{"id":123627,"date":"2025-04-22T09:05:07","date_gmt":"2025-04-22T07:05:07","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/uyazvimost-v-udostoveryayushhem-czentre-ssl-com-pozvolyavshaya-poluchit-sertifikat-dlya-chuzhogo-domena"},"modified":"2025-04-22T09:05:07","modified_gmt":"2025-04-22T07:05:07","slug":"uyazvimost-v-udostoveryayushhem-czentre-ssl-com-pozvolyavshaya-poluchit-sertifikat-dlya-chuzhogo-domena","status":"publish","type":"post","link":"https:\/\/prohoster.info\/ro\/blog\/news\/uyazvimost-v-udostoveryayushhem-czentre-ssl-com-pozvolyavshaya-poluchit-sertifikat-dlya-chuzhogo-domena","title":{"rendered":"O vulnerabilitate \u00een centrul de certificare SSL.com, care permitea ob\u021binerea unui certificat pentru un domeniu str\u0103in","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

\u00cen centrul de certificare SSL.com a fost descoperit\u0103 o vulnerabilitate \u00een sistemul de verificare a propriet\u0103\u021bii domeniului, care permitea ob\u021binerea unui certificat TLS pentru orice domeniu, oferind atacatorului un email. Pentru a ob\u021bine certificatul TLS, era suficient accesul la un email asociat cu domeniul \u021bint\u0103. De exemplu, vulnerabilitatea permitea ob\u021binerea unui certificat TLS pentru domeniile utilizate \u00een servicii de email publice, precum gmail.com, yandex.ru, yahoo.com, outlook.com \u0219i icloud.com. <\/p>\n

Vulnerabilitatea le oferea, de asemenea, autorilor atacurilor posibilitatea de a lansa atacuri \u021bintite asupra angaja\u021bilor unor companii cunoscute \u0219i participan\u021bilor la proiecte mari pentru a ob\u021bine accesul la emailurile lor \u0219i a ob\u021bine certificate TLS pentru branduri cunoscute. domenii<\/a>. De exemplu, hackuirea unui angajat Google, care de\u021bine emailul name@google.com, permitea ob\u021binerea certificatului pentru un domeniu<\/a> google.com. <\/p>\n

Vulnerabilitatea a fost cauzat\u0103 de o eroare \u00een implementarea sistemului de verificare a propriet\u0103\u021bii domeniului prin confirmare prin e-mail. Pentru a ob\u021bine confirmarea prin email, este necesar s\u0103 ad\u0103uga\u021bi \u00een zona DNS a domeniului pentru care se solicit\u0103 certificatul, un \u00eenregistrare DNS TXT \u201e_validation-contactemail\u201d. De exemplu, \u201e_validation-contactemail.test.com DNS TXT name@example.com\u201d. Dup\u0103 ini\u021bierea verific\u0103rii domeniului, un cod de confirmare va fi trimis pe emailul name@examle.com, introducerea acestuia confirm\u00e2nd proprietatea domeniului \u201etest.com\u201d \u0219i permi\u021b\u00e2nd ob\u021binerea certificatului TLS pentru \u201etest.com\u201d. <\/p>\n

Esenta vulnerabilit\u0103\u021bii const\u0103 \u00een aceea c\u0103, pe l\u00e2ng\u0103 domeniul \u201etest.com\u201d pentru care a fost solicitat certificatul, indicatorul de confirmare a propriet\u0103\u021bii era afi\u0219at \u0219i pentru domeniul \u201eexample.com\u201d utilizat \u00een email. \u00cen cadrul problemei identificate, cercet\u0103torul a demonstrat ob\u021binerea unui certificat TLS valid pentru domeniul aliyun.com, utilizat \u00een serviciul de webmail al companiei chineze Alibaba. \u00cen timpul unui atac de testare, cercet\u0103torul a \u00eenregistrat un domeniu de verificare \u201ed2b4eee07de5efcb8598f0586cbf2690.test.dcv-inspector.com\u201d \u00een serviciul \u201edcv-inspector.com\u201d \u0219i a solicitat pentru acesta un certificat TLS, ad\u0103ug\u00e2nd \u00eenregistrarea DNS: _validation-contactemail.d2b4eee07de5efcb8598f0586cbf2690.test.dcv-inspector.com DNS TXT myusername@aliyun.com <\/p>\n

