WhisperCore 0.5.5
Posted September 8th, 2011.
Last week, Whisper Systems responded to the
DigiNotar CA compromise
by removing the DigiNotar root from the WhisperCore CA trust database, effectively revoking trust in DigiNotar.
This week, a report was released by the Dutch government, which indicates that the scope of the breach is worse than we originally
anticipated. In addition to the compromised DigiNotar root, it appears that DigiNotar had a number of intermediate CA certificates
which were also compromised. These intermediates (signed by "Staadt der Nederlanden," Entrust, and
CyberTrust) could potentially have been used to sign some unknown number of forged SSL site certificates.
Intermediate CA certificates are not as straightforward to untrust. We can't simply remove them from a database, because they aren't
in any databases. Instead, they chain back to roots which are good otherwise. Firefox and Chrome have addressed this by baking these
certificates directly into their browser binaries and explicitly making checks against them when setting up SSL connections.
On your Android phone, however, there are many different apps that make SSL connections — all of which would have to bake
these explicit certificate checks into their SSL setup logic. At Whisper Systems, we don't want to wait for app developers to make
these changes, and they shouldn't have to. So we've extended the Android framework to do it automatically.
Now on WhisperCore, in addition to the trusted cacerts.bks store, we've created an additional untrusted.bks store, which contains
certificates that are to be explicitly considered compromised, and which is currently populated with the DigiNotar
intermediate certificates. If any application on the device initiates an SSL connection and receives a certificate chain with a
certificate from the untrusted.bks store anywhere in it (root, intermediate, or leaf), that SSL connection will be marked as invalid.
We believe that WhisperCore currently represents the only Android SSL experience that fully protects users from the DigiNotar
compromise. Stock Android devices have not been updated at all, but even advanced users who have rooted their phones to modify
the cacerts.bks file on non-WhisperCore devices are still not protected from these bad DigiNotar intermediate CA certs.
As usual, WhisperCore users can quickly upgrade by using the "WhisperCore Updater" app.
— Whisper Systems Development Team
