just a document that is writing down the rules under which these certificate authorities operate.

20
00:02:16,280 --> 00:02:23,460
So how they should issue certificates, how they should check that a domain really belongs to the domain owner.

21
00:02:23,460 --> 00:02:37,580
And that's already improving a lot, because if something strange is going on and the certificate authority is doing things that it probably shouldn't do, then there's probably something in the baseline requirements where you can say, hey, here's a rule that's not allowed.

22
00:02:39,360 --> 00:02:53,460
Then there's a technology called HTTP public key pinning, which is a very strong protection, but it's also kind of dangerous, because you could pin your site to a key and then lose the key.

23
00:02:53,520 --> 00:03:02,080
So this is a very strong technology, but you probably shouldn't use it unless you know exactly what you're doing.

24
00:03:03,100 --> 00:03:08,880
One other thing is called CAA, certificate authority authorization.

25
00:03:08,880 --> 00:03:18,820
What's happening there is that you can define a DNS record which is saying, I only want certificates from this specific certificate authority and not from any other.

26
00:03:20,560 --> 00:03:26,500
And then there's this thing called certificate transparency, which will be the main topic of my talk.

27
00:03:28,760 --> 00:03:34,420
And the idea here is that we have public logs of certificates.

28
00:03:34,680 --> 00:03:41,940
So all the certificates, we put them in a log that is also verifiable in some cryptographic sense.

29
00:03:41,960 --> 00:03:47,840
So there's more transparency in that system so that people can watch what's going on.

30
00:03:49,860 --> 00:03:53,800
So I'm not going to talk about the details of how that works.

31
00:03:53,800 --> 00:03:56,240
So there's a lot of fancy crypto.

32
00:03:56,240 --> 00:04:04,040
There are a lot of acronyms like signed certificate timestamps, etc.

33
00:04:05,240 --> 00:04:11,060
The basic idea is all of that is to prevent cheating in that system.

34
00:04:11,060 --> 00:04:23,860
So the idea is to make it really hard for any actor in the system, whether it's a certificate authority or log operator, to make something appear like it isn't really.

35
00:04:24,080 --> 00:04:35,680
So these logs have some cryptographic integrity and it is very hard to log something and then remove it again from the log without that being noted.

36
00:04:40,680 --> 00:04:49,640
So right now this is not fully implemented, but starting next year, at least according to the current plan, this has been changed.

37
00:04:49,760 --> 00:04:59,940
But according to the current plan, next year in April, there will be a requirement for all new certificates that they need to be submitted to at least two of these public logs.

38
00:05:02,840 --> 00:05:09,460
But in practice today, a lot of certificates are already logged and there are a number of reasons for that.

39
00:05:09,760 --> 00:05:15,040
So there are some certificate authorities that already submit their certificates to logs.

40
00:05:15,180 --> 00:05:22,280
One of them is Symantec and they do it because Google said they have to do it because there were a lot of issues with Symantec in the past.

41
00:05:23,300 --> 00:05:27,500
Let's Encrypt is doing it voluntarily because they say they want to support this.

42
00:05:27,500 --> 00:05:29,320
They think this is a good system.

43
00:05:29,840 --> 00:05:37,720
Also Cloudflare is doing it, so if you register a Cloudflare site, you automatically get HTTPS and they submit the certificates to logs.

44
00:05:37,760 --> 00:05:49,080
And also the Google search engine crawler, so if the crawler from the Google search engine surfs to your site and you have HTTPS, then they will download the certificate and submit it to their logs.

45
00:05:49,800 --> 00:06:00,340
So in practice, that means already today, a lot of certificates are in these logs and get submitted pretty quickly to these logs.

46
00:06:02,000 --> 00:06:07,140
So you can think of certificate transparency a bit like a CA watchdog.

47
00:06:07,140 --> 00:06:13,240
So everyone can look into these logs and see if there's anything that looks in any way suspicious.

48
00:06:13,580 --> 00:06:22,360
So the most obvious thing is to look into these logs if there are certificates for your own domains that you haven't ordered yourself.

49
00:06:22,700 --> 00:06:27,400
So if there's a certificate for my domain and I don't know about it, then something is wrong.

