Risk of self signed certficates


Risks of Using Self Signed Certificate for Authenticity:

Anyone can create a self-signed certificate, and anyone can put whatever meta-data that they want into it. So, two self-signed certificates can look and behave identically, one can't visually distinguish between a legitimate and a forged certificate. It means, anyone can create similar cab file & digitally sign using self-signed legitimate or forged certificates, send to our customers. The customer will not able to differentiate between fake and genuine one.

Risks of Using Self Signed Certificate for Integrity:

User creates a file for distribution using his own self signed certificate and sends to receiver. Here an attacker too creates a his own self-signed certificate with the same name. Attacker does a MITM, captures User’s data, modifies it, removes the signature (in case of dlls, exes just remove from PE header), re-signs with his own self-signed certificate and forwards it to the receiver. This way the data can be tampered and there’s no way for the receiver to detect it as he will be able to decrypt and match the hashes using Attacker’s sent public key.


 

Comments

Popular posts from this blog

SQL Injection in search field

File Upload through Null Byte Injection