The rise of certificate transparency and its implications on the internet ecosystem

Quirin Scheitle; Oliver Gasser; Theodor Nolte; Johanna Amann; Lexi Brent; Georg Carle; Ralph Holz; Thomas C. Schmidt; Matthias Wählisch

doi:10.1145/3278532.3278562

The rise of certificate transparency and its implications on the internet ecosystem

Quirin Scheitle, Oliver Gasser, Theodor Nolte, Johanna Amann, Lexi Brent, Georg Carle, Ralph Holz, Thomas C. Schmidt, Matthias Wählisch

Informatics 8 - Chair of Network Architectures and Services

Research output: Chapter in Book/Report/Conference proceeding › Conference contribution › peer-review

48 Scopus citations

Abstract

In this paper, we analyze the evolution of Certificate Transparency (CT) over time and explore the implications of exposing certificate DNS names from the perspective of security and privacy. We find that certificates in CT logs have seen exponential growth. Website support for CT has also constantly increased, with now 33% of established connections supporting CT. With the increasing deployment of CT, there are also concerns of information leakage due to all certificates being visible in CT logs. To understand this threat, we introduce a CT honeypot and show that data from CT logs is being used to identify targets for scanning campaigns only minutes after certificate issuance. We present and evaluate a methodology to learn and validate new subdomains from the vast number of domains extracted from CT logged certificates.

Original language	English
Title of host publication	IMC 2018 - Proceedings of the Internet Measurement Conference
Publisher	Association for Computing Machinery
Pages	343-349
Number of pages	7
ISBN (Electronic)	9781450356190
DOIs	https://doi.org/10.1145/3278532.3278562
State	Published - 31 Oct 2018
Event	2018 Internet Measurement Conference, IMC 2018 - Boston, United States Duration: 31 Oct 2018 → 2 Nov 2018

Publication series

Name	Proceedings of the ACM SIGCOMM Internet Measurement Conference, IMC

Conference

Conference	2018 Internet Measurement Conference, IMC 2018
Country/Territory	United States
City	Boston
Period	31/10/18 → 2/11/18

Keywords

Certificate Transparency
Honeypot
Phishing

Access to Document

10.1145/3278532.3278562

Cite this

Scheitle, Q., Gasser, O., Nolte, T., Amann, J., Brent, L., Carle, G., Holz, R., Schmidt, T. C., & Wählisch, M. (2018). The rise of certificate transparency and its implications on the internet ecosystem. In IMC 2018 - Proceedings of the Internet Measurement Conference (pp. 343-349). (Proceedings of the ACM SIGCOMM Internet Measurement Conference, IMC). Association for Computing Machinery. https://doi.org/10.1145/3278532.3278562

@inproceedings{9328b3c3b6a045f6ac98df107110e8dc,

title = "The rise of certificate transparency and its implications on the internet ecosystem",

abstract = "In this paper, we analyze the evolution of Certificate Transparency (CT) over time and explore the implications of exposing certificate DNS names from the perspective of security and privacy. We find that certificates in CT logs have seen exponential growth. Website support for CT has also constantly increased, with now 33% of established connections supporting CT. With the increasing deployment of CT, there are also concerns of information leakage due to all certificates being visible in CT logs. To understand this threat, we introduce a CT honeypot and show that data from CT logs is being used to identify targets for scanning campaigns only minutes after certificate issuance. We present and evaluate a methodology to learn and validate new subdomains from the vast number of domains extracted from CT logged certificates.",

keywords = "Certificate Transparency, Honeypot, Phishing",

author = "Quirin Scheitle and Oliver Gasser and Theodor Nolte and Johanna Amann and Lexi Brent and Georg Carle and Ralph Holz and Schmidt, {Thomas C.} and Matthias W{\"a}hlisch",

note = "Publisher Copyright: {\textcopyright} 2018 Copyright held by the owner/author(s). Publication rights licensed to ACM.; 2018 Internet Measurement Conference, IMC 2018 ; Conference date: 31-10-2018 Through 02-11-2018",

