Measurement and Analysis of Private Key Sharing in the HTTPS - PowerPoint PPT Presentation

How prevalent is key sharing? 1 0.8 0.6 CDF 0.4 0.2 Organizations 0 10 2 10 3 10 4 10 5 0 1 10 Number of Third-Party Hosting Providers Used

How prevalent is key sharing? 1 0.8 0.6 CDF 0.4 0.2 23.5% Self-hosted Organizations 0 10 2 10 3 10 4 10 5 0 1 10 Number of Third-Party Hosting Providers Used

How prevalent is key sharing? 1 76.5% 0.8 share 0.6 at least CDF 1 key 0.4 0.2 23.5% Self-hosted Organizations 0 10 2 10 3 10 4 10 5 0 1 10 Number of Third-Party Hosting Providers Used

How prevalent is key sharing? 1 Who? 76.5% 0.8 share 0.6 at least CDF 1 key 0.4 0.2 23.5% Self-hosted Organizations 0 10 2 10 3 10 4 10 5 0 1 10 Number of Third-Party Hosting Providers Used

Who shares? Fraction of Domains Hosted 1 on Third-party Providers At least one key shared All keys shared 0.8 0.6 0.4 0.2 0 0 200k 400k 600k 800k 1M Alexa Site Rank (bins of 10,000)

Who shares? Fraction of Domains Hosted 1 on Third-party Providers At least one key shared 43.2% (of Top 10k) All keys shared 0.8 share at least one 0.6 0.4 0.2 0 0 200k 400k 600k 800k 1M Alexa Site Rank (bins of 10,000)

Who shares? Fraction of Domains Hosted 1 on Third-party Providers At least one key shared 43.2% (of Top 10k) All keys shared 0.8 share at least one 0.6 0.4 22.4% share all 0.2 0 0 200k 400k 600k 800k 1M Alexa Site Rank (bins of 10,000)

Who shares? Fraction of Domains Hosted 1 on Third-party Providers At least one key shared 43.2% (of Top 10k) All keys shared 0.8 share at least one 0.6 0.4 22.4% share all 0.2 0 0 200k 400k 600k 800k 1M Alexa Site Rank (bins of 10,000) Key sharing is common across the Internet

Outline How prevalent is key sharing? How many keys have providers aggregated? How does sharing impact key management?

Outline • 76.5% share with ≥ 1 provider How prevalent is • Common even among most key sharing? popular websites How many keys have providers aggregated? How does sharing impact key management?

How many keys have providers aggregated? Domain Host Org Org Domain Domain Domain Org Host Host Org Domain Domain Org Domain Host Domain Domain Host Org Org

How have keys been aggregated? 10 6 10 5 Number of Distinct Customers Served 10 4 10 3 10 2 10 1 10 0 10 0 10 1 10 2 10 3 10 4 10 5 10 6 Rank-Order Third-Party Hosting Providers

How have keys been aggregated? Hosting provider #Organizations #Domains 266,110 277,891 secureserver.net 10 6 151,628 175,089 amazonaws.com 117.229 122,158 unifiedlayer.com 10 5 Number of Distinct 78,369 87,077 Customers Served Cloud Flare Inc. 54,158 63,418 Rackspace Hosting 10 4 … … … 15,440 22,671 akamaitechnologies.com 10 3 10 2 10 1 10 0 10 0 10 1 10 2 10 3 10 4 10 5 10 6 Rank-Order Third-Party Hosting Providers

How have keys been aggregated? Hosting provider #Organizations #Domains 266,110 277,891 secureserver.net 10 6 151,628 175,089 amazonaws.com 117.229 122,158 unifiedlayer.com 10 5 Number of Distinct 78,369 87,077 Customers Served Cloud Flare Inc. 54,158 63,418 Rackspace Hosting 10 4 … … … 15,440 22,671 akamaitechnologies.com 10 3 10 2 10 1 10 0 10 0 10 1 10 2 10 3 10 4 10 5 10 6 Rank-Order Third-Party Hosting Providers Top 1% of providers hold keys for 86% of all organizations

Does key sharing make enticing attack targets? Domain Host Org Org Domain Domain Domain Org Host Host Org Domain Domain Org Domain Host Domain Domain Host Org Org

