Skip to main content
banner image
venafi logo

2015 Retrospective Part 2: Venafi Was Painfully Accurate When We Predicted More Attacks on Trust

2015 Retrospective Part 2: Venafi Was Painfully Accurate When We Predicted More Attacks on Trust

December 14, 2015 | Kevin Bocek
Key Takeaways
  • Cyberattacks misusing keys and certificates increased in 2015
  • These attacks had a wide range of impacts, including phishing, MITM attacks, car apps, refrigerators, and more
  • In 2016, protecting keys and certificates must not be seen as merely an operations issue, but as a security priority

We correctly called 6 of the 8 predictions we made for 2015, which isn't bad (see our 2015 Retrospective Part 1). But we were absolutely 100% accurate on our overall prediction that attacks impacting the foundation of online trust—cryptographic keys and digital certificates—would increase. Looking back through 2015, Venafi Labs captured data on a steady stream of cyberattacks involving the misuse of keys and certificates, threatening the underlying foundation of trust for everything that is IP-based.

The attacks in 2015 show a continued increase in the misuse of keys and certificates. They also show how keys and certificates have become interwoven into many aspects of our business and personal lives. From airline Internet services to laptop software to government certificate authorities (CAs) to apps for your car or your fridge to Google and banking sites, keys and certificates secure all our online transactions.

Why is this important? If organizations cannot safeguard the use of keys and certificates for communication, authentication, and authorization, the resulting loss of trust will cost them their customers and potentially their business.

2015 Attack Timeline

Here is a sample of some notable security incidents the Venafi Labs threat research team followed:

  • Gogo Dished Up Man-in-the-Middle (MITM) Attacks
    To kick off the year, a Google Chrome engineer discovered that Gogo Inflight Internet service was issuing fake Google certificates. Gogo claimed it was trying to prevent online video streaming, but this practice ultimately exposed Gogo users to MITM attacks.
  • Lenovo Pre-installed Superfish Malware on Laptop
    Lenovo found that an adware program it was pre-installing on laptops was making itself an unrestricted root certificate authority, which allowed for MITM attacks on standard consumer PCs. 
  • CNNIC Got Banned by Google and Mozilla
    Google found unauthorized digital certificates for several of its domains issued by CNNIC, China’s main government-run CA, making CNNIC certificates untrustworthy and vulnerable to attack. Google, quickly followed by Mozilla, blocked all CNNIC authorized domains. In a 2015 Black Hat survey, Venafi found that IT security professionals understand the risks associated with untrusted certificates, such as those issued by CNNIC, but do nothing.
  • St. Louis Federal Reserve Bank Was Breached
    The US bank discovered that hackers had compromised its domain name register. This allowed the hackers to successfully redirect users of the bank's online research services to fake websites set up by the hackers.
  • New SSL/TLS Vulnerability Logjam Exposed Crypto Weaknesses
    Logjam exposed a problem with the Diffie-Hellman key exchange algorithm, which allows protocols such as HTTPS, SSH, IPsec, and others to negotiate a shared key and create a secure connection. Identified by university researchers, the Logjam flaw allowed MITM attacks by downgrading vulnerable TLS connections.
  • GM’s OnStar and Other Car Apps Were Hacked
    A GM OnStar system hack that locks, unlocks, starts, and stops GM cars was made possible because the GM application did not properly validate security certificates. By planting a cheap, homemade WiFi hotspot device somewhere on the car’s body to capture commands sent from the user’s smartphone to the car, hackers could break into the car’s vulnerable system, take full control, and behave as the driver indefinitely. Similar weaknesses allowed hacks in iOS applications for BMW, Mercedes, and Chrysler.
  • Major CAs Issued Compromised Certificates for Fake Phishing Websites
    Netcraft recently issued new research that found fake banking websites using domain-validated SSL certificates issued by Symantec, Comodo and GoDaddy.
  • Samsung’s Smart Fridge Was Hackable through Gmail
    A security flaw found in Samsung’s IoT smart refrigerators allowed hackers to compromise Gmail credentials using MITM attacks because the fridge was not set up to validate SSL certificates
  • Symantec Fired Employees for Issuing HTTPS Certificates for Fake Google Sites
    Several Symantec employees were fired for issuing unauthorized certificates that made it possible to fake HTTPS Google sites. The certificates were found by Google’s Certificate Transparency project.

This list of attacks that leveraged stolen, compromised, and/or unprotected cryptographic keys and digital certificates in 2015 highlights a wide range of potential impacts from attacks on trust, but is by no means a comprehensive list. In truth, many of these attacks go on undetected: cybercriminals use keys and certificates to bypass security controls and hide their actions.

Businesses need to understand that key and certificate management is not just an operations issue—it is critical to securing their networks, data, and trust relationships with customers and partners. The problem is compounded given that most Global 5000 organizations blindly trust the keys and certificates deployed on their networks and use security controls designed to trust these encryption components. There is an evil force out there in the cyber realm, lurking in the shadows that no one sees—until it’s too late. Without the ability to tell friend vs. foe, good vs. bad in the digital realm, our global economy is in a perilous situation.

And we think the misuse of keys and certificates will grow. Check out our predictions for 2016 to see how we think attacks on online trust will evolve in the upcoming year.

Want to find out your organization’s risk level from unprotected keys and certificates? Venafi can help. Contact us and we’ll set up an assessment for your business.

Like this blog? We think you will love this.
Featured Blog

Researchers Find 3,200 Apps Exposing Twitter API Keys, Cite ‘BOT Army’ Threat

Key Findings:

Read More
Subscribe to our Weekly Blog Updates!

Join thousands of other security professionals

Get top blogs delivered to your inbox every week

See Popular Tags

You might also like

TLS Machine Identity Management for Dummies

TLS Machine Identity Management for Dummies

Certificate-Related Outages Continue to Plague Organizations
White Paper

CIO Study: Certificate-Related Outages Continue to Plague Organizations

About the author

Kevin Bocek
Kevin Bocek

Kevin is Vice President of Security Strategy & Threat Intelligence at Venafi. He is recognized as a subject matter expert in threat detection, encryption, digital signatures, and key management, and has previously held positions at CipherCloud, PGP Corporation and Thales.

Read Posts by Author
get-started-overlay close-overlay cross icon
get-started-overlay close-overlay cross icon
Venafi Risk assessment Form Image

Sign up for Venafi Cloud

Venafi Cloud manages and protects certificates

* Please fill in this field Please enter valid email address
* Please fill in this field Password must be
At least 8 characters long
At least one digit
At last one lowercase letter
At least one uppercase letter
At least one special character
* Please fill in this field
* Please fill in this field
* Please fill in this field

End User License Agreement needs to be viewed and accepted

Already have an account? Login Here

get-started-overlay close-overlay cross icon

How can we help you?

Thank you!

Venafi will reach out to you within 24 hours. If you need an immediate answer please use our chat to get a live person.

In the meantime, please explore more of our solutions

Explore Solutions

learn more

Email Us a Question

learn more

Chat With Us

learn more