{"id":123627,"date":"2025-04-22T09:05:07","date_gmt":"2025-04-22T07:05:07","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/uyazvimost-v-udostoveryayushhem-czentre-ssl-com-pozvolyavshaya-poluchit-sertifikat-dlya-chuzhogo-domena"},"modified":"2025-04-22T09:05:07","modified_gmt":"2025-04-22T07:05:07","slug":"uyazvimost-v-udostoveryayushhem-czentre-ssl-com-pozvolyavshaya-poluchit-sertifikat-dlya-chuzhogo-domena","status":"publish","type":"post","link":"https:\/\/prohoster.info\/da\/blog\/news\/uyazvimost-v-udostoveryayushhem-czentre-ssl-com-pozvolyavshaya-poluchit-sertifikat-dlya-chuzhogo-domena","title":{"rendered":"S\u00e5rbarhed i SSL.com-certifikatmyndigheden, der tillod at f\u00e5 et certifikat til et andets dom\u00e6ne","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

I SSL.com-certifikatscenter er der opdaget en s\u00e5rbarhed i systemet til kontrol af ejerskab af dom\u00e6ner, der gjorde det muligt at f\u00e5 et TLS-certifikat for ethvert dom\u00e6ne, bare ved at give angriberen en e-mail. For at f\u00e5 et TLS-certifikat var det tilstr\u00e6kkeligt at have adgang til e-mailen med det m\u00e5lrettede dom\u00e6ne. For eksempel gjorde s\u00e5rbarheden det muligt at f\u00e5 et TLS-certifikat for dom\u00e6ner, der blev brugt i offentlige e-mail-tjenester som gmail.com, yandex.ru, yahoo.com, outlook.com og icloud.com. <\/p>\n

S\u00e5rbarheden gav ogs\u00e5 angriberne mulighed for at udf\u00f8re m\u00e5lrettede angreb mod ansatte i kendte virksomheder og deltagere i store projekter for at f\u00e5 adgang til deres e-mail og f\u00e5 TLS-certifikater til kendte. dom\u00e6ner<\/a>. For eksempel gjorde en hacking af en Google-ansat, der havde e-mail name@google.com, det muligt at f\u00e5 et certifikat for dom\u00e6net<\/a> google.com. <\/p>\n

S\u00e5rbarheden blev for\u00e5rsaget af en fejl i implementeringen af dom\u00e6neejerskabsbekr\u00e6ftelsessystemet via e-mailbekr\u00e6ftelse. For at f\u00e5 en bekr\u00e6ftelse via e-mail skal der tilf\u00f8jes en DNS TXT-post «_validation-contactemail» til DNS-zonen for det dom\u00e6ne, som certifikatet anmodes om. For eksempel «_validation-contactemail.test.com DNS TXT name@example.com». Efter initiationen af dom\u00e6neverificeringen vil en bekr\u00e6ftelseskode blive sendt til e-mailen name@examle.com, hvorefter indtastningen af denne kode bekr\u00e6fter ejerskabet af dom\u00e6net «test.com» og muligg\u00f8r udstedelsen af et TLS-certifikat for «test.com». <\/p>\n

Essensen af s\u00e5rbarheden er, at ud over dom\u00e6net «test.com», for hvilket certifikatet blev anmodet, blev ejerskabsbekr\u00e6ftelsestegnet ogs\u00e5 tildelt for dom\u00e6net «example.com», der blev brugt i e-mailen. Den forsker, der opdagede problemet, demonstrerede opn\u00e5elsen af et fungerende TLS-certifikat for dom\u00e6net aliyun.com, der blev anvendt i webmail-tjenesten fra den kinesiske virksomhed Alibaba. Under et testangreb registrerede forskeren det verificerende dom\u00e6ne «d2b4eee07de5efcb8598f0586cbf2690.test.dcv-inspector.com» i tjenesten «dcv-inspector.com» og anmodede om TLS-certifikatet ved at tilf\u00f8je DNS-posten: _validation-contactemail.d2b4eee07de5efcb8598f0586cbf2690.test.dcv-inspector.com DNS TXT myusername@aliyun.com <\/p>\n

