Follow Us

We use cookies to provide you with a better experience. If you continue to use this site, we'll assume you're happy with this. Alternatively, click here to find out how to manage these cookies

hide cookie message

Major Google security scare after discovery of unauthorised certificate for google.com

Chrome browser updated, other browser makers notified of problem

Article comments

Google has taken steps to close potential security holes created by a fraudulent certificate for its google.com domain, discovered in late December.

The certificate was erroneously issued by an intermediate certificate authority (CA) linking back to TurkTrust, a Turkish CA.

"Intermediate CA certificates carry the full authority of the CA, so anyone who has one can use it to create a certificate for any website they wish to impersonate," wrote Adam Langley, a Google software engineer, in a blog post Thursday.

Google detected the existence of the certificate on Christmas Eve, updated its Chrome browser the next day to block the intermediate CA and notified TurkTrust and other browser makers about the problem.

TurkTrust then conducted its own investigation and found out that in August 2011 it had mistakenly issued two intermediate CA certificates to organizations that should have instead received regular SSL certificates, according to Langley.

Google then updated Chrome again to block the second CA certificate and again notified other browser vendors.

"Our actions addressed the immediate problem for our users. Given the severity of the situation, we will update Chrome again in January to no longer indicate Extended Validation status for certificates issued by TurkTrust, though connections to TurkTrust-validated HTTPS servers may continue to be allowed," Langley wrote.

Google may take additional steps in reaction to this issue, he added.

A Google spokesman said via e-mail that although TurkTrust mistakenly issued two intermediate certificates, only one was used to generate an unauthorized certificate.

"We believe there was one case of the certificate being used internally on a company's network," the spokesman said.

The incident is "a really big deal," said Chester Wisniewski, a senior security advisor at Sophos, a security software vendor.

"Essentially what happened is that the certificate authority in Turkey gave the master keys to everybody's web browser to some random company by accident and it turned out it was later abused," he said.

Meanwhile, both Microsoft and Mozilla have issued their own alerts about the problem.

In a security advisory, Microsoft said it was aware of "active attacks" being carried out using the digital certificate.

"This fraudulent certificate could be used to spoof content, perform phishing attacks, or perform man-in-the-middle attacks against several Google web properties," the Microsoft alert said.

To protect Windows users, Microsoft has updated its Certificate Trust List (CTL) and is pushing out the new version to all supported releases of the OS.

Users whose systems are set up to receive automatic updates of revoked certificates don't need to do anything because their computers will be updated automatically. Other users are advised to implement this patch immediately.

In its blog post, Mozilla provided more information about the malicious use of the certificate, saying it was employed in a man-in-the-middle attack.

"We are also concerned that the private keys for these certificates were not kept as secure as would be expected for intermediate certificates," wrote Michael Coates, Mozilla's Director of Security Assurance, in the blog post.

Mozilla will update all supported versions of Firefox on Tuesday so that the browser will not accept the two fraudulent certificates.



Share:

More from Techworld

More relevant IT news

Comments



Send to a friend

Email this article to a friend or colleague:

PLEASE NOTE: Your name is used only to let the recipient know who sent the story, and in case of transmission error. Both your name and the recipient's name and address will not be used for any other purpose.

Techworld White Papers

Choose – and Choose Wisely – the Right MSP for Your SMB

End users need a technology partner that provides transparency, enables productivity, delivers...

Download Whitepaper

10 Effective Habits of Indispensable IT Departments

It’s no secret that responsibilities are growing while budgets continue to shrink. Download this...

Download Whitepaper

Gartner Magic Quadrant for Enterprise Information Archiving

Enterprise information archiving is contributing to organisational needs for e-discovery and...

Download Whitepaper

Advancing the state of virtualised backups

Dell Software’s vRanger is a veteran of the virtualisation specific backup market. It was the...

Download Whitepaper

Techworld UK - Technology - Business

Innovation, productivity, agility and profit

Watch this on demand webinar which explores IT innovation, managed print services and business agility.

Techworld Mobile Site

Access Techworld's content on the move

Get the latest news, product reviews and downloads on your mobile device with Techworld's mobile site.

Find out more...

From Wow to How : Making mobile and cloud work for you

On demand Biztech Briefing - Learn how to effectively deliver mobile work styles and cloud services together.

Watch now...

Site Map

* *