Dup\u0103 aceasta, a solicitat pe site-ul SSL.com un certificat TLS pentru domeniul d2b4eee07de5efcb8598f0586cbf2690.test.dcv-inspector.com \u0219i a ales confirmarea prin email. Autoritatea de certificare SSL.com a trimis un cod de verificare pe myusername@aliyun.com \u0219i, dup\u0103 introducerea acestui cod, a ad\u0103ugat \u00een lista domeniilor verificate nu doar \u201ed2b4eee07de5efcb8598f0586cbf2690.test.dcv-inspector.com\u201d, ci \u0219i \u201ealiyun.com\u201d. Dup\u0103 aceasta, cercet\u0103torul a ob\u021binut cu succes un certificat TLS pentru domeniul \u201ealiyun.com\u201d, proprietatea c\u0103ruia a fost confirmat\u0103. <\/p>\n

Autoritatea de certificare SSL.com a remediat problema \u0219i a identificat 11 certificate pentru care a fost folosit un sistem de verificare vulnerabil cu un domeniu ter\u021b \u00een email. Se presupune c\u0103, \u00een cazurile identificate, nu exist\u0103 semne de activitate d\u0103un\u0103toare, iar din cele 11, p\u00e2n\u0103 acum a fost revocat doar un certificat ob\u021binut de cercet\u0103tor pentru site-ul aliyun.com. \u00cen celelalte certificate au fost incluse domeniile medinet.ca, help.gurusoft.com.sg, banners.betvictor.com, production-boomi.3day.com, kisales.com \u0219i medc.kisales.com. Compania SSL.com inten\u021bioneaz\u0103 s\u0103 publice raportul despre incident p\u00e2n\u0103 pe 2 mai.
\n
Sursa: opennet.ro<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0412 \u0443\u0434\u043e\u0441\u0442\u043e\u0432\u0435\u0440\u044f\u044e\u0449\u0435\u043c \u0446\u0435\u043d\u0442\u0440\u0435 SSL.com \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432 \u0441\u0438\u0441\u0442\u0435\u043c\u0435 \u043f\u0440\u043e\u0432\u0435\u0440\u043a\u0438 \u0432\u043b\u0430\u0434\u0435\u043d\u0438\u044f \u0434\u043e\u043c\u0435\u043d\u043e\u043c, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0432\u0448\u0430\u044f \u043f\u043e\u043b\u0443\u0447\u0438\u0442\u044c TLS-\u0441\u0435\u0440\u0442\u0438\u0444\u0438\u043a\u0430\u0442 \u0434\u043b\u044f \u043b\u044e\u0431\u043e\u0433\u043e \u0434\u043e\u043c\u0435\u043d\u0430, \u043f\u0440\u0435\u0434\u043e\u0441\u0442\u0430\u0432\u0438\u0432\u0448\u0435\u0433\u043e email \u0430\u0442\u0430\u043a\u0443\u044e\u0449\u0435\u043c\u0443. \u0414\u043b\u044f \u043f\u043e\u043b\u0443\u0447\u0435\u043d\u0438\u044f TLS-\u0441\u0435\u0440\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u0430 \u0431\u044b\u043b\u043e \u0434\u043e\u0441\u0442\u0430\u0442\u043e\u0447\u043d\u043e \u0434\u043e\u0441\u0442\u0443\u043f\u0430 \u043a email \u0441 \u0446\u0435\u043b\u0435\u0432\u044b\u043c \u0434\u043e\u043c\u0435\u043d\u043e\u043c. \u041d\u0430\u043f\u0440\u0438\u043c\u0435\u0440, \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u043b\u0430 \u043f\u043e\u043b\u0443\u0447\u0438\u0442\u044c TLS-\u0441\u0435\u0440\u0442\u0438\u0444\u0438\u043a\u0430\u0442 \u0434\u043b\u044f \u0434\u043e\u043c\u0435\u043d\u043e\u0432, \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u043c\u044b\u0445 \u0432 \u043e\u0431\u0449\u0435\u0434\u043e\u0441\u0442\u0443\u043f\u043d\u044b\u0445 email-\u0441\u0435\u0440\u0432\u0438\u0441\u0430\u0445, \u0442\u0430\u043a\u0438\u0445 \u043a\u0430\u043a gmail.com, yandex.ru, yahoo.com, outlook.com \u0438 icloud.com. \u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0442\u0430\u043a\u0436\u0435 \u0434\u0430\u0432\u0430\u043b\u0430 \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0430\u043c \u0432\u043e\u0437\u043c\u043e\u0436\u043d\u043e\u0441\u0442\u044c […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-123627","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Vulnerabilitate \u00een cadrul autorit\u0103\u021bii de certificare SSL.com, care permitea ob\u021binerea unui certificat pentru un domeniu str\u0103in | ProHoster","description":"O vulnerabilitate a fost identificat\u0103 \u00een cadrul autorit\u0103\u021bii de certificare SSL.com \u00een sistemul de verificare a propriet\u0103\u021bii domeniului, permi\u021b\u00e2nd ob\u021binerea unui certificat TLS pentru orice domeniu care a furnizat un email atacatorului.","canonical_url":"https:\/\/prohoster.info\/ro\/blog\/news\/uyazvimost-v-udostoveryayushhem-czentre-ssl-com-pozvolyavshaya-poluchit-sertifikat-dlya-chuzhogo-domena","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"ro_RO","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432 \u0443\u0434\u043e\u0441\u0442\u043e\u0432\u0435\u0440\u044f\u044e\u0449\u0435\u043c \u0446\u0435\u043d\u0442\u0440\u0435 SSL.com, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0432\u0448\u0430\u044f \u043f\u043e\u043b\u0443\u0447\u0438\u0442\u044c \u0441\u0435\u0440\u0442\u0438\u0444\u0438\u043a\u0430\u0442 \u0434\u043b\u044f \u0447\u0443\u0436\u043e\u0433\u043e \u0434\u043e\u043c\u0435\u043d\u0430 | ProHoster","og:description":"\u0412 \u0443\u0434\u043e\u0441\u0442\u043e\u0432\u0435\u0440\u044f\u044e\u0449\u0435\u043c \u0446\u0435\u043d\u0442\u0440\u0435 SSL.com \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432 \u0441\u0438\u0441\u0442\u0435\u043c\u0435 \u043f\u0440\u043e\u0432\u0435\u0440\u043a\u0438 \u0432\u043b\u0430\u0434\u0435\u043d\u0438\u044f \u0434\u043e\u043c\u0435\u043d\u043e\u043c, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0432\u0448\u0430\u044f \u043f\u043e\u043b\u0443\u0447\u0438\u0442\u044c TLS-\u0441\u0435\u0440\u0442\u0438\u0444\u0438\u043a\u0430\u0442 \u0434\u043b\u044f \u043b\u044e\u0431\u043e\u0433\u043e \u0434\u043e\u043c\u0435\u043d\u0430, \u043f\u0440\u0435\u0434\u043e\u0441\u0442\u0430\u0432\u0438\u0432\u0448\u0435\u0433\u043e email \u0430\u0442\u0430\u043a\u0443\u044e\u0449\u0435\u043c\u0443.","og:url":"https:\/\/prohoster.info\/ro\/blog\/news\/uyazvimost-v-udostoveryayushhem-czentre-ssl-com-pozvolyavshaya-poluchit-sertifikat-dlya-chuzhogo-domena","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2025-04-22T07:05:07+00:00","article:modified_time":"2025-04-22T07:05:07+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"123627","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":"default","schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-02-11 11:16:23","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2026-01-23 12:22:22","updated":"2026-02-11 11:16:23","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts\/123627","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/comments?post=123627"}],"version-history":[{"count":2,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts\/123627\/revisions"}],"predecessor-version":[{"id":160581,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts\/123627\/revisions\/160581"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/media?parent=123627"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/categories?post=123627"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/tags?post=123627"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}