Posts

Showing posts from July, 2014

Risk of self signed certficates

Risks of Using Self Signed Certificate for Authenticity:

Anyone can create a self-signed certificate, and anyone can put whatever meta-data that they want into it. So, two self-signed certificates can look and behave identically, one can't visually distinguish between a legitimate and a forged certificate. It means, anyone can create similar cab file & digitally sign using self-signed legitimate or forged certificates, send to our customers. The customer will not able to differentiate between fake and genuine one.

Risks of Using Self Signed Certificate for Integrity:

User creates a file for distribution using his own self signed certificate and sends to receiver. Here an attacker too creates a his own self-signed certificate with the same name. Attacker does a MITM, captures User’s data, modifies it, removes the signature (in case of dlls, exes just remove from PE header), re-signs with his own self-signed certificate and forwards it to the receiver. This way the data can be tam…