Menu
Google catches bad digital certificates from Egyptian company

Google catches bad digital certificates from Egyptian company

An Egyptian company issued unauthorized digital certificates for Google's services, a major no-no

Google said Monday an Egyptian company issued digital certificates that could have been used to intercept data traffic to its services, which did not appear to have been abused.

The incident is the latest example of longstanding problems around the issuance of digital certificates, which are used to encrypt data and verify the legitimacy of websites.

Google detected on March 20 that unauthorized digital certificates had been issued for several of its domains by MCS Holdings, a Cairo-based networking and security company, wrote Adam Langley, a Google security engineer.

The unauthorized certificates would have allowed MCS Holdings to spy on communications between Google and users on its network. Langley wrote that Google does not, however, believe the certificates were used for that purpose.

"We have no indication of abuse, and we are not suggesting that people change passwords or take other action," he wrote. "At this time, we are considering what further actions are appropriate.

Both Google and Mozilla, the developer of the Firefox browser, were instructing their browsers to block a higher level digital certificate -- known as an intermediate one -- which was used by MCS Holdings to issue the unauthorized ones.

The intermediate digital certificate was issued to MCS Holdings by the China Internet Network Information Center (CNNIC), a nonprofit organization that is administered by the Cyberspace Administration of China. CNNIC is a Certificate Authority, which is a considered a trusted organization that verifies digital certificates.

All Web browsers were coded to trust the certificates CNNIC issues, wrote Mozilla's security team in a blog post, which means the unauthorized ones issued by MCS Holdings would not trigger a warning.

Google contacted CNNIC when it detected the unauthorized certificates, Langley wrote. CNNIC said that MCS Holdings was only supposed to use the intermediate certificate to generate other certificates for the domains it owns.

Instead, MCS Holdings put the CNNIC intermediate certificate into a firewall, which was designed to inspect traffic that is encrypted by SSL/TLS. Many companies and organizations terminate encrypted traffic at a proxy so they can inspect it for security reasons.

But such proxies aren't supposed to have the power to generate certificates for other domains, Langley wrote. CNNIC, he wrote, "delegated their substantial authority to an organization that was not fit to hold it."

CNNIC told Google it would revoke the certificate. MCS Holdings couldn't immediately be reached for comment.

Security experts have long warned of the problems with wrongly issued digital certificates. To combat the problem, Google has pushed its Certificate Transparency project, which is aimed at quickly detecting SSL/TLS certificates that have been mistakenly issued or acquired by hackers.

Many major online services are also using a technique called certificate key pinning to bolster security. It allows online services to specify which certificate authorities have issued valid digital certificates for their sites and reject ones that haven't come from known authorities.

Send news tips and comments to jeremy_kirk@idg.com. Follow me on Twitter: @jeremy_kirk

Follow Us

Join the New Zealand Reseller News newsletter!

Error: Please check your email address.

Tags GoogleMCS Holdingssecuritymozilla

Slideshows

Meet the leading HP partners in New Zealand...

Meet the leading HP partners in New Zealand...

HP has recognised its top performing partners in New Zealand at the second annual 2016 HP Partner Awards, held at a glittering bash in Auckland. The HP Partner Awards recognises and celebrates excellence, growth, consistency and engagement of its top partners. This year also saw the addition of several new categories, resulting in 11 companies winning across 11 award categories.

Meet the leading HP partners in New Zealand...
Channel comes together as Ingram Micro Showcase hits Auckland

Channel comes together as Ingram Micro Showcase hits Auckland

Ingram Micro outlined its core focuses for 2017 at Showcase in Auckland, bringing together the channel for a day of engaging keynotes, compelling breakout sessions and new technologies.

Channel comes together as Ingram Micro Showcase hits Auckland
Show Comments