TLS/SSL certificates have proven to be valuable commodities to organizations that use them to establish trust for connections and communications with customers, partners and employees. Unfortunately, this same trust is extremely valuable to cybercriminals for much the same reasons. When they fall into the wrong hands, TLS/SSL certificates can bring hidden risks to organizations, we often see them exploited in vulnerabilities and sophisticated attack campaigns. But, just how lucrative are these machine identities to cybercriminals? What are bad actors willing to do, and spend, to get their hands on TLS/SSL certificates?
“One very interesting aspect of this research was seeing TLS certificates packaged with wrap-around services – such as web design services – in order to give attackers immediate access to high levels of online credibility and trust,” said security researcher and report author David Maimon, associate professor and director of the Evidence-based Cybersecurity Research Group. “It was surprising to discover how easy and inexpensive it is to acquire extended validation certificates, along with all the documentation needed to create very credible shell companies without any verification information.”
Key discoveries from the first set of findings include:
Five of the Tor network markets observed, offer a steady supply of SSL/TLS certificates, along with a range of related services and products.
Prices for certificates vary from $260 to $1,600, depending on the type of certificate offered and the scope of additional services.
Researchers found extended validation certificates packaged with services to support malicious websites such as Google-indexed “aged” domains, after-sale support, web design services, and integration with a range of payment processors – including Stripe, PayPal and Square.
At least one vendor on BlockBooth promises to issue certificates from reputable Certificate Authorities along with forged company documentation – including DUNS numbers. This package of products and services allows attackers to credibly present themselves as a trusted U.S. or U.K. company for less than $2,000.
One representative search of these five marketplaces uncovered 2,943 mentions for “SSL” and 75 for “TLS.” In comparison, there were just 531 mentions for “ransomware” and 161 for “zero days.” It was also evident that some marketplaces – such as Dream Market – appear to specialize in the sale of TLS certificates, effectively providing machine-identity-as-a-service products. In addition, researchers found that certificates are often packaged with other crimeware, including ransomware.
“This study found clear evidence of the rampant sale of TLS certificates on the dark net,” said Kevin Bocek, vice president of security and threat intelligence for Venafi. “TLS certificates that act as trusted machine identities are clearly a key part of cybercriminal toolkits – just like bots, ransomware and spyware. There is a lot more research to do in this area, but every organization should be concerned that the certificates used to establish and maintain trust and privacy on the internet are being weaponized and sold as commodities to cybercriminals.”