50
00:06:27,720 --> 00:06:29,080
That's obvious.

51
00:06:29,080 --> 00:06:39,020
But there's also things like if you look at this certificate, what's a bit suspicious here is that it's only valid for one day and it's for Google com.

52
00:06:40,820 --> 00:06:44,020
That was an internal test at Symantec.

53
00:06:44,140 --> 00:06:48,980
Apparently they have submitted the certificate from the internal test to the public log.

54
00:06:48,980 --> 00:06:50,780
So Google found out about it.

55
00:06:50,780 --> 00:06:54,960
So it's a certificate for Google com, but it's not from Google.

56
00:06:55,240 --> 00:06:59,120
So that started the whole Symantec controversy.

57
00:07:02,420 --> 00:07:04,560
This is also interesting.

58
00:07:04,700 --> 00:07:08,420
So does anyone see what's wrong here?

59
00:07:08,420 --> 00:07:17,610
So if you look at the location, it says it's in Rotterdam in California in the Netherlands.

60
00:07:19,010 --> 00:07:27,350
So I don't know about your geography skills, but California is, as far as I know, not part of the Netherlands.

61
00:07:29,870 --> 00:07:32,790
Maybe there are some similarities, but yeah.

62
00:07:34,010 --> 00:07:35,930
This one is also interesting.

63
00:07:35,950 --> 00:07:41,370
So here you can see in one of the lower lines, there's a domain name with two dots in it.

64
00:07:41,650 --> 00:07:45,470
So it says dot dot this, and that's not a valid host name.

65
00:07:45,650 --> 00:07:54,930
So we can be sure that there's no way anyone has really checked that this host name belongs to anyone because it's an invalid host name.

66
00:07:54,930 --> 00:07:56,490
It cannot belong to anyone.

67
00:07:57,830 --> 00:08:04,450
So here you can see that this system really works.

68
00:08:04,450 --> 00:08:12,750
People are looking at these logs and are seeing, okay, here's something strange, here's something fishy, and we should report that, and yeah.

69
00:08:13,510 --> 00:08:16,850
And hopefully then the CA will not do it again in the future.

70
00:08:18,390 --> 00:08:27,690
If you want to check this out a bit, there's a search engine for certificates and certificate transparency under your LCRTSH.

71
00:08:27,690 --> 00:08:28,650
That's very nice.

72
00:08:28,650 --> 00:08:30,550
That's operated by Komodo.

73
00:08:31,790 --> 00:08:38,370
So for example, the very easiest thing you could do right now is search if there are certificates for your domain that you don't know.

74
00:08:40,810 --> 00:08:46,090
But on the other hand, certificate transparency is also a kind of data source.

75
00:08:46,570 --> 00:08:54,430
Because we have all these certificates, okay, for example, they contain, as we have seen sometimes, the location and also they contain host names.

76
00:08:54,870 --> 00:09:04,830
So for example, if you operate a search engine, this could be interesting because you could know, okay, here are all these hosts that have web pages, so maybe I look at them.

77
00:09:07,810 --> 00:09:14,890
So in a certain sense, certificate transparency gives you a kind of feed for new host names.

78
00:09:14,990 --> 00:09:27,830
So if you're permanently observing these logs as they are public, like there's an API, you can just simply request the new certificates from them, and then you can look into these certificates and see host names.

79
00:09:27,950 --> 00:09:37,010
And when someone creates a new web host with HTTPS and gets a certificate, then it will end up in logs, so you kind of have a feed of new web host names.

80
00:09:38,530 --> 00:09:49,470
So now I want to switch the topic a bit to something which may appear like something completely unrelated at first, and that's web applications.

81
00:09:49,470 --> 00:09:54,930
And when I talk about web applications here, I mean things like self-hosted web applications.

82
00:09:54,950 --> 00:09:59,770
So things like WordPress, Joomla, or things like Nextcloud.

83
00:09:59,890 --> 00:10:10,110
These are usually written in PHP, usually use MySQL, you probably all know one of these like typical content management systems and similar things.

84
00:10:10,830 --> 00:10:30,050
When you install one of those, what usually happens, so you upload the files from the software to some web hosting company or on your own server, and then usually you just call the web page and get an installer and click through a few things.

