HOWTO: Create a rogue CA certificate for $2000
An international group of researchers—speaking at the 25th Chaos Communication Club conference—published details on how they had managed to construct a rogue Certificate Authority (CA) certificate (!) using a weakness in the MD5 hashing algorithm. They estimate the attack costs $20,000 to execute today, but that the cost can be reduced to as little as $2000. With a rogue CA certificate in hand they are able to impersonate any SSL-enabled web site and conduct MITM attacks undetected (no browser warnings!).
The presentation is now available for download.
Update (30 Dec): And so is the paper, along with more information and a demonstration site (the CA certificate was purposefully constructed to expire in 2004, which essentially makes it harmless).
Update (31 Dec): Verisign fixes the problem.
