Vulnerabilities / Threats
1/4/2013
05:55 PM
Connect Directly
LinkedIn
Twitter
Google+
RSS
E-Mail
50%
50%

Microsoft, Mozilla, Opera Block Unauthorized Digital Certificate

Google alert prompts other browser vendors to block rogue digital certificates.

Microsoft, Mozilla and Opera took steps Thursday to block two unauthorized digital certificates from Turktrust, a Turkish certificate authority, one of which appears to have been used to intercept online communications.

The "intermediate" certificates in question, explained Michael Coates, Mozilla director of security assurance, in a blog post, can be used to conduct a man-in-the-middle (MITM) attack. In so doing, the certificate holder could intercept and access communication on his or her network between a user and any website.

"Such certificates could deceive users into trusting websites appearing to originate from the domain owners, but actually containing malicious content or software," said Coates.

Coates expressed concern that one of the certificates "was used for MITM traffic management of domain names that the customer did not legitimately own or control."

[ Learn more about digital certificates. Read Expired Digital Certificates: A Management Challenge. ]

Microsoft put it more bluntly, stating in its security advisory that it "is aware of active attacks using one fraudulent digital certificate issued by [certificate authority] Turktrust."

Opera's Sigbjorn Vig however was more cautious in his assessment, noting that "the google.com certificate was automatically issued by an over-zealous firewall/proxy, and not used fraudulently in any manner."

Google blocked the two certificates in Chrome browsers last month because it detected one of them being used to impersonate the "*.google.com" domain. It then notified other browser vendors about the issue.

Apple has not yet made a public statement about the incident.

Turktrust said in a statement that the relevant certificates have been revoked and that it has identified the source of the problem, a unique situation the company insists, without providing details. "There is also no evidence of any attack or hacking attempt on our systems, as well as no implication of any malicious usage," the company insisted.

Nonetheless, the incident underscores the fragility of the Internet's trust architecture and offers a reminder of past certificate problems like the hacking of now-defunct certificate authority DigiNotar. Risks include not only the possibility that malicious individuals or groups could misuse digital certificates to intercept online communications but also the possibility that governments could compel local certificate authorities to issue intermediate certificates to facilitate mass online eavesdropping.

Comment  | 
Print  | 
More Insights
Register for Dark Reading Newsletters
White Papers
Cartoon
Current Issue
Flash Poll
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2015-1955
Published: 2015-08-03
IBM MQ Light before 1.0.0.2 allows remote attackers to cause a denial of service (CPU consumption) via a crafted byte sequence in authentication data.

CVE-2015-1956
Published: 2015-08-03
IBM MQ Light before 1.0.0.2 allows remote attackers to cause a denial of service (disk consumption) via a crafted byte sequence in authentication data, a different vulnerability than CVE-2015-1958 and CVE-2015-1987.

CVE-2015-1958
Published: 2015-08-03
IBM MQ Light before 1.0.0.2 allows remote attackers to cause a denial of service (disk consumption) via a crafted byte sequence in authentication data, a different vulnerability than CVE-2015-1956 and CVE-2015-1987.

CVE-2015-1970
Published: 2015-08-03
The IBM WebSphere DataPower XC10 appliance 2.1 through 2.1.0.3 and 2.5 through 2.5.0.4 retains data on SSD cards, which might allow physically proximate attackers to obtain sensitive information by extracting a card and attaching it elsewhere.

CVE-2015-1987
Published: 2015-08-03
IBM MQ Light before 1.0.0.2 allows remote attackers to cause a denial of service (disk consumption) via a crafted byte sequence in authentication data, a different vulnerability than CVE-2015-1956 and CVE-2015-1958.

Dark Reading Radio
Archived Dark Reading Radio
What’s the future of the venerable firewall? We’ve invited two security industry leaders to make their case: Join us and bring your questions and opinions!