85
00:10:30,050 --> 00:10:39,550
It asks you for your database credentials, then it asks you to create an initial administration account, and then you have installed your application.

86
00:10:41,070 --> 00:10:44,410
What's notable is there's no authentication whatsoever.

87
00:10:44,650 --> 00:10:52,390
So these installers have no protection, so everyone who, like if someone else calls this installer, he can install it just as well.

88
00:10:55,970 --> 00:11:08,810
And this has been known for a while, like people have been using Google to search for uninstalled WordPresses that have been abandoned, like maybe someone has uploaded them and then a problem happened and they just forgot about this installation.

89
00:11:09,530 --> 00:11:12,930
And if you find them with Google, then you can take them over.

90
00:11:16,230 --> 00:11:27,190
But the new idea here is there's a small time window between when a webmaster uploads this application and when he finishes the installation.

91
00:11:27,730 --> 00:11:38,070
And if we can hit that time window, we have an attack, because then we can do the installation and then we are in control of this application.

92
00:11:40,210 --> 00:11:43,570
And you might see where this is getting at.

93
00:11:43,610 --> 00:11:47,750
You may remember from earlier, we have this feed of new host names.

94
00:11:48,070 --> 00:11:52,710
So if we combine these things, we have our attack.

95
00:11:53,770 --> 00:12:05,050
So we can monitor the certificate transparency logs all the time, probably with some kind of con job, automated, and extract all the host names.

96
00:12:07,490 --> 00:12:20,750
And then we check these hosts, like we do a curl or a wget on them, and compare what they are currently serving as a web page to common application installers from WordPress, from Joomla, from whatever.

97
00:12:22,890 --> 00:12:27,570
So , and if you find one of them, we install this application ourselves.

98
00:12:27,570 --> 00:12:31,510
And if we're a real attacker, we would probably do this automated.

99
00:12:31,510 --> 00:12:33,590
Of course, it's faster.

100
00:12:35,290 --> 00:12:46,210
Now then, when we have done this installation, we can upload a plugin, because all these applications usually have some kind of extension mechanism where you can upload a plugin, and basically that gives you code execution.

101
00:12:48,250 --> 00:12:56,070
And ideally, we upload something that gives us further code execution, so we can just then execute arbitrary code.

102
00:12:57,410 --> 00:13:10,970
And what we do then is that we revert the installation, because how these installs work is usually just when they finish, they write down a config file, and if we delete that config file, then the installation is undone.

103
00:13:13,980 --> 00:13:34,400
So one thing we need for the whole thing are database credentials, but that's not a problem, because you can just define an external MySQL host, and there's, for example, a service called freemysqlhosting.net, which offers free MySQL hosting, which is very convenient for what we're trying to do.

104
00:13:36,920 --> 00:13:40,080
Yeah, so we have a little demo.

105
00:13:43,840 --> 00:13:57,560
So what I'm doing here, this is the search engine I mentioned earlier, and what I'm now doing is I put in a percent, which is a wildcard character, and then I put in .tlsfun.de.

106
00:13:57,560 --> 00:14:00,360
That is one of my own domains.

107
00:14:02,660 --> 00:14:05,320
And I'll make this a bit bigger.

108
00:14:05,420 --> 00:14:11,820
You see, the very latest entry here is for blog.tlsfun.de.

109
00:14:12,240 --> 00:14:16,800
And let's just copy that URL and see what we can find there.

110
00:14:20,180 --> 00:14:22,880
Oh, this is a WordPress installation.

111
00:14:23,440 --> 00:14:24,520
That is nice.

112
00:14:24,520 --> 00:14:29,080
So we click on continue, and click another button.

113
00:14:29,080 --> 00:14:31,440
Okay, now we need these database credentials.

114
00:14:32,160 --> 00:14:40,660
And as I'm prepared for this, I already have database credentials here, as I said, from free MySQL hosting.

115
00:14:43,420 --> 00:14:49,600
And password, and this host.

116
00:14:54,520 --> 00:14:57,660
Okay, run the install.

117
00:14:58,600 --> 00:15:11,180
So now I need a site title, I just use test, username admin, want some password for me, and an email.