Herefter anmodede han om et TLS-certifikat for dom\u00e6net d2b4eee07de5efcb8598f0586cbf2690.test.dcv-inspector.com p\u00e5 SSL.com og valgte e-mailbekr\u00e6ftelse. Certifikatmyndigheden SSL.com sendte en bekr\u00e6ftelseskode til myusername@aliyun.com, og efter indtastningen af denne kode blev ikke kun «d2b4eee07de5efcb8598f0586cbf2690.test.dcv-inspector.com» tilf\u00f8jet til listen over verificerede dom\u00e6ner, men ogs\u00e5 «aliyun.com». Efter dette opn\u00e5ede forskeren med succes et TLS-certifikat for dom\u00e6net «aliyun.com», hvis ejerskab var blevet bekr\u00e6ftet. <\/p>\n

Certifikatmyndigheden SSL.com l\u00f8ste problemet og identificerede 11 certifikater, hvorudgivelsen af dem brugte en s\u00e5rbar verifikationsmetode med et tredjepartsdom\u00e6ne via email. Formodentlig er der i de identificerede tilf\u00e6lde ingen tegn p\u00e5 ondsindet aktivitet, og af de 11 er kun \u00e9t certifikat, som blev modtaget af forskeren til webstedet aliyun.com, blevet tilbagekaldt indtil videre. De \u00f8vrige certifikater omfattede dom\u00e6nerne medinet.ca, help.gurusoft.com.sg, banners.betvictor.com, production-boomi.3day.com, kisales.com og medc.kisales.com. SSL.com har til hensigt at offentligg\u00f8re en rapport om h\u00e6ndelsen inden den 2. maj.
\n
Kilde: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0412 \u0443\u0434\u043e\u0441\u0442\u043e\u0432\u0435\u0440\u044f\u044e\u0449\u0435\u043c \u0446\u0435\u043d\u0442\u0440\u0435 SSL.com \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432 \u0441\u0438\u0441\u0442\u0435\u043c\u0435 \u043f\u0440\u043e\u0432\u0435\u0440\u043a\u0438 \u0432\u043b\u0430\u0434\u0435\u043d\u0438\u044f \u0434\u043e\u043c\u0435\u043d\u043e\u043c, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0432\u0448\u0430\u044f \u043f\u043e\u043b\u0443\u0447\u0438\u0442\u044c TLS-\u0441\u0435\u0440\u0442\u0438\u0444\u0438\u043a\u0430\u0442 \u0434\u043b\u044f \u043b\u044e\u0431\u043e\u0433\u043e \u0434\u043e\u043c\u0435\u043d\u0430, \u043f\u0440\u0435\u0434\u043e\u0441\u0442\u0430\u0432\u0438\u0432\u0448\u0435\u0433\u043e email \u0430\u0442\u0430\u043a\u0443\u044e\u0449\u0435\u043c\u0443. \u0414\u043b\u044f \u043f\u043e\u043b\u0443\u0447\u0435\u043d\u0438\u044f TLS-\u0441\u0435\u0440\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u0430 \u0431\u044b\u043b\u043e \u0434\u043e\u0441\u0442\u0430\u0442\u043e\u0447\u043d\u043e \u0434\u043e\u0441\u0442\u0443\u043f\u0430 \u043a email \u0441 \u0446\u0435\u043b\u0435\u0432\u044b\u043c \u0434\u043e\u043c\u0435\u043d\u043e\u043c. \u041d\u0430\u043f\u0440\u0438\u043c\u0435\u0440, \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u043b\u0430 \u043f\u043e\u043b\u0443\u0447\u0438\u0442\u044c TLS-\u0441\u0435\u0440\u0442\u0438\u0444\u0438\u043a\u0430\u0442 \u0434\u043b\u044f \u0434\u043e\u043c\u0435\u043d\u043e\u0432, \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u043c\u044b\u0445 \u0432 \u043e\u0431\u0449\u0435\u0434\u043e\u0441\u0442\u0443\u043f\u043d\u044b\u0445 email-\u0441\u0435\u0440\u0432\u0438\u0441\u0430\u0445, \u0442\u0430\u043a\u0438\u0445 \u043a\u0430\u043a gmail.com, yandex.ru, yahoo.com, outlook.com \u0438 icloud.com. \u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0442\u0430\u043a\u0436\u0435 \u0434\u0430\u0432\u0430\u043b\u0430 \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0430\u043c \u0432\u043e\u0437\u043c\u043e\u0436\u043d\u043e\u0441\u0442\u044c […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-123627","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47S\u00e5rbarhed i certifikatmyndigheden SSL.com, der gjorde det muligt at f\u00e5 et certifikat til et fremmed dom\u00e6ne | ProHoster","description":"Der er opdaget en s\u00e5rbarhed i certifikatmyndigheden SSL.coms system til verifikation af dom\u00e6neejerskab, som gjorde det muligt at f\u00e5 et TLS-certifikat for ethvert dom\u00e6ne, der gav en email til angriberen.","canonical_url":"https:\/\/prohoster.info\/da\/blog\/news\/uyazvimost-v-udostoveryayushhem-czentre-ssl-com-pozvolyavshaya-poluchit-sertifikat-dlya-chuzhogo-domena","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"da_DK","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432 \u0443\u0434\u043e\u0441\u0442\u043e\u0432\u0435\u0440\u044f\u044e\u0449\u0435\u043c \u0446\u0435\u043d\u0442\u0440\u0435 SSL.com, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0432\u0448\u0430\u044f \u043f\u043e\u043b\u0443\u0447\u0438\u0442\u044c \u0441\u0435\u0440\u0442\u0438\u0444\u0438\u043a\u0430\u0442 \u0434\u043b\u044f \u0447\u0443\u0436\u043e\u0433\u043e \u0434\u043e\u043c\u0435\u043d\u0430 | ProHoster","og:description":"\u0412 \u0443\u0434\u043e\u0441\u0442\u043e\u0432\u0435\u0440\u044f\u044e\u0449\u0435\u043c \u0446\u0435\u043d\u0442\u0440\u0435 SSL.com \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432 \u0441\u0438\u0441\u0442\u0435\u043c\u0435 \u043f\u0440\u043e\u0432\u0435\u0440\u043a\u0438 \u0432\u043b\u0430\u0434\u0435\u043d\u0438\u044f \u0434\u043e\u043c\u0435\u043d\u043e\u043c, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0432\u0448\u0430\u044f \u043f\u043e\u043b\u0443\u0447\u0438\u0442\u044c TLS-\u0441\u0435\u0440\u0442\u0438\u0444\u0438\u043a\u0430\u0442 \u0434\u043b\u044f \u043b\u044e\u0431\u043e\u0433\u043e \u0434\u043e\u043c\u0435\u043d\u0430, \u043f\u0440\u0435\u0434\u043e\u0441\u0442\u0430\u0432\u0438\u0432\u0448\u0435\u0433\u043e email \u0430\u0442\u0430\u043a\u0443\u044e\u0449\u0435\u043c\u0443.","og:url":"https:\/\/prohoster.info\/da\/blog\/news\/uyazvimost-v-udostoveryayushhem-czentre-ssl-com-pozvolyavshaya-poluchit-sertifikat-dlya-chuzhogo-domena","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2025-04-22T07:05:07+00:00","article:modified_time":"2025-04-22T07:05:07+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"123627","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":"default","schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-02-11 11:16:23","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2026-01-23 12:22:22","updated":"2026-02-11 11:16:23","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/posts\/123627","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/comments?post=123627"}],"version-history":[{"count":2,"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/posts\/123627\/revisions"}],"predecessor-version":[{"id":160581,"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/posts\/123627\/revisions\/160581"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/media?parent=123627"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/categories?post=123627"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/tags?post=123627"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}