Risk: Informational
An international group of security researchers are urging browser makers to drop support for digital signatures based on MD5 hashing, after they claimed to have successfully attacked the trust infrastructure of the Internet by creating a fake, but valid, certificate.
The research builds a practical attack against the Internet public key infrastructure (PKI) based on already known weaknesses in the design of MD5 hash functions.
Using the techniques, the researchers claimed to have created a rogue certificate authority that could distribute fake Secure Socket Layer (SSL) certificates that all popular browsers would treat as legitimate.
If online criminals duplicated the work, they may be able to use their own rogue certificate authority to create virtually undetectable phishing schemes that may collect sensitive information normally protected by SSL encryption.