118
00:15:11,180 --> 00:15:13,960
There, I just use something like trash mail.

119
00:15:16,720 --> 00:15:18,880
And installation.

120
00:15:19,420 --> 00:15:20,620
Now it takes a bit...

121
00:15:24,770 --> 00:15:28,170
Okay, so it says WordPress has been installed.

122
00:15:28,170 --> 00:15:29,290
Thank you and enjoy.

123
00:15:30,210 --> 00:15:31,330
Login.

124
00:15:31,690 --> 00:15:37,490
So now I'm logging in with the admin account I just created with the password I just typed in.

125
00:15:43,280 --> 00:15:53,140
Okay, and now I go in plugins, and click on add new.

126
00:15:56,700 --> 00:16:03,680
And so here I can just install plugins from WordPress itself, but I can also click on upload plugin.

127
00:16:03,680 --> 00:16:13,380
So I can upload my own plugin, which I have prepared before, which is called hijack, and we'll install it.

128
00:16:18,560 --> 00:16:32,160
Okay, so now in this plugin, I have a file called shell.php, and it doesn't show me anything, because it wants a secret.

129
00:16:32,160 --> 00:16:34,740
Secret is DEF CON 2017.

130
00:16:35,220 --> 00:16:37,560
It's not very exciting, but okay.

131
00:16:37,560 --> 00:16:40,440
Okay, and this is a very simple PHP shell.

132
00:16:40,440 --> 00:16:44,280
So we can make ls, and we can also...

133
00:16:46,400 --> 00:16:48,200
Okay, now the screen is cut off.

134
00:16:48,200 --> 00:16:49,280
That's not very good.

135
00:16:49,280 --> 00:16:54,880
But I can show you, for example, if I type in uname, then I get output of uname.

136
00:16:54,880 --> 00:16:56,620
So I basically have a shell now.

137
00:16:59,460 --> 00:17:04,820
And the interesting thing is I also here have a button which says remove installation traces.

138
00:17:05,840 --> 00:17:08,940
I'll just try to let you see that.

139
00:17:09,220 --> 00:17:10,580
Yeah, that's better.

140
00:17:12,980 --> 00:17:21,220
And now if I go on this again, then you see the installer's back.

141
00:17:21,580 --> 00:17:31,920
And that is important, because the person who is the owner of this WordPress, which in this case is me, but in the real case is someone else, will never notice what happened.

142
00:17:32,420 --> 00:17:33,860
So I have a backdoor now.

143
00:17:33,860 --> 00:17:41,040
I can execute arbitrary code on that server, but the owner of that WordPress installation will never notice it.

144
00:17:41,580 --> 00:17:43,300
At least that's what we hope.

145
00:17:45,200 --> 00:17:46,480
Yeah.

146
00:17:56,660 --> 00:18:03,040
So one challenge here that we have is that the certificates are not immediately public.

147
00:18:03,200 --> 00:18:13,440
There's a time lag, which so it is a maximum two hours, but I have kind of measured it, and it's usually about 30 minutes.

148
00:18:13,500 --> 00:18:17,780
So from certificate issuance until the certificate ends up in the lock.

149
00:18:19,480 --> 00:18:29,700
But it doesn't really matter, because there are still like enough people who will just create that host and then upload that WordPress and then go for a coffee and finish the installation later.

150
00:18:29,700 --> 00:18:33,760
So we'll just hit enough vulnerable hosts in that time frame.

151
00:18:35,960 --> 00:18:51,500
And this could also be further optimized, like you could say, I'm not only checking a site once, but when I see a new host in the certificate transparency locks, I just check it every five minutes again and again for maybe a couple of hours.

152
00:18:54,800 --> 00:19:07,080
So I ran a test script where I was searching for these installs this certificate transparency locks over three months, and I could have taken over 5,000 WordPress installations in that time.

153
00:19:07,280 --> 00:19:18,640
So that's quite a nice spot net if you have 5,000 ways to execute PHP code, use that to send spam or host phishing sites or whatever.

154
00:19:18,940 --> 00:19:24,200
Also around 500 Joomla installations, 120 next cloud and 70 on cloud.

155
00:19:24,200 --> 00:19:29,560
The others were all quite low, so the others I would say probably doesn't deserve the effort.

