Security Analysis on Practices of Certificate Authorities in the HTTPS Phishing Ecosystem
Doowon Kima, Haehyun Chob, Yonghwi Kwonc, Adam Doupéd, Sooel Sone, Gail‐Joon Ahnf g, Tudor Dumitraşh
- aUniversity of Tennessee, Knoxville, Knoxville, TN, USA
- bSoongsil University, Seoul, South Korea
- cUniversity of Virginia, Charlottesville, VA, USA
- dArizona State University, Phoenix, AZ, USA
- eKAIST, Daejeon, South Korea
- fArizona State University &
- gSamsung Research, Phoenix, AZ, USA
- hUniversity of Maryland, College Park, College Park, MD, USA
Papers open inside SciRah from the original publisher or repository; SciRah never hosts them.
Abstract
Phishing attacks are causing substantial damage albeit extensive effort in academia and industry. Recently, a large volume of phishing attacks transit toward adopting HTTPS, leveraging TLS certificates issued from Certificate Authorities (CAs), to make the attacks more effective. In this paper, we present a comprehensive study on the security practices of CAs in the HTTPS phishing ecosystem. We focus on the CAs, critical actors under-studied in previous literature, to better understand the importance of the security practices of CAs and thwart the proliferating HTTPS phishing. In particular, we first present the current landscape and effectiveness of HTTPS phishing attacks comparing to traditional HTTP ones. Then, we conduct an empirical experiment on the CAs' security practices in terms of the issuance and revocation of the certificates. Our findings highlight serious conflicts between the expected security practices of CAs and reality, raising significant security concerns. We further validate our findings using a longitudinal dataset of abusive certificates used for real phishing attacks in the wild. We confirm that the security concerns of CAs prevail in the wild and these concerns can be one of the main contributors to the recent surge of HTTPS phishing attacks.
TL;DRIt is confirmed that the security concerns of CAs prevail in the wild and these concerns can be one of the main contributors to the recent surge of HTTPS phishing attacks. (Semantic Scholar)