Installing Fake Root Keys in a PC

If a malicious party can insert a self-issued CA public key into the list of root public keys stored in a PC, then this party could potentially do considerable harm to that PC. In this paper, we present a way to achieve such an attack for the Internet Explorer web browser root key store, which avoids attracting the user’s attention. A realisation of this attack is also described. Finally, countermeasures that can be deployed to prevent such an attack are outlined.

• Type: Conference
• Year: 2005
• Where: EUROPKI
• Authors: Adil Alsaid, Chris J. Mitchell
• Keywords: CA Public Key, EUROPKI 2005, Public Keys, Root Public Keys, Security Privacy