Erik van Straten<p>🌘DYDX.EXCHANGE DV-CERT MIS-ISSUANCES🌒<br>🧵#2/3</p><p>Below you can find a listing of 34 LE (Let's Encrypt) leaf certs (certificates) that were all issued on 2024-07-23 for [*.]dydx.exchange (i.e. literally dydx.exchange and *.dydx.exchange , where '*' represents exactly one subdomain level).</p><p>Most -if not all- of those certs were mis-issued to cybercriminals who used impersonating websites after modifying DNS records without authorization. Of those certs, only 27 were revoked (as of 2024-08-05).</p><p>More about the associated DNS attack can be read in <a href="https://www.bleepingcomputer.com/news/security/defi-exchange-dydx-v3-website-hacked-in-dns-hijack-attack/" rel="nofollow noopener" translate="no" target="_blank"><span class="invisible">https://www.</span><span class="ellipsis">bleepingcomputer.com/news/secu</span><span class="invisible">rity/defi-exchange-dydx-v3-website-hacked-in-dns-hijack-attack/</span></a>.</p><p>🌘REMARKABLE / NOTES🌒<br>⚠️ Out of caution, all certs issued to [*.]dydx.exchange on 2024-07-23 should have been revoked.</p><p>I see no reason to assume that the 7 of the 34 certificates issued during the same small timeframe (14:26:21 GMT through 19:31:11 GMT, with the last non-revoked cert issued at 15:47:29 GMT, i.e. within 2 hours of the first cert) were not mis-issued.</p><p>Note: criminals can still abuse them by attacking individuals by forging DNS responses to them.</p><p>⚠️ In one case, no reason whatsoever was specified for the revocation. In all other cases "cessationOfOperation" was specified.</p><p>IMO both are wrong and misleading. The reason should have been the one used for mis-issuance:</p><p><<< privilegeWithdrawn (RFC 5280 CRLReason #9) >>></p><p>See, for example, <a href="https://www.mozilla.org/en-US/about/governance/policies/security-group/certs/policy/#611-end-entity-tls-certificate-crlrevocation-reasons" rel="nofollow noopener" translate="no" target="_blank"><span class="invisible">https://www.</span><span class="ellipsis">mozilla.org/en-US/about/govern</span><span class="invisible">ance/policies/security-group/certs/policy/#611-end-entity-tls-certificate-crlrevocation-reasons</span></a> and <a href="https://blog.mozilla.org/security/2022/05/16/revocation-reason-codes-for-tls-server-certificates/" rel="nofollow noopener" translate="no" target="_blank"><span class="invisible">https://</span><span class="ellipsis">blog.mozilla.org/security/2022</span><span class="invisible">/05/16/revocation-reason-codes-for-tls-server-certificates/</span></a>.</p><p>⚠️ In addition to the previous point: maybe I overlooked it, but I found no mention of this security incident on <a href="https://letsencrypt.org" rel="nofollow noopener" translate="no" target="_blank"><span class="invisible">https://</span><span class="">letsencrypt.org</span><span class="invisible"></span></a>. Does LE *not* want you to know about this? What happened to "certificate transparency"?</p><p>⚠️ For part of their subdomain names (such as links.dydx.exchange) dydx.exchange seems to have reused an asymmetric keypair *that* many times that tapping on "Subject Public Key Info" in i.e. <a href="https://crt.sh/?spkisha256=a49e1f32dc76b0fb9522eb4557b80ce522eab725ac8bfe67b510856e7de0ab8e" rel="nofollow noopener" translate="no" target="_blank"><span class="invisible">https://</span><span class="ellipsis">crt.sh/?spkisha256=a49e1f32dc7</span><span class="invisible">6b0fb9522eb4557b80ce522eab725ac8bfe67b510856e7de0ab8e</span></a> causes crt.sh to time out (or to crash).</p><p>⚠️ I don't know why there's always a one hour difference between the "invalid before" timestamp and the timestamp of the countersignature. Perhaps there's a mandatory 1 hour delay (please let us know if you know what the reason is).