According to Google’s security team, NIC (India’s National Informatics Center) have been issuing unprincipled and dodgy SSL certificates. It has come to notice their that NIC has issued several unauthorized SSL certificates to various Google domains. These unauthorized certificates can be used to bluff and pretend as legit Google website on different servers and can put user’s information at risk.
Windows is the most common OS used by a large number of people as it supports a majority of programs. Users using Chrome on other OS than Windows like Android, IOS etc remains unaffected. Firefox also remains unmoved as it uses its own root store; therefore, SSL certificate is not required. The major concern kicks in when the issuer is holding a number of intermediate CA certificates that are trusted by India CCA as well as by some western companies. Although no evidence of Windows using these fake certificates has come up so far, however, an investigation is ongoing to find if there are any.
This concern was brought to Indian agencies and Microsoft as a result of which all fake SSL certificates were withdrawn within a few days. Required steps were taken by authorities to protect user’s information. Not only this, but India CCA is investigating the issue to find the root cause as it happened earlier too.
Certificate Transparency
Google accepts that it is a serious breach of CA system and such incidents indicate that Google’s Certificate Transparency efforts are critical for protecting the security of certificates in the future. Certificate transparency will help in:
Google engineers have come up with logging system that brings together CAs (ones that are trusted) and CAs working hard to build its goodwill. They have managed to issue a list of these CA’s on a public platform and specified those that are no longer trusted by browsers. The main mission of this system is to:
• Protect its user from fake and illegally issued SSL certificates
Windows is the most common OS used by a large number of people as it supports a majority of programs. Users using Chrome on other OS than Windows like Android, IOS etc remains unaffected. Firefox also remains unmoved as it uses its own root store; therefore, SSL certificate is not required. The major concern kicks in when the issuer is holding a number of intermediate CA certificates that are trusted by India CCA as well as by some western companies. Although no evidence of Windows using these fake certificates has come up so far, however, an investigation is ongoing to find if there are any.
This concern was brought to Indian agencies and Microsoft as a result of which all fake SSL certificates were withdrawn within a few days. Required steps were taken by authorities to protect user’s information. Not only this, but India CCA is investigating the issue to find the root cause as it happened earlier too.
Fake Certificate Security Issues
SSL/TLS (Security Socket Layer/ Transport Layer Security) encryption systems are badly hit by this dodgy SSL certificate, which was used to secure https:// connection. Various issues that have been raised so far are listed below:
• A warning was issued by Microsoft over ‘improper issued’ SSL certificate which could have resulted in a phishing attack.
• Apple also got alerted about the critical SSL flaw in Mac OS and iOS
• Google has warned CNNIC, an intermediate certificate authority, about the issuing of unauthorized digital certificates.
SSL/TLS (Security Socket Layer/ Transport Layer Security) encryption systems are badly hit by this dodgy SSL certificate, which was used to secure https:// connection. Various issues that have been raised so far are listed below:
• A warning was issued by Microsoft over ‘improper issued’ SSL certificate which could have resulted in a phishing attack.
• Apple also got alerted about the critical SSL flaw in Mac OS and iOS
• Google has warned CNNIC, an intermediate certificate authority, about the issuing of unauthorized digital certificates.
Certificate Transparency
Google accepts that it is a serious breach of CA system and such incidents indicate that Google’s Certificate Transparency efforts are critical for protecting the security of certificates in the future. Certificate transparency will help in:
- Eliminating security flaws as it will provide an open framework to monitor and audit SSL certificate in near real time.
- Detect fake SSLs.
- Identifying CAs attempt to issue unauthorized SSL certificates
- Pinning public key can specify authorized SSL certificates.
- Issuing authorities as well as can reject fake dodge SSL certificates.
Google engineers have come up with logging system that brings together CAs (ones that are trusted) and CAs working hard to build its goodwill. They have managed to issue a list of these CA’s on a public platform and specified those that are no longer trusted by browsers. The main mission of this system is to:
• Protect its user from fake and illegally issued SSL certificates
• Provide public record information about the certificates issued for specific domains.
No comments:
Post a Comment