Hackers Purchasing Abused SSL/TLS certificates From Dark Web Markets to Victimize their Targets

SSL/TLS certificates are the backbones of secure communication, it encrypts the sensitive information that sent across the internet, so that, only the intended recipients can get access to it.

The SSL/TLS certificates provides trust with lock icon and also provides authentication, which makes you to ensure the information has been sent to the correct server.

But the certificates are poorly protected, which allows attackers to abuse them and use it for launching a high-profile attacks.

Evidence-based Cybersecurity Research Group published a detailed report on the volumes of SSL/TLS certificates that available for sale on the dark web, including the details on how they are packaged and sold to attackers. The report highlights the emergence of identity-as-a-service on the dark web marketplace.

Threat actors sold the certificates individually as well as packed with other tools that deliver machine-identities-as-a-service to attackers who like to launch a man-in-the-middle attacks, spoof websites, eavesdrop and to steal sensitive data.

Researchers conducted 16 weekly searches across all 60 websites on the Tor network, 17 webpages on I2P. Listings of SSL/TLS certificates found in markets such as Dream Market, Wall Street Market, BlockBooth, Nightmare Market and Galaxy3.

The listings shows that the availability of the SSL/TLS certificates is remarkably higher than the number of ransomwares and exploit’s listed.

An ad listing in Wall St. Market shows that the threat actors provide the certificates as well as the services to create the Fraudulent Websites.

Another listing in the Dream market went step ahead, mentioning the issuance of SSL certificates and the use of aged domains as key services provided by this vendor. The certificate is sold here for less than €200 including web design services.

“SSL/TLS certificates were also mentioned in various tutorials produced by anonymous authors. In addition, we found evidence of the availability of SSL stripping tools in the Dream Market,” reads the report.

EV certificate is designed to be the most trusted one in the market, a vendor named ‘bulkaccounts’ advertise it’s ability to issue EV certificates for U.S. & U.K. companies without any documentation and the cost starts at $1,000. “the vendor promises to provide full documentation for forged companies, including D-U-N-S numbers.”

Dark web markets are the ideal place for the criminals to sell various malicious software, login details, financial data at very low cost.

Lest year it was observed that threat actors are offering both code signing certificates and domain name registration accompanying with the SSL certificates.

You can follow us on Linkedin, Twitter, Facebook for daily Cybersecurity updates also you can take the Best Cybersecurity courses online to keep your self-updated.