</p><p>🌘IMPROVING READABILITY🌒<br>I've removed all dates that were July 23, 2024 from the list below.</p><p>In addition, *each* certificate was actually issued for both:<br>🔸<subDN>.dydx.exchange<br>🔸Not mentioned in the following list: www.<subDN>.dydx.exchange<br>(this also applies to dydx.exchange and www.dydx.exchange).</p><p>Records in the list below are sorted in chronological order of issuance of the precertificate.</p><p>🌘LEGENDA🌒<br>r#nn: revoked, <a href="https://infosec.exchange/tags/nr" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>nr</span></a> (2 digits)<br>v#nn: valid (not revoked), <a href="https://infosec.exchange/tags/nr" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>nr</span></a><br>f: valid From time (not valid before)<br>c: counter-signature timestamp<br>r: revocation timestamp + "(reason)"<br>s: source</p><p>---- BEGIN OF LIST ----</p><p>r#01: api.dydx.exchange<br>f: 14:26:21 GMT<br>c: 15:26:21.595 GMT<br>r: 20:59:14 UTC (cessationOfOperation)<br>s: <a href="https://crt.sh/?id=13897807683&opt=ocsp" rel="nofollow noopener" translate="no" target="_blank"><span class="invisible">https://</span><span class="ellipsis">crt.sh/?id=13897807683&opt=ocs</span><span class="invisible">p</span></a></p><p>r#02: dydx.exchange<br>f: 14:26:23 GMT<br>c: 15:26:23.451 GMT<br>r: 21:00:08 UTC (cessationOfOperation)<br>s: <a href="https://crt.sh/?id=13897808125&opt=ocsp" rel="nofollow noopener" translate="no" target="_blank"><span class="invisible">https://</span><span class="ellipsis">crt.sh/?id=13897808125&opt=ocs</span><span class="invisible">p</span></a></p><p>r#03: ios-beta.dydx.exchange<br>f: 14:26:47 GMT<br>c: 15:26:47.554 GMT<br>r: 20:59:36 UTC (cessationOfOperation)<br>s: <a href="https://crt.sh/?id=13897811047&opt=ocsp" rel="nofollow noopener" translate="no" target="_blank"><span class="invisible">https://</span><span class="ellipsis">crt.sh/?id=13897811047&opt=ocs</span><span class="invisible">p</span></a></p><p>r#04: docs.dydx.exchange<br>f: 14:27:56 GMT<br>c: 15:27:56.096 GMT<br>r: 21:00:16 UTC (cessationOfOperation)<br>s: <a href="https://crt.sh/?id=13897811225&opt=ocsp" rel="nofollow noopener" translate="no" target="_blank"><span class="invisible">https://</span><span class="ellipsis">crt.sh/?id=13897811225&opt=ocs</span><span class="invisible">p</span></a></p><p>r#05: links.dydx.exchange<br>f: 14:28:19 GMT<br>c: 15:28:19.601 GMT<br>r: 20:59:47 UTC (cessationOfOperation)<br>s: <a href="https://crt.sh/?id=13897811650&opt=ocsp" rel="nofollow noopener" translate="no" target="_blank"><span class="invisible">https://</span><span class="ellipsis">crt.sh/?id=13897811650&opt=ocs</span><span class="invisible">p</span></a></p><p>r#06: integral.dydx.exchange<br>f: 14:28:22 GMT<br>c: 15:28:22.915 GMT<br>r: 21:00:22 UTC (cessationOfOperation)<br>s: <a href="https://crt.sh/?id=13897821925&opt=ocsp" rel="nofollow noopener" translate="no" target="_blank"><span class="invisible">https://</span><span class="ellipsis">crt.sh/?id=13897821925&opt=ocs</span><span class="invisible">p</span></a></p><p>v#01: status.dydx.exchange<br>f: 14:28:37 GMT<br>c: 15:28:37.649 GMT<br>r: 🧨 NOT REVOKED (as of 2024-08-05)<br>s: <a href="https://crt.sh/?id=13897817710&opt=ocsp" rel="nofollow noopener" translate="no" target="_blank"><span class="invisible">https://</span><span class="ellipsis">crt.sh/?id=13897817710&opt=ocs</span><span class="invisible">p</span></a></p><p>r#07: media.dydx.exchange<br>f: 14:29:06 GMT<br>c: 15:29:06.874 GMT<br>r: 20:59:56 UTC (cessationOfOperation)<br>s: <a href="https://crt.sh/?id=13897812660&opt=ocsp" rel="nofollow noopener" translate="no" target="_blank"><span class="invisible">https://</span><span