It's easy to fake Extended Validation certificates, research shows

EV certificates — the files that tell a browser to show the little green lock — are supposed to make crystal clear who owns a website. There's a way around it, though.

What does the happy green lock at the top of your browser mean? Maybe not what you think.

Extended Validation certificates — the files that tell your browser to show the lock — are supposed to make crystal clear who owns a website, in order to stymie cyberattacks and phishing. Instead, EV certificates are dangerously easy to fake, according to experts like U.S.-based researcher Ian Carroll.

The certificates are meant to prove legal ownership of HTTPS websites so that you are certain, for instance, that Google owns the website you’re visiting. Browsers like Chrome and Firefox show a green bar with the company name to signify security. The iOS version of Safari even replaces URLs entirely with the EV certificate.

The problem, Carroll explained in a recent blog post, is that it’s easy to incorporate under the same name as big-time companies and therefore imitate their EV certificate. Carroll did exactly that by incorporating as “Stripe, Inc” in Kentucky and imitating the multimillion-dollar payment processing firm “Stripe, Inc” incorporated in Delaware.

The result is that it ranges from difficult to impossible for users to tell the difference between the real deal and the fake.

https://twitter.com/iangcarroll/status/940281927789146112

Experts like Carroll expect to see hackers take advantage.

“There will undoubtedly be many proposed solutions to this issue,” Carroll wrote. “Ultimately, though, any method that ends up giving users a legal entity is fatally flawed.”

Because EV certificates stem from legal processes, any fix would ultimately have to be legal as well as technical in nature.

“As a result of how extended validation certificates work, browsers have few options to fix this,” Carroll argued. “Having said that, they can take steps to ensure EV certificates do not override other critical parts of the user interface, like Safari does.”

It’s not clear anyone is currently exploiting this weakness in the wild, but Carroll and other experts expect to see it in the future, especially in targeted phishing campaigns against browsers like the iOS version of Safari, which completely covers the URL bar with easily faked EV indicators.

Government

• FBI officials say AI is bolstering adversaries, emphasizing need to focus on cyber basics, patching

• Feds accuse China of ‘systematic’ distillation of U.S. AI models

• CIA’s Michael Ellis says cyber intelligence is changing how the agency operates

• Jail time for Maine child in 764 marks turning point in federal law enforcement

Technology

• FCC proposes public scorecard to rate telecoms on anti-robocall efforts

• Pegasus, NoviSpy variant spyware found on devices of Serbian activists

• Wyden seeks upgraded NSA security guidance on commercial VPN use

• The Collective Cyber Defense letter wrote your next vendor questionnaire

Threats

• Chinese espionage groups swarm to exploit triple-link chain of zero-days

• Microsoft discloses two actively exploited zero-days among 974 vulnerabilities

• Russian national extradited to US for alleged involvement in bank-account takeover scheme

• Attackers exploit zero-days in consistently besieged SonicWall product

Policy

• Whistleblower says USPS deploying new, ‘untested’ IT systems governing mail-in ballots

• ‘Watershed 250’ test program in Texas looks to private sector for water cybersecurity help

• Former sexual abuse victims say Grok used their images, videos to train deepfake capabilities

• Cyber threats nudge Trump to sign executive order on foreign equipment in U.S. energy infrastructure