{"id":123627,"date":"2025-04-22T09:05:07","date_gmt":"2025-04-22T07:05:07","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/uyazvimost-v-udostoveryayushhem-czentre-ssl-com-pozvolyavshaya-poluchit-sertifikat-dlya-chuzhogo-domena"},"modified":"2025-04-22T09:05:07","modified_gmt":"2025-04-22T07:05:07","slug":"uyazvimost-v-udostoveryayushhem-czentre-ssl-com-pozvolyavshaya-poluchit-sertifikat-dlya-chuzhogo-domena","status":"publish","type":"post","link":"https:\/\/prohoster.info\/it\/blog\/novosti-interneta\/uyazvimost-v-udostoveryayushhem-czentre-ssl-com-pozvolyavshaya-poluchit-sertifikat-dlya-chuzhogo-domena","title":{"rendered":"Vulnerabilit\u00e0 nel certificatore SSL.com, che consentiva di ottenere un certificato per un dominio altrui","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

\u00c8 stata scoperta una vulnerabilit\u00e0 nel sistema di verifica della propriet\u00e0 del dominio presso il centro di certificazione SSL.com, che consentiva di ottenere un certificato TLS per qualsiasi dominio fornendo l'email all'attaccante. Per ottenere un certificato TLS era sufficiente avere accesso all'email con il dominio target. Ad esempio, la vulnerabilit\u00e0 permetteva di ottenere certificati TLS per domini utilizzati in servizi email pubblici, come gmail.com, yandex.ru, yahoo.com, outlook.com e icloud.com. <\/p>\n

La vulnerabilit\u00e0 consentiva inoltre agli aggressori di effettuare attacchi mirati sui dipendenti di aziende famose e sui partecipanti a grandi progetti per ottenere accesso alle loro email e ottenere certificati TLS per nomi noti. domini<\/a>. Ad esempio, compromettere un dipendente di Google con email name@google.com consentiva di ottenere un certificato per il dominio<\/a> google.com. <\/p>\n

La vulnerabilit\u00e0 \u00e8 stata causata da un errore nell'implementazione del sistema di verifica della propriet\u00e0 del dominio tramite conferma via email. Per ottenere la conferma via email, \u00e8 necessario aggiungere nella zona DNS del dominio per il quale si richiede il certificato, un record DNS TXT con \"_validation-contactemail\". Ad esempio, \"_validation-contactemail.test.com DNS TXT name@example.com\". Dopo aver avviato la verifica del dominio, verr\u00e0 inviato un codice di conferma all'email name@examle.com; l'inserimento di questo codice confermer\u00e0 la propriet\u00e0 del dominio \"test.com\" e consentir\u00e0 di ottenere il certificato TLS per \"test.com\". <\/p>\n

Il problema della vulnerabilit\u00e0 \u00e8 che, oltre al dominio \"test.com\" per il quale \u00e8 stato richiesto il certificato, il segnale di verifica della propriet\u00e0 \u00e8 stato attribuito anche al dominio \"example.com\", utilizzato nell'email. Il ricercatore che ha identificato il problema ha dimostrato di poter ottenere un certificato TLS funzionante per il dominio aliyun.com, utilizzato nel servizio webmail della compagnia cinese Alibaba. Durante un attacco di prova, il ricercatore ha registrato il dominio di verifica \"d2b4eee07de5efcb8598f0586cbf2690.test.dcv-inspector.com\" nel servizio \"dcv-inspector.com\" e ha richiesto un certificato TLS per esso, aggiungendo il record DNS: _validation-contactemail.d2b4eee07de5efcb8598f0586cbf2690.test.dcv-inspector.com DNS TXT myusername@aliyun.com <\/p>\n

Successivamente, ha richiesto sul sito SSL.com un certificato TLS per il dominio d2b4eee07de5efcb8598f0586cbf2690.test.dcv-inspector.com e ha scelto la conferma via email. L'autorit\u00e0 di certificazione SSL.com ha inviato un codice di verifica a myusername@aliyun.com e, dopo aver inserito questo codice, ha aggiunto all'elenco dei domini verificati non solo \"d2b4eee07de5efcb8598f0586cbf2690.test.dcv-inspector.com\", ma anche \"aliyun.com\". Successivamente, il ricercatore ha ottenuto con successo un certificato TLS per il dominio \"aliyun.com\", la cui propriet\u00e0 \u00e8 stata confermata. <\/p>\n

