Google catches bad digital certificates from Egyptian company

An Egyptian company issued unauthorized digital certificates for Google's services, a major no-no

Google said Monday an Egyptian company issued digital certificates that could have been used to intercept data traffic to its services, which did not appear to have been abused.

The incident is the latest example of longstanding problems around the issuance of digital certificates, which are used to encrypt data and verify the legitimacy of websites.

Google detected on March 20 that unauthorized digital certificates had been issued for several of its domains by MCS Holdings, a Cairo-based networking and security company, wrote Adam Langley, a Google security engineer.

The unauthorized certificates would have allowed MCS Holdings to spy on communications between Google and users on its network. Langley wrote that Google does not, however, believe the certificates were used for that purpose.

"We have no indication of abuse, and we are not suggesting that people change passwords or take other action," he wrote. "At this time, we are considering what further actions are appropriate.

Both Google and Mozilla, the developer of the Firefox browser, were instructing their browsers to block a higher level digital certificate -- known as an intermediate one -- which was used by MCS Holdings to issue the unauthorized ones.

The intermediate digital certificate was issued to MCS Holdings by the China Internet Network Information Center (CNNIC), a nonprofit organization that is administered by the Cyberspace Administration of China. CNNIC is a Certificate Authority, which is a considered a trusted organization that verifies digital certificates.

All Web browsers were coded to trust the certificates CNNIC issues, wrote Mozilla's security team in a blog post, which means the unauthorized ones issued by MCS Holdings would not trigger a warning.

Google contacted CNNIC when it detected the unauthorized certificates, Langley wrote. CNNIC said that MCS Holdings was only supposed to use the intermediate certificate to generate other certificates for the domains it owns.

Instead, MCS Holdings put the CNNIC intermediate certificate into a firewall, which was designed to inspect traffic that is encrypted by SSL/TLS. Many companies and organizations terminate encrypted traffic at a proxy so they can inspect it for security reasons.

But such proxies aren't supposed to have the power to generate certificates for other domains, Langley wrote. CNNIC, he wrote, "delegated their substantial authority to an organization that was not fit to hold it."

CNNIC told Google it would revoke the certificate. MCS Holdings couldn't immediately be reached for comment.

Security experts have long warned of the problems with wrongly issued digital certificates. To combat the problem, Google has pushed its Certificate Transparency project, which is aimed at quickly detecting SSL/TLS certificates that have been mistakenly issued or acquired by hackers.

Many major online services are also using a technique called certificate key pinning to bolster security. It allows online services to specify which certificate authorities have issued valid digital certificates for their sites and reject ones that haven't come from known authorities.

Send news tips and comments to jeremy_kirk@idg.com. Follow me on Twitter: @jeremy_kirk

Join the Good Gear Guide newsletter!

Error: Please check your email address.

Tags GoogleMCS Holdingssecuritymozilla

Our Back to Business guide highlights the best products for you to boost your productivity at home, on the road, at the office, or in the classroom.

Keep up with the latest tech news, reviews and previews by subscribing to the Good Gear Guide newsletter.

Jeremy Kirk

IDG News Service
Show Comments

Essentials

Lexar® JumpDrive® S57 USB 3.0 flash drive

Learn more >

Microsoft L5V-00027 Sculpt Ergonomic Keyboard Desktop

Learn more >

Mobile

Lexar® JumpDrive® S45 USB 3.0 flash drive 

Learn more >

Exec

Lexar® JumpDrive® C20c USB Type-C flash drive 

Learn more >

Lexar® Professional 1800x microSDHC™/microSDXC™ UHS-II cards 

Learn more >

Audio-Technica ATH-ANC70 Noise Cancelling Headphones

Learn more >

HD Pan/Tilt Wi-Fi Camera with Night Vision NC450

Learn more >

Budget

Back To Business Guide

Click for more ›

Most Popular Reviews

Latest News Articles

Resources

PCW Evaluation Team

Michael Hargreaves

Windows 10 for Business / Dell XPS

I’d happily recommend this touchscreen laptop and Windows 10 as a great way to get serious work done at a desk or on the road.

Aysha Strobbe

Windows 10 / HP Spectre

Ultimately, I think the Windows 10 environment is excellent for me as it caters for so many different uses. The inclusion of the Xbox app is also great for when you need some downtime too!

Mark Escubio

Windows 10 / Lenovo Yoga

For me, the Xbox Play Anywhere is a great new feature as it allows you to play your current Xbox games with higher resolutions and better graphics without forking out extra cash for another copy. Although available titles are still scarce, but I’m sure it will grow in time.

Kathy Cassidy

STYLISTIC Q702

First impression on unpacking the Q702 test unit was the solid feel and clean, minimalist styling.

Anthony Grifoni

STYLISTIC Q572

For work use, Microsoft Word and Excel programs pre-installed on the device are adequate for preparing short documents.

Featured Content

Latest Jobs

Don’t have an account? Sign up here

Don't have an account? Sign up now

Forgot password?