NSA Warns Of Wildcard Certificate Risks, Issues Mitigations

Share post:

The U.S. National Security Agency (NSA) has warned organizations and individuals of the dangers of using broadly-scoped certificates to authenticate multiple servers in an organization.

Previously, researchers have shown that Transport Layer Security (TLS) servers running different protocols with compatible certificates such as wildcard and multi-domain could be exploited by an Application Layer Protocols Allowing Cross-Protocol Attack (ALPACA), which could allow attackers to steal cookies or conduct cross-site scripting attacks.

According to the NSA, “ALPACA is a complex class of exploitation techniques that can take many forms,” and in order to achieve its goal, it needs a targeted web application that uses TLS. TLS is another service/application that provides a valid TLS certificate with a subject name that would be for the targeted web app, a means for the malicious actor to redirect the network traffic of the target application to the second service, and an HTTP request that is accepted by the second service.

The NSA, therefore, recommended that organizations protect the private key of a wildcard certificate and keep it on a well-maintained server to avoid the risk of attackers obtaining it by compromising a poorly secured machine.

For more information, read the original story in BleepingComputer.

Featured Tech Jobs


Related articles

Russian threat actor expanding its target list, warns Five Eyes report

APT29 is increasingly going after cloud services in mo

Canada’s privacy watchdog investigating hack at Global Affairs

Inquiry will look into adequacy of data safeguards at the federal

Sidebar: The powerful Digital Safety Commission

A look at the powers of the proposed five-person body charged with overseeing the Online

Cyber attack on Hamilton knocks out municipal phone, email

One of Ontario’s biggest cities is in the second day of dealing with a cyber attack. Hamilton, a municipality of about 570,000 on the shore of Lake Ontario, said Sunday it had suffered a city-wide phone and email “disruption” to municipal and public library services, which included the Bus Check Info Line and the HSRNow

Become a member

New, Relevant Tech Stories. Our article selection is done by industry professionals. Our writers summarize them to give you the key takeaways