L'autorit\u00e0 di certificazione SSL.com ha risolto il problema e ha identificato 11 certificati, per i quali \u00e8 stata utilizzata una vulnerabile schema di verifica tramite un dominio esterno via email. Si presume che nei casi identificati non ci siano segni di attivit\u00e0 dannosa e, su 11, \u00e8 stato revocato solo un certificato, ottenuto dall'analista per il sito aliyun.com. Negli altri certificati erano coinvolti i domini medinet.ca, help.gurusoft.com.sg, banners.betvictor.com, production-boomi.3day.com, kisales.com e medc.kisales.com. L'azienda SSL.com prevede di pubblicare il rapporto sull'incidente entro il 2 maggio.
\n
Fonte: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0412 \u0443\u0434\u043e\u0441\u0442\u043e\u0432\u0435\u0440\u044f\u044e\u0449\u0435\u043c \u0446\u0435\u043d\u0442\u0440\u0435 SSL.com \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432 \u0441\u0438\u0441\u0442\u0435\u043c\u0435 \u043f\u0440\u043e\u0432\u0435\u0440\u043a\u0438 \u0432\u043b\u0430\u0434\u0435\u043d\u0438\u044f \u0434\u043e\u043c\u0435\u043d\u043e\u043c, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0432\u0448\u0430\u044f \u043f\u043e\u043b\u0443\u0447\u0438\u0442\u044c TLS-\u0441\u0435\u0440\u0442\u0438\u0444\u0438\u043a\u0430\u0442 \u0434\u043b\u044f \u043b\u044e\u0431\u043e\u0433\u043e \u0434\u043e\u043c\u0435\u043d\u0430, \u043f\u0440\u0435\u0434\u043e\u0441\u0442\u0430\u0432\u0438\u0432\u0448\u0435\u0433\u043e email \u0430\u0442\u0430\u043a\u0443\u044e\u0449\u0435\u043c\u0443. \u0414\u043b\u044f \u043f\u043e\u043b\u0443\u0447\u0435\u043d\u0438\u044f TLS-\u0441\u0435\u0440\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u0430 \u0431\u044b\u043b\u043e \u0434\u043e\u0441\u0442\u0430\u0442\u043e\u0447\u043d\u043e \u0434\u043e\u0441\u0442\u0443\u043f\u0430 \u043a email \u0441 \u0446\u0435\u043b\u0435\u0432\u044b\u043c \u0434\u043e\u043c\u0435\u043d\u043e\u043c. \u041d\u0430\u043f\u0440\u0438\u043c\u0435\u0440, \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u043b\u0430 \u043f\u043e\u043b\u0443\u0447\u0438\u0442\u044c TLS-\u0441\u0435\u0440\u0442\u0438\u0444\u0438\u043a\u0430\u0442 \u0434\u043b\u044f \u0434\u043e\u043c\u0435\u043d\u043e\u0432, \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u043c\u044b\u0445 \u0432 \u043e\u0431\u0449\u0435\u0434\u043e\u0441\u0442\u0443\u043f\u043d\u044b\u0445 email-\u0441\u0435\u0440\u0432\u0438\u0441\u0430\u0445, \u0442\u0430\u043a\u0438\u0445 \u043a\u0430\u043a gmail.com, yandex.ru, yahoo.com, outlook.com \u0438 icloud.com. \u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0442\u0430\u043a\u0436\u0435 \u0434\u0430\u0432\u0430\u043b\u0430 \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0430\u043c \u0432\u043e\u0437\u043c\u043e\u0436\u043d\u043e\u0441\u0442\u044c […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-123627","post","type-post","status-publish","format-standard","hentry","category-novosti-interneta"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Vulnerabilit\u00e0 nel centro di certificazione SSL.com, che consentiva di ottenere un certificato per un dominio altrui | ProHoster","description":"Nel centro di certificazione SSL.com \u00e8 emersa una vulnerabilit\u00e0 nel sistema di verifica del possesso del dominio, che consentiva di ottenere un certificato TLS per qualsiasi dominio, fornendo all'attaccante un'email. Per ottenere il certificato TLS era sufficiente avere accesso all'email del dominio target. Ad esempio, la vulnerabilit\u00e0 consentiva di ottenere un certificato TLS per i domini utilizzati in servizi email pubblici, come gmail.com, yandex.ru, yahoo.com, outlook.com e icloud.com. La vulnerabilit\u00e0 offriva anche agli aggressori la possibilit\u00e0 di","canonical_url":"https:\/\/prohoster.info\/it\/blog\/novosti-interneta\/uyazvimost-v-udostoveryayushhem-czentre-ssl-com-pozvolyavshaya-poluchit-sertifikat-dlya-chuzhogo-domena","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"it_IT","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432 \u0443\u0434\u043e\u0441\u0442\u043e\u0432\u0435\u0440\u044f\u044e\u0449\u0435\u043c \u0446\u0435\u043d\u0442\u0440\u0435 SSL.com, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0432\u0448\u0430\u044f \u043f\u043e\u043b\u0443\u0447\u0438\u0442\u044c \u0441\u0435\u0440\u0442\u0438\u0444\u0438\u043a\u0430\u0442 \u0434\u043b\u044f \u0447\u0443\u0436\u043e\u0433\u043e \u0434\u043e\u043c\u0435\u043d\u0430 | ProHoster","og:description":"\u0412 \u0443\u0434\u043e\u0441\u0442\u043e\u0432\u0435\u0440\u044f\u044e\u0449\u0435\u043c \u0446\u0435\u043d\u0442\u0440\u0435 SSL.com \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432 \u0441\u0438\u0441\u0442\u0435\u043c\u0435 \u043f\u0440\u043e\u0432\u0435\u0440\u043a\u0438 \u0432\u043b\u0430\u0434\u0435\u043d\u0438\u044f \u0434\u043e\u043c\u0435\u043d\u043e\u043c, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0432\u0448\u0430\u044f \u043f\u043e\u043b\u0443\u0447\u0438\u0442\u044c TLS-\u0441\u0435\u0440\u0442\u0438\u0444\u0438\u043a\u0430\u0442 \u0434\u043b\u044f \u043b\u044e\u0431\u043e\u0433\u043e \u0434\u043e\u043c\u0435\u043d\u0430, \u043f\u0440\u0435\u0434\u043e\u0441\u0442\u0430\u0432\u0438\u0432\u0448\u0435\u0433\u043e email \u0430\u0442\u0430\u043a\u0443\u044e\u0449\u0435\u043c\u0443. \u0414\u043b\u044f \u043f\u043e\u043b\u0443\u0447\u0435\u043d\u0438\u044f TLS-\u0441\u0435\u0440\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u0430 \u0431\u044b\u043b\u043e \u0434\u043e\u0441\u0442\u0430\u0442\u043e\u0447\u043d\u043e \u0434\u043e\u0441\u0442\u0443\u043f\u0430 \u043a email \u0441 \u0446\u0435\u043b\u0435\u0432\u044b\u043c \u0434\u043e\u043c\u0435\u043d\u043e\u043c. \u041d\u0430\u043f\u0440\u0438\u043c\u0435\u0440, \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u043b\u0430 \u043f\u043e\u043b\u0443\u0447\u0438\u0442\u044c TLS-\u0441\u0435\u0440\u0442\u0438\u0444\u0438\u043a\u0430\u0442 \u0434\u043b\u044f \u0434\u043e\u043c\u0435\u043d\u043e\u0432, \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u043c\u044b\u0445 \u0432 \u043e\u0431\u0449\u0435\u0434\u043e\u0441\u0442\u0443\u043f\u043d\u044b\u0445 email-\u0441\u0435\u0440\u0432\u0438\u0441\u0430\u0445, \u0442\u0430\u043a\u0438\u0445 \u043a\u0430\u043a gmail.com, yandex.ru, yahoo.com, outlook.com \u0438 icloud.com. \u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0442\u0430\u043a\u0436\u0435 \u0434\u0430\u0432\u0430\u043b\u0430 \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0430\u043c \u0432\u043e\u0437\u043c\u043e\u0436\u043d\u043e\u0441\u0442\u044c","og:url":"https:\/\/prohoster.info\/it\/blog\/novosti-interneta\/uyazvimost-v-udostoveryayushhem-czentre-ssl-com-pozvolyavshaya-poluchit-sertifikat-dlya-chuzhogo-domena","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2025-04-22T07:05:07+00:00","article:modified_time":"2025-04-22T07:05:07+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"123627","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":"default","schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-02-11 11:16:23","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2026-01-23 12:22:22","updated":"2026-02-11 11:16:23"},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/it\/wp-json\/wp\/v2\/posts\/123627","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/it\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/it\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/it\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/it\/wp-json\/wp\/v2\/comments?post=123627"}],"version-history":[{"count":2,"href":"https:\/\/prohoster.info\/it\/wp-json\/wp\/v2\/posts\/123627\/revisions"}],"predecessor-version":[{"id":160581,"href":"https:\/\/prohoster.info\/it\/wp-json\/wp\/v2\/posts\/123627\/revisions\/160581"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/it\/wp-json\/wp\/v2\/media?parent=123627"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/it\/wp-json\/wp\/v2\/categories?post=123627"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/it\/wp-json\/wp\/v2\/tags?post=123627"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}