Google Security Slammed by Fake Web Certificates

Google has Admitted that, Unauthorized Digital Certificates Have been Issued for a Number of the Company's Domains. Google Security Engineer, Adam Langley Said, the Company Became Aware of Unauthorized Digital Certificates Being Issued for Several Google Domains on March 20th. In a Blog Post on Last Monday, the Engineer Said, the Certificates were Issued by an Intermediate Certificate Authority which the Tech Giant Believes, is Held by a Company Called, MCS Holdings, an Egyptian Company which Operates under the China Internet Network Information Center (CNNIC). CNNIC is Included in All Major Root Stores and so, "the misissued certificates would be trusted by almost all browsers and operating systems", Langley Says. However, a Fail-Safe Process Called Public-Key Pinning -- which Tells Web Clients to Associate Particular Cryptographic Public Keys with Specific Web Servers -- will Keep Chrome on Windows, OS X and Linux, ChromeOS and Firefox 33 and Above from Accepting such Fake Certificates.


Google Says that, upon Discovery, the Firm Alerted CNNIC and "Other Major Browsers" about the Security Incident and Blocked the MCS Holdings Certificate Immediately in Chrome with a CRLSet Push. Over the Weekend, CNNIC Responded and Explained they had "contracted with MCS Holdings on the basis that MCS would only issue certificates for domains that they had registered". However, instead of Keeping Private Keys in a Suitable Hardware Security Module, MCS Installed it, in a Man-in-the-Middle Proxy. Man-in-the-Middle Proxies Intercept Secure Connections by Pretending to be the Intended Destination of Traffic and Can be Used in a Variety of Ways, such as Monitoring Employee Browsing at Work. However, in this Scenario, a Breach of the Certificate Authority System Took Place. If a Business Wishes to Use such a Proxy to Monitor Secure Traffic, usually, Staff Computers Have to be Set to Accept and Trust the Proxy. However, in MCS's Case, the Proxy was Given the Full Authority of the Certificate Authority. The Technology Giant Says, Other Websites May Have also been Impersonated.




Langley Writes:


"This explanation is congruent with the facts. However, CNNIC still delegated their substantial authority to an organization that was not fit to hold it."


In Another, Separate Post on the Mozilla Security Blog, the Firm States:


"While this is not a Firefox-specific issue, to protect our users we are adding the revoked certificate to OneCRL, our mechanism for directly sending revocation information to Firefox which will be shipping in Firefox 37."




Google has Assured Users, there has been No Indication of Abuse and Chrome Users Don't Need to Take any Action including Changing Passwords.




Info Sources:

http://googleonlinesecurity.blogspot.com/2015/03/maintaining-digital-certificate-security.html

http://www.mcsholding.com

http://blog.chromium.org/2011/06/new-chromium-security-features-june.html

https://blog.mozilla.org/security/2015/03/23/revoking-trust-in-one-cnnic-intermediate-certificate