Trapped By The CLI

### Overview In this presentation, speaker William explores how command-line interface (CLI) cryptographic utilities—most notably OpenSSL—can mislead administrators and security operators when inspecting X.509 certificates and Certificate Signing Requests (CSRs). By leveraging terminal escape sequences, ANSI control characters, and ASN.1 structure manipulation, an attacker can visually mask malicious certificate metadata or spoof benign-looking information in terminal outputs.

### Key Topics - **X.509 and ASN.1/DER Encoding Fundamentals**: How digital certificates are composed of ASN.1 sequences and serialized into binary Distinguished Encoding Rules (DER) or base64-encoded Privacy-Enhanced Mail (PEM) formats. - **Binary Structure Manipulation**: Using OpenSSL's internal tools such as `asn1parse` alongside the speaker's tool, `asn1template`, to parse, modify, and regenerate complex nested ASN.1 structures. - **Terminal Control Character Injection**: Exploiting raw evaluation of control characters and ANSI escape sequences in CLI tools when rendering fields such as Distinguished Names (DN) and Subject Alternative Names (SAN). - **Certificate Signing Request Spoofing**: Demonstrating practical attack vectors where a reviewer believes they are approving an innocuous CSR, while in reality signing a request for unauthorized domains (e.g., `*.google.com`). - **Real-World Dataset Analysis**: Analyzing tens of millions of certificates obtained from CIRCL (Luxembourg's CERT for the private sector) to observe real-world oddities and unintended control characters.

### Technical Details The speaker traces the workflow of inspecting certificates via OpenSSL subcommands like `x509` and `asn1parse`. While reviewing an earlier OpenSSL infinite-loop vulnerability identified by Google's Tavis Ormandy, which required editing DER-encoded elliptic curve parameters, the speaker revisited `asn1template`—a Perl script that converts `asn1parse` output into a text template for modification and reconstruction using `asn1parse -genconf`.

Investigating OpenSSL's rendering behavior revealed several findings: 1. **Distinguished Name UTF-8 Interpretation**: Changes introduced in OpenSSL 3.2.4 allowed UTF-8 parsing in Distinguished Names, inadvertently interpreting embedded ANSI escape codes and control characters. When reported, OpenSSL categorized this behavior as a bug. 2. **Terminal Output Truncation**: Specific sequences in GNOME Terminal and select other emulators can suppress or conceal subsequent output, enabling an attacker to hide remaining certificate fields entirely. 3. **Raw Evaluation in SAN DNS Fields**: Across all versions of OpenSSL tested, injecting control codes and escape characters (such as clear screen and cursor movements) into the SAN `DNS` field resulted in raw evaluation in the terminal. When displayed, the output can visually simulate a benign domain like `google.com` while the actual Subject remains entirely different. 4. **CSR Deception in Private PKIs**: While public Certificate Authorities enforce strict validation rules rejecting malformed or complex entries, internal private PKIs (such as corporate environments using Easy-RSA for OpenVPN) remain vulnerable. An administrator inspecting a CSR via CLI can be tricked into signing a certificate for an arbitrary domain like `*.google.com`. 5. **Wild Certificate Anomalies**: Inspecting wild certificates provided by CIRCL revealed sizes from 239 bytes to over 35 kilobytes, including template variable expansion errors, embedded JSON/JavaScript, and live typing artifacts like backspace characters (`0x08`) capturing form corrections.

To conclude the technical demonstration, the speaker displayed a valid 23 MB certificate that rendered an animated 16-frame video in the terminal by interleaving frame displays with dummy data write-erase cycles to simulate timing pauses.

### Takeaways Terminal output cannot inherently be trusted as a sanitized representation of raw cryptographic artifacts. Administrators inspecting CSRs and certificates should never rely solely on standard terminal rendering. Critical files should be inspected using tools that display or sanitize control codes (such as piping output into `less`) before executing signatures in internal PKI workflows.