Google blocks bogus digital certificates issued in India

It's unclear how the certificates were issued by the country's National Informatics Centre

Google has blocked several digital certificates issued in India that could have been used to make bogus websites appear to be run by the Web giant.

The digital certificates were issued by the National Informatics Centre (NIC), part of India's Ministry of Communications and Information Technology that handles e-government projects, wrote Adam Langley, a Google security engineer, on Tuesday.

How the bogus certificates were issued by NIC is under investigation, Langley wrote. Users are not believed to have been affected.

"We have no indication of widespread abuse, and we are not suggesting that people change passwords," he wrote.

Web browsers check a domain's digital certificate to verify it actually belongs to the entity that claims it. The certificate is also used to encrypt communications between a computer and the domain using SSL/TLS (Secure Sockets Layer/Transport Layer Security).

The certificates are issued by authorized authorities. Hackers have occasionally attacked those authorities and created valid digital certificates for illegitimate domains they've created, which pass a security check. If users were lured to the fraudulent website, an attacker could decrypt their data traffic.

Security experts have long warned of the problems with wrongly issued digital certificates. To combat the problem, Google has pushed its

Certificate Transparency project, which is aimed at quickly detecting SSL certificates that have been mistakenly issued or acquired by hackers.

The certificates were revoked on July 3, a day after Google's discovery of the problem, by another ministry agency, the Indian Controller of Certifying Authorities (India CCA), which regulates Certificate Authorities that issue digital certificates in India, Langley wrote.

Indian officials could not be immediately reached for comment.

The NIC held intermediate digital certificates, which were trusted by the Indian CCA, Langley wrote. Indian CCA certificates are trusted by most programs runnings on Windows, including Internet Explorer and Chrome, Langley wrote.

Firefox is not affected because it uses its own list of trusted certificates that doesn't include the Indian CCA ones, he wrote. Also, Chrome, Chrome OS, Android, iOS and OS X are not affected.

Chrome running on Windows would not have been fooled by the certificates due to a security measure Google uses called public-key pinning, he wrote. Google has also updated Chrome's CRLSet, a list of certificates that are trusted.

Send news tips and comments to jeremy_kirk@idg.com. Follow me on Twitter: @jeremy_kirk

Join the newsletter!

Error: Please check your email address.
Rocket to Success - Your 10 Tips for Smarter ERP System Selection

Tags GooglesecurityNational Informatics Centre

Keep up with the latest tech news, reviews and previews by subscribing to the Good Gear Guide newsletter.

Jeremy Kirk

IDG News Service
Show Comments

Most Popular Reviews

Latest Articles

Resources

PCW Evaluation Team

Sarah Ieroianni

Brother QL-820NWB Professional Label Printer

The print quality also does not disappoint, it’s clear, bold, doesn’t smudge and the text is perfectly sized.

Ratchada Dunn

Sharp PN-40TC1 Huddle Board

The Huddle Board’s built in program; Sharp Touch Viewing software allows us to easily manipulate and edit our documents (jpegs and PDFs) all at the same time on the dashboard.

George Khoury

Sharp PN-40TC1 Huddle Board

The biggest perks for me would be that it comes with easy to use and comprehensive programs that make the collaboration process a whole lot more intuitive and organic

David Coyle

Brother PocketJet PJ-773 A4 Portable Thermal Printer

I rate the printer as a 5 out of 5 stars as it has been able to fit seamlessly into my busy and mobile lifestyle.

Kurt Hegetschweiler

Brother PocketJet PJ-773 A4 Portable Thermal Printer

It’s perfect for mobile workers. Just take it out — it’s small enough to sit anywhere — turn it on, load a sheet of paper, and start printing.

Matthew Stivala

HP OfficeJet 250 Mobile Printer

The HP OfficeJet 250 Mobile Printer is a great device that fits perfectly into my fast paced and mobile lifestyle. My first impression of the printer itself was how incredibly compact and sleek the device was.

Featured Content

Latest Jobs

Don’t have an account? Sign up here

Don't have an account? Sign up now

Forgot password?