class="ellipsis">crt.sh/?id=13897812660&opt=ocs</span><span class="invisible">p</span></a></p><p>r#08: help.dydx.exchange<br>f: 14:29:18 GMT<br>c: 15:29:18.337 GMT<br>r: 21:00:31 UTC (cessationOfOperation) <br>s: <a href="https://crt.sh/?id=13897814167&opt=ocsp" rel="nofollow noopener" translate="no" target="_blank"><span class="invisible">https://</span><span class="ellipsis">crt.sh/?id=13897814167&opt=ocs</span><span class="invisible">p</span></a></p><p>r#09: indexerv4staging.dydx.exchange<br>f: 14:29:19 GMT<br>c: 15:29:19.843 GMT<br>r: 21:12:13 UTC (cessationOfOperation)<br>s: <a href="https://crt.sh/?id=13897819527&opt=ocsp" rel="nofollow noopener" translate="no" target="_blank"><span class="invisible">https://</span><span class="ellipsis">crt.sh/?id=13897819527&opt=ocs</span><span class="invisible">p</span></a></p><p>r#10: forward.dydx.exchange<br>f: 14:29:26 GMT<br>c: 15:29:27.028 GMT<br>r: 21:12:34 UTC (cessationOfOperation)<br>s: <a href="https://crt.sh/?id=13897820336&opt=ocsp" rel="nofollow noopener" translate="no" target="_blank"><span class="invisible">https://</span><span class="ellipsis">crt.sh/?id=13897820336&opt=ocs</span><span class="invisible">p</span></a></p><p>v#02: metabase.dydx.exchange<br>f: 14:29:26 GMT<br>c: 15:29:27.210 GMT<br>r: 🧨 NOT REVOKED (as of 2024-08-05)<br>s: <a href="https://crt.sh/?id=13897815842&opt=ocsp" rel="nofollow noopener" translate="no" target="_blank"><span class="invisible">https://</span><span class="ellipsis">crt.sh/?id=13897815842&opt=ocs</span><span class="invisible">p</span></a></p><p>r#11: indexerv4dev.dydx.exchange<br>f: 14:29:51 GMT<br>c: 15:29:52.070 GMT<br>r: 21:12:52 UTC (cessationOfOperation)<br>s: <a href="https://crt.sh/?id=13897821570&opt=ocsp" rel="nofollow noopener" translate="no" target="_blank"><span class="invisible">https://</span><span class="ellipsis">crt.sh/?id=13897821570&opt=ocs</span><span class="invisible">p</span></a></p><p>r#12: analytics.dydx.exchange<br>f: 14:30:21 GMT<br>c: 15:30:21.562 GMT<br>r: 21:12:21 UTC (cessationOfOperation)<br>s: <a href="https://crt.sh/?id=13897822133&opt=ocsp" rel="nofollow noopener" translate="no" target="_blank"><span class="invisible">https://</span><span class="ellipsis">crt.sh/?id=13897822133&opt=ocs</span><span class="invisible">p</span></a></p><p>r#13: legacy-docs.dydx.exchange<br>f: 14:30:22 GMT<br>c: 15:30:22.997 GMT<br>r: 21:12:40 UTC (cessationOfOperation)<br>s: <a href="https://crt.sh/?id=13897821933&opt=ocsp" rel="nofollow noopener" translate="no" target="_blank"><span class="invisible">https://</span><span class="ellipsis">crt.sh/?id=13897821933&opt=ocs</span><span class="invisible">p</span></a></p><p>r#14: margintokens.dydx.exchange<br>f: 14:30:38 GMT<br>c: 15:30:38.606 GMT<br>r: 21:13:01 UTC (cessationOfOperation)<br>s: <a href="https://crt.sh/?id=13897821784&opt=ocsp" rel="nofollow noopener" translate="no" target="_blank"><span class="invisible">https://</span><span class="ellipsis">crt.sh/?id=13897821784&opt=ocs</span><span class="invisible">p</span></a></p><p>r#15: parity.dydx.exchange<br>f: 14:31:13 GMT<br>c: 15:31:13.749 GMT<br>r: 21:12:45 UTC (cessationOfOperation)<br>s: <a href="https://crt.sh/?id=13897830727&opt=ocsp" rel="nofollow noopener" translate="no" target="_blank"><span class="invisible">https://</span><span class="ellipsis">crt.sh/?id=13897830727&opt=ocs</span><span class="invisible">p</span></a></p><p>r#16: skhelp.dydx.exchange<br>f: 14:31:14 GMT<br>c: 15:31:14.982 GMT<br>r: 21:12:27 UTC (cessationOfOperation)<br>s: <a href="https://crt.sh/?id=13897829203&opt=ocsp" rel="nofollow noopener" translate="no" target="_blank"><span class="invisible">https://</span><span class="ellipsis">crt.sh/?id=13897829203&opt=ocs</span><span