Collected research

Breaking the Security Myths of Extended Validation SSL

Breaking the Security Myths of Extended Validation SSL Certificates

Alexander Sotirov and Mike Zusman · Black Hat USA

Shows how a trusted non-EV certificate can undermine an EV certificate indicator through subordinate content, same-origin window control, certificate switching and cached responses. The slides trace attack sequences and explain how cached malicious content can outlast an attacker’s presence on the victim’s network.

Record

Document

Breaking the Security Myths of Extended Validation SSL Certificates

Researcher

Alexander Sotirov and Mike Zusman

Published by

Black Hat USA

Format

Whitepaper

Topic

Crypto

In the archive

• Collected in the 2009 research round

Tags

• tls
• https
• cache-poisoning
• same-origin-policy
• ui-redress
• owasp-a01-2021
• owasp-a02-2021
• owasp-a04-2021

This page is the archive's own catalogue record. The research is the work of Alexander Sotirov and Mike Zusman, first published at the original source. Preserved copies are kept so the citation survives its host; this one was last captured on 13 September 2026.