Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Risk

4/17/2013
06:42 PM
Connect Directly
Google+
LinkedIn
Twitter
RSS
E-Mail
50%
50%

Mozilla Weighs Excommunication For Certificate Authority TeliaSonera

Swedish telecom provider accused of helping governments spy on citizens.

Mozilla is mulling whether to refuse to recognize Swedish telecom multinational TeliaSonera as a trusted certificate authority because of claims the company assists governments with surveillance.

TeliaSonera has asked Mozilla to accept its new root certificate in the list of trusted certificates used by Firefox. If Mozilla does not do so, websites that purchase SSL certificates from TeliaSonera or its affiliates will generate warnings when visited by Firefox users. Those warnings will likely deter online visitors from interacting with affected websites and would probably ruin the company's ability to sell SSL certificates.

"TeliaSonera's roots are a topic of active and public discussion in the Mozilla community," a Mozilla spokeswoman said in an email. "We have not reached a decision at this time. The decision to trust a certificate authority in Mozilla products is one we make very carefully. Each authority is publicly vetted before inclusion, and is required to provide regular, public audits of policy compliance once included."

[ Want to know how Google is giving legacy apps extended life? Read Google Offers Life Support For Old Internet Explorer Versions. ]

Mozilla's concern is that a certificate authority can provide governments or other parties with the ability to conduct a man-in-the-middle attack in order to covertly intercept online communications. The company's certificate inclusion policy states that would-be certificate authorities must disclose their business practices and publicly declare their compliance with Mozilla's requirements.

In a discussion of the issue in Mozilla's security policy group that has been going on since early March, Mozilla program manager Kathleen Wilson noted that there appears to be evidence that TeliaSonera is currently providing software, services or devices that enable customers, including oppressive regimes, to conduct surveillance and interception of communications.

Some participants in the discussion contend that the role of a certificate authority -- attesting to the security of websites -- is incompatible with selling surveillance technology that bypasses security.

Christopher Soghoian, a noted privacy researcher who recently became principal technologist at the American Civil Liberties Union, argued in a post to Mozilla's TeliaSonera discussion that certificate authorities should not be in the surveillance business. "Mozilla can and should use its power to force these companies to pick which market they want to be in -- they can either provide wiretaps or HTTPS certificates, but not both," he said.

Soghoian argued that telecommunications companies, such as Verizon, should not be allowed to sell SSL certificates at all. "In many countries (including the U.S.), telecommunications carriers are required to provide surveillance assistance to governments," he said. "This will likely mean that telecommunications carriers will not be able to be in the certificate business."

Last year, the Electronic Frontier Foundation accused TeliaSonera of "colluding with authoritarian regimes by selling them high-tech surveillance gear to spy on its citizens," based on an investigation conducted by Swedish news show Uppdrag Granskning.

TeliaSonera insists that it meets Mozilla's requirements and that the company only wants to upgrade its CA root certificate for legitimate business reasons, such as making the certificates it issues valid for longer periods of time, accommodating longer encryption-key lengths and reflecting the company's name change from Sonera to TeliaSonera.

Addressing the issue in a post last month, TeliaSonera senior public relations manager Irene Krohn said TeliaSonera only provides interception surveillance services as required by law in the countries where it operates. "The governments and security services of all countries in the world have the legal right to request information from operators and monitor network traffic for the purpose of fighting crime," she wrote. "This is happening every day in all countries and applies to all operators. We are obliged to comply with the legislation of each country."

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
The Mainframe Is Seeing a Resurgence. Is Security Keeping Pace?
Ray Overby, Co-Founder & President at Key Resources, Inc.,  8/15/2019
The Flaw in Vulnerability Management: It's Time to Get Real
Jim Souders, Chief Executive Officer at Adaptiva,  8/15/2019
Tough Love: Debunking Myths about DevOps & Security
Jeff Williams, CTO, Contrast Security,  8/19/2019
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Current Issue
7 Threats & Disruptive Forces Changing the Face of Cybersecurity
This Dark Reading Tech Digest gives an in-depth look at the biggest emerging threats and disruptive forces that are changing the face of cybersecurity today.
Flash Poll
The State of IT Operations and Cybersecurity Operations
The State of IT Operations and Cybersecurity Operations
Your enterprise's cyber risk may depend upon the relationship between the IT team and the security team. Heres some insight on what's working and what isn't in the data center.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2019-5638
PUBLISHED: 2019-08-21
Rapid7 Nexpose versions 6.5.50 and prior suffer from insufficient session expiration when an administrator performs a security relevant edit on an existing, logged on user. For example, if a user's password is changed by an administrator due to an otherwise unrelated credential leak, that user accou...
CVE-2019-6177
PUBLISHED: 2019-08-21
A vulnerability reported in Lenovo Solution Center version 03.12.003, which is no longer supported, could allow log files to be written to non-standard locations, potentially leading to privilege escalation. Lenovo ended support for Lenovo Solution Center and recommended that customers migrate to Le...
CVE-2019-10687
PUBLISHED: 2019-08-21
KBPublisher 6.0.2.1 has SQL Injection via the admin/index.php?module=report entry_id[0] parameter, the admin/index.php?module=log id parameter, or an index.php?View=print&id[]= request.
CVE-2019-11601
PUBLISHED: 2019-08-21
A directory traversal vulnerability in remote access to backup & restore in earlier versions than ProSyst mBS SDK 8.2.6 and Bosch IoT Gateway Software 9.2.0 allows remote attackers to write or delete files at any location.
CVE-2019-11602
PUBLISHED: 2019-08-21
Leakage of stack traces in remote access to backup & restore in earlier versions than ProSyst mBS SDK 8.2.6 and Bosch IoT Gateway Software 9.2.0 allows remote attackers to gather information about the file system structure.