class="invisible">p</span></a></p><p>r#17: pm-bounces.dydx.exchange<br>f: 14:31:38 GMT<br>c: 15:31:38.388 GMT<br>r: 21:13:09 UTC (cessationOfOperation)<br>s: <a href="https://crt.sh/?id=13897833728&opt=ocsp" rel="nofollow noopener" translate="no" target="_blank"><span class="invisible">https://</span><span class="ellipsis">crt.sh/?id=13897833728&opt=ocs</span><span class="invisible">p</span></a></p><p>r#18: trade.dydx.exchange<br>f: 14:32:28 GMT<br>c: 15:32:28.689 GMT<br>r: 21:18:56 UTC (cessationOfOperation)<br>s: <a href="https://crt.sh/?id=13897833284&opt=ocsp" rel="nofollow noopener" translate="no" target="_blank"><span class="invisible">https://</span><span class="ellipsis">crt.sh/?id=13897833284&opt=ocs</span><span class="invisible">p</span></a></p><p>r#19: v#03: margin.dydx.exchange<br>f: 14:32:36 GMT<br>c: 15:32:37.015 GMT<br>r: 🧨 NOT REVOKED (as of 2024-08-05)<br>s: <a href="https://crt.sh/?id=13897844502&opt=ocsp" rel="nofollow noopener" translate="no" target="_blank"><span class="invisible">https://</span><span class="ellipsis">crt.sh/?id=13897844502&opt=ocs</span><span class="invisible">p</span></a></p><p>r#20: stage.dydx.exchange<br>f: 14:32:41 GMT<br>c: 15:32:41.083 GMT<br>r: 21:18:29 UTC (cessationOfOperation)<br>s: <a href="https://crt.sh/?id=13897834807&opt=ocsp" rel="nofollow noopener" translate="no" target="_blank"><span class="invisible">https://</span><span class="ellipsis">crt.sh/?id=13897834807&opt=ocs</span><span class="invisible">p</span></a></p><p>v#04: whitepaper.dydx.exchange<br>f: 14:33:17 GMT<br>c: 15:33:18.231 GMT<br>r: 🧨 NOT REVOKED (as of 2024-08-05)<br>s: <a href="https://crt.sh/?id=13897844858&opt=ocsp" rel="nofollow noopener" translate="no" target="_blank"><span class="invisible">https://</span><span class="ellipsis">crt.sh/?id=13897844858&opt=ocs</span><span class="invisible">p</span></a></p><p>r#21: testing.dydx.exchange<br>f: 14:33:35 GMT<br>c: 15:33:35.409 GMT<br>r: 21:18:36 UTC (cessationOfOperation)<br>s: <a href="https://crt.sh/?id=13852529152&opt=ocsp" rel="nofollow noopener" translate="no" target="_blank"><span class="invisible">https://</span><span class="ellipsis">crt.sh/?id=13852529152&opt=ocs</span><span class="invisible">p</span></a></p><p>v#05: url5082.dydx.exchange<br>f: 14:33:47 GMT<br>c: 15:33:47.838 GMT<br>r: 🧨 NOT REVOKED (as of 2024-08-05)<br>s: <a href="https://crt.sh/?id=13897842992&opt=ocsp" rel="nofollow noopener" translate="no" target="_blank"><span class="invisible">https://</span><span class="ellipsis">crt.sh/?id=13897842992&opt=ocs</span><span class="invisible">p</span></a></p><p>r#22: plhelp.dydx.exchange<br>f: 15:35:53 GMT<br>c: 16:35:53.580 GMT<br>r: 21:30:36 UTC<br>s: <a href="https://crt.sh/?id=13898344519&opt=ocsp" rel="nofollow noopener" translate="no" target="_blank"><span class="invisible">https://</span><span class="ellipsis">crt.sh/?id=13898344519&opt=ocs</span><span class="invisible">p</span></a></p><p>r#23: alpha.dydx.exchange<br>f: 14:36:47 GMT<br>c: 15:36:47.886 GMT<br>r: 21:19:04 UTC (cessationOfOperation)<br>s: <a href="https://crt.sh/?id=13897856627&opt=ocsp" rel="nofollow noopener" translate="no" target="_blank"><span class="invisible">https://</span><span class="ellipsis">crt.sh/?id=13897856627&opt=ocs</span><span class="invisible">p</span></a></p><p>r#24: indexerv4testnet.dydx.exchange<br>f: 14:37:43 GMT<br>c: 15:37:44.056 GMT<br>r: 21:29:58 UTC (cessationOfOperation)<br>s: <a href="https://crt.sh/?id=13897859052&opt=ocsp" rel="nofollow noopener" translate="no" target="_blank"><span class="invisible">https://</span><span class="ellipsis">crt.sh/?id=13897859052&opt=ocs</span><span class="invisible">p</span></a></p><p>r#25: hihelp.dydx.exchange<br>f: 14:41:50 GMT<br>c: 15:41:50.408 GMT<br>r: 