Cats? In My Certificate Transparency Logs?
summary
Certificate Transparency logs are a public, append-only store that must include any issued certificate and Chrome enforces this via SCTs. The authors scrape CT with modified axemen into Hive (about 455 million certs analyzed), show you can encode roughly 13 KB per cert and then chain chunks across many entries to store arbitrarily large files — they push a 4.5 MB WebM spread over ~350 certificates using an open tool CatLog, and demonstrate it reliably reconstructs images and video.
AI-written summary · about
chapters (13)
- 0:00Introduction to talk
- 0:21What is certificate transparency
- 6:18How CT logs work
- 11:12CT logs for reconnaissance
- 13:20Weak crypto in CT logs
- 14:01Persistent data storage in CT logs
- 17:14Storing arbitrary data in CT logs
- 18:59Demo of catlog tool
- 21:09Other people abusing CT logs
- 26:44Analysis of large certificates
- 29:12Demo of video in CT logs
- 29:33Final thoughts on CT logs
- 30:40Q&A on legal implications
related talks
51mCertificate Transparency Logs: Roadmaps to Riches or Ruin?
08mMove over certificate pinning. Certificate transparency is here!
13mLightning Talk: Move Over Certificate Pinning. Certificate Transparency is Here!
35mTrust Unearned? Evaluating CA Trustworthiness Across 5 Billion Certificates
30mHashiTLS: Demystifying Security Certs
59mCrash, Burn, Report
49mHerding Certs - How to Automate Certificate Management
24mEncrypted Telemetry in Transit