That requested stemmed from the fact that PayPal is a high value target and that Let\u2019s Encrypt had already issued nearly 1,000 certificates containing the term \u201cPayPal,\u201d more than 99% of which were intended for phishing sites.<\/p>\n
With expanded research, we found our previous claim was a major underestimate. Let\u2019s Encrypt has actually issued 15,270 \u201cPayPal\u201d certificates. This reveals the previously unknown extent of the Let\u2019s Encrypt phishing phenomenon.<\/p>\n
The Let’s Encrypt Phishing Connection<\/h2>\n
One of the primary fears voiced by critics of Let\u2019s Encrypt \u2013 a fear that predates the Certificate Authority\u2019s launch \u2013 was that the service would become the go-to CA for phishers because its SSL certificates were free. Let\u2019s Encrypt also has an unconventional stance on the role of the CA, arguing that it was not the CA\u2019s job to stop malicious sites from using its certificates. This meant that phishers and malware distributors were free to use Let\u2019s Encrypt without any risk of being banned or having their certificate revoked.<\/p>\n<\/span><\/span>\n Despite the concerns of many around the industry, Let\u2019s Encrypt\u2019s stance is in full compliance with industry standards. Regardless, \u00a0that policy in combination with offering free certificates does create a very attractive environment for phishers.<\/p>\n In my previous article I said Let\u2019s Encrypt had issued 988 certificates containing the word \u201cPayPal\u201d \u2013 for example, paypal.com.secure-alert.net. Typically, CAs would not issue certificates like this due to the likelihood they will be used to aid criminal activity.<\/p>\n Of those 988, 99.5% of the certificates were being used (or had been used) for phishing. While this proved that there was wide-spread abuse, it was not at the scale many had expected when Let\u2019s Encrypt was first announced.<\/p>\n We now have new data that captures the full extent of the \u201cPayPal\u201d certificates that have been issued by Let\u2019s Encrypt. This new data comes from crt.sh<\/a> \u2013 a search engine for certificate transparency logs \u2013 and reveals that the service has been significantly more popular with phishers than previously reported.<\/p>\n Between January 1st<\/sup>, 2016 and March 6th<\/sup>, 2017, Let\u2019s Encrypt has issued a total of 15,270<\/span> SSL certificates containing the word \u201cPayPal.\u201d<\/strong><\/p>\n This figure is more than ten times larger than previous estimates that have been published. The vast majority of this issuance has occurred since November – since then Let\u2019s Encrypt has issued nearly 100 \u201cPayPal\u201d certificates per day.<\/p>\n Based on a random sample, 96.7% of these certificates were intended for use on phishing sites.<\/p>\n The internet is currently moving from HTTP to HTTPS, spurred by a number of initiatives to \u201cencrypt everything.\u201d<\/a> Encrypting everything<\/em> includes the bad sites, and the widespread use of HTTPS on malicious sites has been a concern for some.<\/p>\n For many years, the security industry as a whole incorrectly taught users to associate HTTPS and the green padlock with a \u201csafe\u201d site. This is a bad generalization, which may lead users to believe a phishing site is real if it is using SSL.<\/p>\n In addition, Chrome\u2019s new UI displays \u201cSecure\u201d next to every site with a valid SSL certificate and HTTPS configuration. What\u2019s the chance that a user misconstrues the meaning of this and sees a phishing site as legitimate?<\/p>\n While our research has focused on PayPal phishing, there are many other targets out there including Bank of America, Apple IDs, and Google. Let\u2019s Encrypt has issued thousands more<\/a> of these certificates.<\/p>\n This new data clearly shows that use of HTTPS on phishing sites is significantly higher than previously thought.<\/p>\n This section expands on our data and methodology.<\/p>\n Our Source<\/strong><\/p>\n Let\u2019s Encrypt submits all of the certificates it issues into certificate transparency logs<\/a>, a mechanism designed to increase public transparency into the activities of CAs. The logs also act as an excellent source for researchers who want to analyze a CA and the SSL certificate ecosystem.<\/p>\n Not all CAs log their certificates, as this is currently an optional practice (though not for long<\/a>). Because Let\u2019s Encrypt voluntarily logs, it allows us to get very accurate data about its issuance activity.<\/p>\n Last week we reported Let\u2019s Encrypt had issued 988 \u201cPayPal\u201d certificates. That figure came from the methodology used by previous works. Upon further research, we found that method was limited in scope and was capturing only a small portion of the population.<\/p>\n![\"PayPal](\"https:\/\/www.thesslstore.com\/blog\/wp-content\/uploads\/2017\/03\/PayPalPhishing.png\")
<\/p>\nThe Data<\/h2>\n
![\"PayPal](\"https:\/\/www.thesslstore.com\/blog\/wp-content\/uploads\/2017\/03\/Number-of-Certs_Issued_Chart-168x300.png\")
Let\u2019s Encrypt has been issuing certificates since late 2015, when they were in a public beta. However, the first Let\u2019s Encrypt phishing\u00a0certificate for Paypal was not issued until March 25th<\/sup>, 2016. On the right is a per month breakdown.<\/p>\n