21:30:27 UTC<br>s: <a href="https://crt.sh/?id=13897870799&opt=ocsp" rel="nofollow noopener" translate="no" target="_blank"><span class="invisible">https://</span><span class="ellipsis">crt.sh/?id=13897870799&opt=ocs</span><span class="invisible">p</span></a></p><p>v#06: em5800.dydx.exchange<br>f: 14:44:19 GMT<br>c: 15:44:19.193 GMT<br>r: 🧨 NOT REVOKED (as of 2024-08-05)<br>s: <a href="https://crt.sh/?id=13897878923&opt=ocsp" rel="nofollow noopener" translate="no" target="_blank"><span class="invisible">https://</span><span class="ellipsis">crt.sh/?id=13897878923&opt=ocs</span><span class="invisible">p</span></a></p><p>r#26: v4dev.dydx.exchange<br>f: 14:45:36 GMT<br>c: 15:45:36.560 GMT<br>r: 21:30:04 UTC<br>s: <a href="https://crt.sh/?id=13897883063&opt=ocsp" rel="nofollow noopener" translate="no" target="_blank"><span class="invisible">https://</span><span class="ellipsis">crt.sh/?id=13897883063&opt=ocs</span><span class="invisible">p</span></a></p><p>1 hour later, not revoked:</p><p>v#07: slack.dydx.exchange<br>f: 15:47:29 GMT<br>c: 16:47:29.547 GMT<br>r: 🧨 NOT REVOKED (as of 2024-08-05)<br>s: <a href="https://crt.sh/?id=13898502795&opt=ocsp" rel="nofollow noopener" translate="no" target="_blank"><span class="invisible">https://</span><span class="ellipsis">crt.sh/?id=13898502795&opt=ocs</span><span class="invisible">p</span></a></p><p>hours later, revoked:</p><p>r#27: metrics.dydx.exchange<br>f: 19:31:11 GMT<br>c: 20:31:12.076 GMT<br>r: 20:43:16 UTC (NO REASON PROVIDED)<br>s: <a href="https://crt.sh/?id=13900209357&opt=ocsp" rel="nofollow noopener" translate="no" target="_blank"><span class="invisible">https://</span><span class="ellipsis">crt.sh/?id=13900209357&opt=ocs</span><span class="invisible">p</span></a></p><p>---- END OF LIST ----</p><p><a href="https://infosec.exchange/tags/DV" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>DV</span></a> <a href="https://infosec.exchange/tags/LE" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>LE</span></a> <a href="https://infosec.exchange/tags/LetsEncrypt" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>LetsEncrypt</span></a> <a href="https://infosec.exchange/tags/Certificates" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>Certificates</span></a> <a href="https://infosec.exchange/tags/Certs" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>Certs</span></a> <a href="https://infosec.exchange/tags/Misissuance" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>Misissuance</span></a> <a href="https://infosec.exchange/tags/Mis_issuance" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>Mis_issuance</span></a> <a href="https://infosec.exchange/tags/Revocation" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>Revocation</span></a> <a href="https://infosec.exchange/tags/Revoked" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>Revoked</span></a> <a href="https://infosec.exchange/tags/Infosec" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>Infosec</span></a> <a href="https://infosec.exchange/tags/DNS" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>DNS</span></a> <a href="https://infosec.exchange/tags/DNSHijacks" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>DNSHijacks</span></a> <a href="https://infosec.exchange/tags/SquareSpace" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>SquareSpace</span></a> <a href="https://infosec.exchange/tags/DeFi" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>DeFi</span></a> <a href="https://infosec.exchange/tags/dydx_exchange" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>dydx_exchange</span></a> <a href="https://infosec.exchange/tags/CryptoCoins" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>CryptoCoins</span></a></p>