NSA Warns Of Wildcard Certificate Risks, Issues Mitigations

Share post:

The U.S. National Security Agency (NSA) has warned organizations and individuals of the dangers of using broadly-scoped certificates to authenticate multiple servers in an organization.

Previously, researchers have shown that Transport Layer Security (TLS) servers running different protocols with compatible certificates such as wildcard and multi-domain could be exploited by an Application Layer Protocols Allowing Cross-Protocol Attack (ALPACA), which could allow attackers to steal cookies or conduct cross-site scripting attacks.

According to the NSA, “ALPACA is a complex class of exploitation techniques that can take many forms,” and in order to achieve its goal, it needs a targeted web application that uses TLS. TLS is another service/application that provides a valid TLS certificate with a subject name that would be for the targeted web app, a means for the malicious actor to redirect the network traffic of the target application to the second service, and an HTTP request that is accepted by the second service.

The NSA, therefore, recommended that organizations protect the private key of a wildcard certificate and keep it on a well-maintained server to avoid the risk of attackers obtaining it by compromising a poorly secured machine.

For more information, read the original story in BleepingComputer.

Featured Tech Jobs



Related articles

Kaspersky uncovers malware targeting iPhones running iOS 15.7 and below

Kaspersky has uncovered a sophisticated malware campaign specifically designed to infect iPhones running up to iOS 15.7 through...

WordPress fixes critical Jetpack plugin vulnerability

WordPress has addressed a critical flaw discovered in the Jetpack plugin, which had the potential to enable authors...

Akamai discovers Dark Frost botnet exploiting gaming platforms

Akamai's security intelligence response team recently has alerted the general public of Dark Frost, a botnet that has...

Become a member

New, Relevant Tech Stories. Our article selection is done by industry professionals. Our writers summarize them to give you the key takeaways