year = "2018",

month = oct,

day = "31",

doi = "10.1145/3278532.3278562",

language = "English",

series = "Proceedings of the ACM SIGCOMM Internet Measurement Conference, IMC",

publisher = "Association for Computing Machinery",

pages = "343--349",

booktitle = "IMC 2018 - Proceedings of the Internet Measurement Conference",

}

Scheitle, Q, Gasser, O, Nolte, T, Amann, J, Brent, L, Carle, G, Holz, R, Schmidt, TC & Wählisch, M 2018, The rise of certificate transparency and its implications on the internet ecosystem. in IMC 2018 - Proceedings of the Internet Measurement Conference. Proceedings of the ACM SIGCOMM Internet Measurement Conference, IMC, Association for Computing Machinery, pp. 343-349, 2018 Internet Measurement Conference, IMC 2018, Boston, United States, 31/10/18. https://doi.org/10.1145/3278532.3278562

The rise of certificate transparency and its implications on the internet ecosystem. / Scheitle, Quirin; Gasser, Oliver; Nolte, Theodor et al.
IMC 2018 - Proceedings of the Internet Measurement Conference. Association for Computing Machinery, 2018. p. 343-349 (Proceedings of the ACM SIGCOMM Internet Measurement Conference, IMC).

Research output: Chapter in Book/Report/Conference proceeding › Conference contribution › peer-review

TY - GEN

T1 - The rise of certificate transparency and its implications on the internet ecosystem

AU - Scheitle, Quirin

AU - Gasser, Oliver

AU - Nolte, Theodor

AU - Amann, Johanna

AU - Brent, Lexi

AU - Carle, Georg

AU - Holz, Ralph

AU - Schmidt, Thomas C.

AU - Wählisch, Matthias

PY - 2018/10/31

Y1 - 2018/10/31

N2 - In this paper, we analyze the evolution of Certificate Transparency (CT) over time and explore the implications of exposing certificate DNS names from the perspective of security and privacy. We find that certificates in CT logs have seen exponential growth. Website support for CT has also constantly increased, with now 33% of established connections supporting CT. With the increasing deployment of CT, there are also concerns of information leakage due to all certificates being visible in CT logs. To understand this threat, we introduce a CT honeypot and show that data from CT logs is being used to identify targets for scanning campaigns only minutes after certificate issuance. We present and evaluate a methodology to learn and validate new subdomains from the vast number of domains extracted from CT logged certificates.

AB - In this paper, we analyze the evolution of Certificate Transparency (CT) over time and explore the implications of exposing certificate DNS names from the perspective of security and privacy. We find that certificates in CT logs have seen exponential growth. Website support for CT has also constantly increased, with now 33% of established connections supporting CT. With the increasing deployment of CT, there are also concerns of information leakage due to all certificates being visible in CT logs. To understand this threat, we introduce a CT honeypot and show that data from CT logs is being used to identify targets for scanning campaigns only minutes after certificate issuance. We present and evaluate a methodology to learn and validate new subdomains from the vast number of domains extracted from CT logged certificates.

KW - Certificate Transparency

KW - Honeypot

KW - Phishing

UR - http://www.scopus.com/inward/record.url?scp=85058186131&partnerID=8YFLogxK

U2 - 10.1145/3278532.3278562

DO - 10.1145/3278532.3278562

M3 - Conference contribution

AN - SCOPUS:85058186131

T3 - Proceedings of the ACM SIGCOMM Internet Measurement Conference, IMC

SP - 343

EP - 349

BT - IMC 2018 - Proceedings of the Internet Measurement Conference

PB - Association for Computing Machinery

T2 - 2018 Internet Measurement Conference, IMC 2018

Y2 - 31 October 2018 through 2 November 2018

ER -

The rise of certificate transparency and its implications on the internet ecosystem

Abstract

Publication series

Conference

Keywords

Access to Document

Other files and links

Fingerprint

Cite this