156
00:19:30,760 --> 00:19:39,040
One thing is Drupal doesn't show up because their installer page is so slow that the time out of my script hit.

157
00:19:41,460 --> 00:19:45,640
But yeah, that's just kind of a technicality.

158
00:19:47,520 --> 00:19:50,700
So how can you protect against this?

159
00:19:50,700 --> 00:19:54,780
So in very general, I think these installers need to be authenticated.

160
00:19:54,840 --> 00:20:04,540
I think it's just not a good design to say I upload an installer and then it's just without any protection out there in the internet and we just hope nobody finds it.

161
00:20:07,620 --> 00:20:14,760
The challenge is, of course, the developers of these applications, they want to make the installation as easy as possible.

162
00:20:14,760 --> 00:20:19,420
And if you add any kind of authentication, that creates extra effort.

163
00:20:19,440 --> 00:20:26,180
So I can kind of understand that they are reluctant, but still this somehow needs to be fixed.

164
00:20:28,060 --> 00:20:43,520
So one thing you could imagine is that the installation process creates a secret token, writes that into a file, and then the user has to download that file and paste that token into a web form and only then he can install the application.

165
00:20:43,960 --> 00:20:47,020
That's one option, but of course there are other options as well.

166
00:20:48,700 --> 00:20:56,600
So I reported this to a couple of vendors, primarily the big content management systems because they are the most interesting here.

167
00:20:57,020 --> 00:21:01,680
So from Drupal, Typo3, and OnCloud, I got no reaction at all.

168
00:21:01,680 --> 00:21:03,640
They just ignored my messages.

169
00:21:05,460 --> 00:21:17,360
Then from WordPress, NextCloud, and Serendipity, there came some answers like we would like to discuss this with other vendors and can we have a cross-vendor discussion.

170
00:21:17,360 --> 00:21:19,500
And I said, okay, I'll set up a mailing list.

171
00:21:20,340 --> 00:21:22,900
But then there was not a whole lot of discussion.

172
00:21:28,880 --> 00:21:30,420
This is interesting.

173
00:21:30,520 --> 00:21:36,460
MediaWiki is not vulnerable to it and was not even before I did this research.

174
00:21:36,460 --> 00:21:38,960
And the reason is their installer works a bit different.

175
00:21:38,960 --> 00:21:45,320
So when you finish the installer, they don't just write the config file, but they provide the config file for download.

176
00:21:45,400 --> 00:21:48,960
And you have to download it and then upload it again to your web host.

177
00:21:49,200 --> 00:21:51,840
Otherwise, the installation doesn't get finished.

178
00:21:53,380 --> 00:21:57,460
Although, MediaWiki allows you to use SQLite.

179
00:21:57,460 --> 00:21:59,420
And SQLite is file-based.

180
00:21:59,420 --> 00:22:04,160
So the installer still kind of allows you to create a file on the server.

181
00:22:04,180 --> 00:22:07,200
But you don't have a whole lot of control over it.

182
00:22:07,810 --> 00:22:12,360
I don't think this can be exploited, but it's a nice challenge.

183
00:22:12,360 --> 00:22:17,660
So if anyone of you has an idea how to exploit that, I would be very interested to hear about that.

184
00:22:20,520 --> 00:22:21,320
And then Joomla.

185
00:22:21,320 --> 00:22:27,940
Joomla was the only content management system that implemented a fix after I reported it to them.

186
00:22:27,940 --> 00:22:30,160
They released it a couple of days ago.

187
00:22:30,860 --> 00:22:36,800
And what they're doing is that it was basically my idea.

188
00:22:36,800 --> 00:22:41,680
The problem is I don't... I later decided that I don't like the idea anymore.

189
00:22:43,620 --> 00:22:49,180
So what they're doing is they're whitelisting localhost as a MySQL server.

190
00:22:49,180 --> 00:22:55,200
So if you have a local database server, the installation is just like it was before.

191
00:22:55,200 --> 00:23:01,140
And if you have an external MySQL server, then they have an extra authentication step.

192
00:23:01,880 --> 00:23:13,040
And the extra authentication step is that it has created a directory with a random file name, and you're supposed to remove that directory, and then you can continue the installation.

