Later archive addition

Bamboozling Certificate Authorities with BGP

Henry Birge-Lee, Yixin Sun, Anne Edmundson, Jennifer Rexford and Prateek Mittal

An autonomous system can hijack BGP routes to a victim domain just long enough to answer a certificate authority domain validation check and obtain a valid certificate for a domain it does not control. The authors demonstrate this against real top CAs, measure 1.8 million certificates, and propose multiple vantage point validation and BGP monitoring.

Record

Researcher

Henry Birge-Lee, Yixin Sun, Anne Edmundson, Jennifer Rexford and Prateek Mittal

In the archive

• Added to the 2018 archive after the original list was published

Related sources

• Talk recording

Tags

• tls
• https
• auth-bypass
• dns
• measurement-study
• large-scale-scan
• mitigation
• owasp-a01-2021
• owasp-a02-2021

This page is the archive's own catalogue record. The research is the work of Henry Birge-Lee, Yixin Sun, Anne Edmundson, Jennifer Rexford and Prateek Mittal, first published at the original source. Preserved copies are kept so the citation survives its host.