1 Reply Latest reply on Jun 26, 2014 1:51 PM by cogoc_1937206

    dns-spoofing embedded certificates




      I'm looking into how best to setup a secure webserver with WICED and I found the sample certificates that are provided with the SDK (Resources/certificates/).  Given that this appears to be a valid certificate for a broadcom subdomain purchased from Entrust.net, is there not a concern that someone could use this certificate to host a real website at 'securedemo.wiced.broadcom.com'?


      I don't have any nefarious plans myself, but this would be the concern I'd have (perhaps unnecessarily?) with purchasing our own certificate from a CA for 'mydevice.mydomain.com' and programming it into every device we manufacturer.  If an attacker managed to extract the certificate data from our hardware, would he then not be able to host a site on the broader internet at 'mydevice.mydomain.com' and trick various DNS servers to direct people there who would then think it's a trustable 'mydomain.com' website?


      Perhaps DNS spoofing is a thing of the past(?)  I'd certainly like to take the above approach because it prevents users from being prompted with an 'untrusted certificate' warning when accessing the secure WICED webserver, but I can't risk any security vulnerabilities.



        • 1. Re: dns-spoofing embedded certificates

          I do still think this is an issue (though not one with a high likelihood of someone attacking), so for our application I won't be embedding a purchased certificate for 'mydevice.mydomain.com'.  My recommendation would be that you guys remove the 'securedemo.wiced.broadcom.com' from the WICED SDK and have the certificate revoked.  The main reason being to avoid implying to other developers that it's safe to do this with their embedded devices.  I am not a security expert, however, so probably best to talk to the gurus within Broadcom first.  If you do, I'd be very curious to see their opinions added to this discussion.