Certi�ed Lies: Detecting and Defeating Government Interception Attacks Against SSL

[prodil89]

"This paper introduces the compelled cer-

ticate creation attack, in which government

agencies may compel a certicate authority to

issue false SSL certicates that can be used by

intelligence agencies to covertly intercept and

hijack individuals' secure Web-based commu-

nications. Although we do not have direct ev-

idence that this form of active surveillance is

taking place in the wild, we show how prod-

ucts already on the market are geared and mar-

keted towards this kind of use|suggesting such

attacks may occur in the future, if they are

not already occurring. Finally, we introduce

a lightweight browser add-on that detects and

thwarts such attacks."

[url]http://files.cloudprivacy.net/ssl-mitm.pdf[/url]