Does key sharing make enticing attack targets? 1 Domains’ Keys Acquired Cumulative Fraction of 0.8 0.6 0.4 Alexa Top 1k 0.2 Alexa Top 1m All Domains 0 10 0 10 1 10 2 10 3 10 4 10 5 10 6 Number of Hosting Providers Compromised

Does key sharing make enticing attack targets? 1 Domains’ Keys Acquired Cumulative Fraction of 0.8 60% of Top 1K, same provider 0.6 0.4 Alexa Top 1k 0.2 Alexa Top 1m All Domains 0 10 0 10 1 10 2 10 3 10 4 10 5 10 6 Number of Hosting Providers Compromised

Does key sharing make enticing attack targets? 1 Domains’ Keys Acquired Cumulative Fraction of 0.8 60% of Top 1K, same provider 0.6 >40% of all sites, 10 providers 0.4 Alexa Top 1k 0.2 Alexa Top 1m All Domains 0 10 0 10 1 10 2 10 3 10 4 10 5 10 6 Number of Hosting Providers Compromised

Does key sharing make enticing attack targets? 1 Domains’ Keys Acquired Cumulative Fraction of 0.8 60% of Top 1K, same provider 0.6 >40% of all sites, 10 providers 0.4 Alexa Top 1k 0.2 Alexa Top 1m All Domains 0 10 0 10 1 10 2 10 3 10 4 10 5 10 6 Number of Hosting Providers Compromised Popular hosting services are prime targets for attack

Outline • 76.5% share with ≥ 1 provider How prevalent is • Common even among most key sharing? popular websites • Top 1% of providers hold   How many keys have keys for 86% of orgs providers aggregated? • Attractive targets for attack How does sharing impact key management?

Key Management Request certificates Renew expiring certificates Revoke and reissue compromised certificates

Who manages private keys? Website acquires Third-party acquires CAs

Measurement and Analysis of Private Key Sharing in the HTTPS - PowerPoint PPT Presentation

Measurement and Analysis of Private Key Sharing in the HTTPS Ecosystem Frank Cangialosi, Taejoong Chung, David Choffnes, Dave Levin, Bruce M. Maggs, Alan Mislove, Christo Wilson How do we know with whom we are communicating? How do we know

Simulation, Measurement and Analysis of Photoemission Simulation, Measurement and Analysis of

An Architectural Approach to Inter-domain Measurement Data Sharing Brian Trammell Communication

Private Sharing of IOCs and Sightings (short paper) Tim van de Kamp Andreas Peter Maarten

Strategic/Policy Implications of Measurement Data Sharing Under the OIO nee, The Road to an

OptiGauge Precision Thickness Measurement July 2008 N ON - CONTACT MEASUREMENT AND ANALYSIS OF SIX

8. Hydrometry - measurement and analysis 8.1 De fi nitions In English, the traditional word used

Operating System Principles: Performance Measurement and Analysis CS 111 Operating Systems

IETF Hackathon: Measurement and Analysis for Protocols (MAP) - Live IETF 104 23-24 March, 2019

Fraud and Error Measurement Analysis Adapting to a changing benefit landscape

Public and private BitTorrent communities: A measurement study M. Meulpolder, L. DAcunto, M.

Measurement Techniques Part 2: Measurement Techniques Terminology and general issues

Turtle: Safe and Private Data Sharing Bogdan C. Popescu Petr Matejka Bruno Crispo Andrew S.

International developments in public/private financial information- sharing partnerships

Measurement There are two main systems of measurement: - The English system

Towards Provable Network Traffic Measurement and Analysis via Semi-Labeled Trace Datasets

Public and private BitT orrent communities: A measurement study M. Meulpolder, L. DAcunto, M.

Internet Structural Analysis by End-to-End Measurement NTT Communications KAMEI Satoshi

Introduction to bivariate analysis When one measurement is made on each observation, univariate

On Flow Concurrency in the Internet and its Implications for Capacity Sharing Brian Trammell and

Traffic Measurement Activities of the WIDE project Kenjiro Cho IIJ Research Lab traffic

Temporal Analysis of Inter-Community User Flows in Online Knowledge-Sharing Networks Anna

A Cost-Benefit Analysis of Private Versus Semi-Private Inpatient Rooms in a New Hospital

Measurement 4 - 1 Introduction Measurement is finding a number

Rendezvous-based Traffic Rendezvous-based Traffic Classification, Measurement, Classification,