193
00:23:15,000 --> 00:23:16,660
So why don't I like it?

194
00:23:16,660 --> 00:23:28,760
So the problem here is if you have a large web hosting company that may have thousands of customers on a single server, then it may just be that the attacker already has credentials for that server.

195
00:23:29,840 --> 00:23:34,400
Like he can just register a couple of accounts at major web hosting companies.

196
00:23:34,580 --> 00:23:36,520
Or you could even think one step further.

197
00:23:36,520 --> 00:23:43,160
The attacker is, of course, attacking multiple applications at once, and WordPress is still vulnerable.

198
00:23:43,320 --> 00:23:53,840
So chances are high he may have already hijacked one WordPress on that server when he finds that Joomla, and then he can use the database credentials from that WordPress to hijack that Joomla.

199
00:23:54,200 --> 00:24:01,240
So I don't think it's an ideal fix, but at least I have to give Joomla credit that they were the only ones that did a fix at all.

200
00:24:01,380 --> 00:24:03,520
Like the others just didn't do anything.

201
00:24:07,470 --> 00:24:09,690
So what can you do as a user?

202
00:24:09,690 --> 00:24:12,730
If you think now, okay, that's a problem.

203
00:24:12,730 --> 00:24:17,190
I don't want my WordPress to get hijacked before I even use it.

204
00:24:17,190 --> 00:24:19,670
How can I protect myself?

205
00:24:21,870 --> 00:24:23,590
You could say, okay.

206
00:24:24,210 --> 00:24:37,530
As I said, these logs are not updated instantly, so you have like 30 minutes, but it's kind of a bit risky because like there's no guarantee how fast these logs are.

207
00:24:37,530 --> 00:24:47,310
And it could just be that next month Google decides they make a super fast log because they have optimized their software and it's running much faster and then this doesn't work anymore.

208
00:24:47,310 --> 00:24:52,530
So I don't think it's a very good solution, but yeah, you can think about that.

209
00:24:54,730 --> 00:24:58,310
Then there's the thing called certificate reduction.

210
00:24:58,410 --> 00:25:10,410
So with this certificate transparency, some certificate authorities were worried that, oh, that means all these host names are now public and our customers might not like it.

211
00:25:10,890 --> 00:25:14,210
Particularly Symantec now already offers that.

212
00:25:14,210 --> 00:25:20,150
So there is a part of certificate transparency where you can have redacted domain labels.

213
00:25:20,150 --> 00:25:27,670
So you could say this certificate in the log is for redactedlabel.something.com.

214
00:25:30,070 --> 00:25:33,210
But I don't think that's very practical either.

215
00:25:33,270 --> 00:25:38,630
So for one, as soon as the Google crawler sees your real certificate, you're still again in the log.

216
00:25:39,330 --> 00:25:43,930
And the other thing is not all certificate authorities offer this.

217
00:25:43,930 --> 00:25:46,570
And this has been quite controversial.

218
00:25:46,570 --> 00:25:50,590
So I'm not entirely sure if it's going to stick around.

219
00:25:50,690 --> 00:25:57,590
And particularly if you had some web host that automatically issues certificates for you, they are likely not going to use this.

220
00:25:57,910 --> 00:26:00,650
So it's also not a very good solution.

221
00:26:00,850 --> 00:26:05,670
You can use a htaccess file to just password protect your installation.

222
00:26:06,230 --> 00:26:08,830
That works.

223
00:26:08,830 --> 00:26:14,610
A problem is that some of these applications use htaccess themselves to configure things.

224
00:26:15,530 --> 00:26:18,450
And you need to make sure that that doesn't interfere.

225
00:26:18,450 --> 00:26:22,670
For example, if you finish a WordPress installation, it creates an htaccess file.

226
00:26:22,830 --> 00:26:30,290
And what you can however do is that you put your password protection htaccess file in the upper directory.

227
00:26:30,810 --> 00:26:39,330
Because like Apache server goes recursively through all the directories to scan for htaccess files.

228
00:26:39,950 --> 00:26:45,890
That doesn't work at all web hosting environments because sometimes you only have write access in your web root.

229
00:26:46,010 --> 00:26:49,510
But if you have write access in the upper directory, then you can do that.

