TLS Certificates on the Darknet: A Case Study of an Emerging Commodity within the Cybercrime Economy

• In Event: Exploring the Cybercrime Economy: New Themes and Methods in the Study of Cybercrime

Abstract

SSL Certificates are designed to facilitate confidential communication between servers and clients. When installed on a web server, the SSL or TLS Certificate activates the padlock and the https protocol allows secure connections from a web server to a browser. To support the sensitive operation of identity verification, SSL Certificates and encryption keys are issued by trusted Certificate Authorities. Certification Authorities are charged with the task of employing stringent validation processes to ensure issuance of SSL Certificates to legitimate companies, organizations and individuals only. The keys and certificates that are issued by the certifying authorities authenticate that each machine is what it says it is, giving it an ‘identity’. However, if this identity is stolen, forged, or tampered with, it can be a powerful tool for attackers. This paper will present evidence from a unique data collection efforts we engaged in effort to explore the existence of a market for compromised, stolen and forged TLS certificates in the darknet.

Authors

• David Maimon, Evidence Based Cybersecurity Research Group, Georgia State University

• Yubao Wu, Georgia State University