Google catches bad digital certificates from Egyptian company

An Egyptian company issued unauthorized digital certificates for Google's services, a major no-no

Google said Monday an Egyptian company issued digital certificates that could have been used to intercept data traffic to its services, which did not appear to have been abused.

The incident is the latest example of longstanding problems around the issuance of digital certificates, which are used to encrypt data and verify the legitimacy of websites.

Google detected on March 20 that unauthorized digital certificates had been issued for several of its domains by MCS Holdings, a Cairo-based networking and security company, wrote Adam Langley, a Google security engineer.

The unauthorized certificates would have allowed MCS Holdings to spy on communications between Google and users on its network. Langley wrote that Google does not, however, believe the certificates were used for that purpose.

"We have no indication of abuse, and we are not suggesting that people change passwords or take other action," he wrote. "At this time, we are considering what further actions are appropriate.

Both Google and Mozilla, the developer of the Firefox browser, were instructing their browsers to block a higher level digital certificate -- known as an intermediate one -- which was used by MCS Holdings to issue the unauthorized ones.

The intermediate digital certificate was issued to MCS Holdings by the China Internet Network Information Center (CNNIC), a nonprofit organization that is administered by the Cyberspace Administration of China. CNNIC is a Certificate Authority, which is a considered a trusted organization that verifies digital certificates.

All Web browsers were coded to trust the certificates CNNIC issues, wrote Mozilla's security team in a blog post, which means the unauthorized ones issued by MCS Holdings would not trigger a warning.

Google contacted CNNIC when it detected the unauthorized certificates, Langley wrote. CNNIC said that MCS Holdings was only supposed to use the intermediate certificate to generate other certificates for the domains it owns.

Instead, MCS Holdings put the CNNIC intermediate certificate into a firewall, which was designed to inspect traffic that is encrypted by SSL/TLS. Many companies and organizations terminate encrypted traffic at a proxy so they can inspect it for security reasons.

But such proxies aren't supposed to have the power to generate certificates for other domains, Langley wrote. CNNIC, he wrote, "delegated their substantial authority to an organization that was not fit to hold it."

CNNIC told Google it would revoke the certificate. MCS Holdings couldn't immediately be reached for comment.

Security experts have long warned of the problems with wrongly issued digital certificates. To combat the problem, Google has pushed its Certificate Transparency project, which is aimed at quickly detecting SSL/TLS certificates that have been mistakenly issued or acquired by hackers.

Many major online services are also using a technique called certificate key pinning to bolster security. It allows online services to specify which certificate authorities have issued valid digital certificates for their sites and reject ones that haven't come from known authorities.

Send news tips and comments to jeremy_kirk@idg.com. Follow me on Twitter: @jeremy_kirk

Join the Good Gear Guide newsletter!

Error: Please check your email address.

Tags GoogleMCS Holdingssecuritymozilla

Our Back to Business guide highlights the best products for you to boost your productivity at home, on the road, at the office, or in the classroom.

Keep up with the latest tech news, reviews and previews by subscribing to the Good Gear Guide newsletter.

Jeremy Kirk

IDG News Service
Show Comments

Cool Tech

Crucial Ballistix Elite 32GB Kit (4 x 8GB) DDR4-3000 UDIMM

Learn more >

Gadgets & Things

Lexar® Professional 1000x microSDHC™/microSDXC™ UHS-II cards

Learn more >

Family Friendly

Lexar® JumpDrive® S57 USB 3.0 flash drive 

Learn more >

Stocking Stuffer

Plox Star Wars Death Star Levitating Bluetooth Speaker

Learn more >

Christmas Gift Guide

Click for more ›

Most Popular Reviews

Latest News Articles

Resources

GGG Evaluation Team

Kathy Cassidy

STYLISTIC Q702

First impression on unpacking the Q702 test unit was the solid feel and clean, minimalist styling.

Anthony Grifoni

STYLISTIC Q572

For work use, Microsoft Word and Excel programs pre-installed on the device are adequate for preparing short documents.

Steph Mundell

LIFEBOOK UH574

The Fujitsu LifeBook UH574 allowed for great mobility without being obnoxiously heavy or clunky. Its twelve hours of battery life did not disappoint.

Andrew Mitsi

STYLISTIC Q702

The screen was particularly good. It is bright and visible from most angles, however heat is an issue, particularly around the Windows button on the front, and on the back where the battery housing is located.

Simon Harriott

STYLISTIC Q702

My first impression after unboxing the Q702 is that it is a nice looking unit. Styling is somewhat minimalist but very effective. The tablet part, once detached, has a nice weight, and no buttons or switches are located in awkward or intrusive positions.

Featured Content

Latest Jobs

Don’t have an account? Sign up here

Don't have an account? Sign up now

Forgot password?