NSA Warns Of Wildcard Certificate Risks, Issues Mitigations

Share post:

The U.S. National Security Agency (NSA) has warned organizations and individuals of the dangers of using broadly-scoped certificates to authenticate multiple servers in an organization.

Previously, researchers have shown that Transport Layer Security (TLS) servers running different protocols with compatible certificates such as wildcard and multi-domain could be exploited by an Application Layer Protocols Allowing Cross-Protocol Attack (ALPACA), which could allow attackers to steal cookies or conduct cross-site scripting attacks.

According to the NSA, “ALPACA is a complex class of exploitation techniques that can take many forms,” and in order to achieve its goal, it needs a targeted web application that uses TLS. TLS is another service/application that provides a valid TLS certificate with a subject name that would be for the targeted web app, a means for the malicious actor to redirect the network traffic of the target application to the second service, and an HTTP request that is accepted by the second service.

The NSA, therefore, recommended that organizations protect the private key of a wildcard certificate and keep it on a well-maintained server to avoid the risk of attackers obtaining it by compromising a poorly secured machine.

For more information, read the original story in BleepingComputer.

SUBSCRIBE NOW

Related articles

DOGE’s Teen Hacker Stirs Concern Over Musk Team’s Access to Federal Databases

A 19-year-old named Edward “Big Balls” Coristine has raised red flags after Wired revealed he holds a key...

Deep Seek and Open Source AI – Without the Hype: Discussion with Robert Falzon, Head of Engineering, Check Point

DeepSeek AI is shaking up the cybersecurity world—are we prepared for the risks? Join host Jim Love and...

Researchers Jailbreak DeepSeek AI, Expose System Prompt and Raise Security Concerns

Security researchers at Wallarm have successfully jailbroken DeepSeek, a recently released open-source AI model from China. The jailbreak...

New SMS Phishing Scam Targets U.S. Toll Road Users with Fake Payment Alerts

Brian Krebs of the Krebs on Security blog did a big piece leading with how residents across the...

Become a member

New, Relevant Tech Stories. Our article selection is done by industry professionals. Our writers summarize them to give you the key takeaways