SSL/TLS is an encryption mechanism that keeps your data confidential between your browser and a webpage. This system protects your data between you and (for example) your bank. To do such things, a bank needs a certificate. That certificate can be verified easily and quickly if it is provided by a certain type of certificate authority, and keep your transactions secure. If you understand the basics of SSL, let me save you some time and point you straight to the graph you can explore on your own. In particular, consider what these kinds of graphs mean for certificate transparency efforts.
For those of you who don’t trouble with technical details, imagine that every key on your keychain has a little tag on it. This tag would have the name of the door it secures, for example:
This means when the key is used for any other door (and there are reasons hackers might try to trick you into that), then you would receive a little warning, telling you this lock isn’t the one you think it is…
However, our goal in this blog post is not to examine the security of certificates in a detailed technical way. Many other commentators do that. Instead let’s examine the ecosystem of certificates and certificate authorities as a network to understand the systemic risk that they might pose if they themselves are compromised by hackers.
If one of these providers had a technical problem, how many users might have their communications exposed? We like to use industry standards and adopt market leader products because higher market share usually translates into efficiency, usability, and quality. But if market share means that we all go down together, this is an added dimension of risk. This is the way that risk managers think. Am I diversifying my risk? Am I over reliant on a certificate provider? Are some certificate providers too big to fail? What would be good practice for business users in their certificate purchases?
Let us begin with the cautionary tale of Diginotar. DigiNotar was a Dutch certificate authority that was bankrupted by a security breach – at least 500 fake certificates were forged, and 300,000 gmail users – all in Iran for some reason..? – were targeted. Keep that in mind as you look at the upcoming image.
We analyse how web certificate providers are used by customers, and the commonality and linkage between them – this is the web of trust. The data has been generously donated by John Matherly of Shodan. John allowed us to examine certificates chosen at random, from data he gets while scanning the internet.
We build the simplest of graphs from such associations, and by ignoring certificates we see only once (46%), we can focus on certificates which represent a larger number of users. For attackers, compromising these encrypted connections provides the greatest utility. Let’s have a look at that graph of roughly 2k nodes and 2K edges (many hub features).
This is a force-directed graph, and the nodes are scaled according to weighted edges. So instantly, we can see our top three issuers are Cybertrust, Geotrust, and Vodafone group. However, the weighting of those edges shows us a few interesting anomalies. Akamai is heavily dependent on Cybertrust, while CloudFlare is very reliant on GlobalSign nv-sa. Vodaphone is obviously trying to use its own services to heavy advantage, while Los Alamos National Laboratory uses Entrust.
These links show how the distribution of trust is apportioned for our encryption, and precious few of these companies are using more than 2 issuers of certificates (103), even fewer are using 3 (13), and only 3 are diversified to use 4 certificate authorities. Even more importantly, that might not be diversification, but variation over time as one subject buys multiple certificates over an extended period. As a supply chain, there is not a lot of diversification here.
Now if one of these issuers were to suffer a major breach, those edge weightings and node sizes would take a on a very different meaning. Essentially, size represents how much of an impact on the certificate landscape the breach of that company would have (assuming the need to revoke certificates), while the thickness of the edge represents how badly hit each subject would be. That has a real impact on business, as people stop visiting websites without little green locks.
Eireann Leverett
Latest posts by Eireann Leverett (see all)
- Where does cyber risk accumulate for insurers? - 24 September 2015
- The emergent white-blood cells of the internet - 1 July 2015
- Differentiating two cyber risks - 23 February 2015
Leave a Reply