230
00:26:49,690 --> 00:26:55,750
And that's kind of the best you can do right now as long as these applications don't protect you.

231
00:26:58,110 --> 00:26:59,730
So, yeah.

232
00:26:59,730 --> 00:27:02,050
Defending as a user is hard here.

233
00:27:02,050 --> 00:27:04,570
And we really need fixes from vendors here.

234
00:27:08,050 --> 00:27:11,730
Then I was wondering, do attackers already use this?

235
00:27:11,730 --> 00:27:14,170
Does anyone know about this attack?

236
00:27:14,170 --> 00:27:15,810
Has anyone had the same idea?

237
00:27:15,810 --> 00:27:17,430
And do they already exploit it?

238
00:27:17,430 --> 00:27:25,930
So, I sent a couple of posts with just random subdomains from my domains and checked if anyone would access them.

239
00:27:26,010 --> 00:27:29,310
And okay, my own test script would access them.

240
00:27:29,430 --> 00:27:30,450
That's obvious.

241
00:27:32,110 --> 00:27:38,970
And I also saw this in the log file which says Netcraft survey agent.

242
00:27:38,970 --> 00:27:40,790
So, Netcraft is a company.

243
00:27:40,790 --> 00:27:43,430
I think they mainly do statistics around the web.

244
00:27:43,430 --> 00:27:46,430
So, I think this is non-malicious.

245
00:27:46,430 --> 00:27:56,850
And it's also a good example that this data, of course, it can be used for attacks, but it can also be used for legitimate proposals like doing statistics, looking for new websites.

246
00:27:56,850 --> 00:27:59,660
That, I think, is legitimate use of that data.

247
00:28:01,010 --> 00:28:06,090
So, I think nobody is exploiting this yet, but that may change.

248
00:28:06,930 --> 00:28:07,550
Yeah.

249
00:28:08,070 --> 00:28:14,830
So, major takeaway, I think, is unauthenticated installs are a security risk.

250
00:28:14,830 --> 00:28:20,770
And I really think these web applications need to do something about that and should fix this.

251
00:28:23,710 --> 00:28:32,590
Then one thing, and I think that message many people haven't gotten yet, there are no more secret host names, at least if you use HTTPS.

252
00:28:32,590 --> 00:28:47,070
So, if you ever had the idea in my company I could have internal secret something something dot company name dot com and there's an internal backend interface that nobody ever will find, forget about that.

253
00:28:47,190 --> 00:29:00,290
That has been a bad idea in the past anyway, because host names are not encrypted, even if you use HTTPS, the host name is always visible on the traffic, both through DNS and through server name indication.

254
00:29:01,710 --> 00:29:04,410
But now it's a really broken assumption.

255
00:29:04,410 --> 00:29:09,390
So, if you have HTTPS for your web pages, you must assume that the host names are public.

256
00:29:09,430 --> 00:29:16,950
And it's also interesting if you're maybe a pen tester or looking at a bug bounty program, this is a good way to search for host names from companies.

257
00:29:19,110 --> 00:29:28,470
And, yeah, final takeaway, certificate transparency is a valuable data source, both for attackers and defenders.

258
00:29:29,750 --> 00:29:33,150
And I'd like to say something that I find important.

259
00:29:33,150 --> 00:29:40,330
So, when I submitted this talk, I feared a bit that people might use this as an argument against certificate transparency.

260
00:29:40,710 --> 00:29:43,850
And therefore I want to make very clear that I don't think it is.

261
00:29:43,850 --> 00:29:46,890
I think certificate transparency is an amazing system.

262
00:29:46,890 --> 00:29:52,430
It's probably the best security improvement the TLS ecosystem has seen in a while.

263
00:29:53,510 --> 00:29:56,090
And I think the problem really lies elsewhere.

264
00:29:56,090 --> 00:30:02,510
Certificate transparency is just kind of amplifying the problem of unauthenticated installers here.

265
00:30:03,070 --> 00:30:04,350
So, yeah.

266
00:30:06,510 --> 00:30:13,050
Yeah, I think it was pretty fast, so we should have time for some questions.

267
00:30:13,050 --> 00:30:13,730
Thank you.