alt Hacker NewsThe Web PKI uses certificate transparency, so we’ll have a definitive answer about whether this is/was exploited soon.
(But in any case, CT ensures that it can’t be “quiet.”)
Replies
CT is great for browsers. Largely irrelevant for anything being fetched outside of a browser.
There are plenty of ways you would never be able to tell if a fake cert had been generated and used via this attack vector (let's ignore validation attacks):
1. CT does not do anything if a state actor demands a CA in its borders generate a cert without publishing to the CT logs (or a three-letter-agency doing this illicitly). They can put SCTs in the cert, and still not publish to the logs, nobody is auditing the logs for every cert every browser sees.
2. Browsers won't check for SCTs in certs if they come from a private CA. you can MITM any domain through ZScaler all day long and nobody will notice
3. Wildcard certs make it easy to make/renew a cert that looks normal but hides requests on new/different hosts
4. Non-Browsers do not validate SCTs
There were no certificates from the compromised intermediates logged to CT prior to remediation by the browsers.