Google catches bad digital certificates from Egyptian company

An Egyptian company issued unauthorized digital certificates for Google's services, a major no-no

Google said Monday an Egyptian company issued digital certificates that could have been used to intercept data traffic to its services, which did not appear to have been abused.

The incident is the latest example of longstanding problems around the issuance of digital certificates, which are used to encrypt data and verify the legitimacy of websites.

Google detected on March 20 that unauthorized digital certificates had been issued for several of its domains by MCS Holdings, a Cairo-based networking and security company, wrote Adam Langley, a Google security engineer.

The unauthorized certificates would have allowed MCS Holdings to spy on communications between Google and users on its network. Langley wrote that Google does not, however, believe the certificates were used for that purpose.

"We have no indication of abuse, and we are not suggesting that people change passwords or take other action," he wrote. "At this time, we are considering what further actions are appropriate.

Both Google and Mozilla, the developer of the Firefox browser, were instructing their browsers to block a higher level digital certificate -- known as an intermediate one -- which was used by MCS Holdings to issue the unauthorized ones.

The intermediate digital certificate was issued to MCS Holdings by the China Internet Network Information Center (CNNIC), a nonprofit organization that is administered by the Cyberspace Administration of China. CNNIC is a Certificate Authority, which is a considered a trusted organization that verifies digital certificates.

All Web browsers were coded to trust the certificates CNNIC issues, wrote Mozilla's security team in a blog post, which means the unauthorized ones issued by MCS Holdings would not trigger a warning.

Google contacted CNNIC when it detected the unauthorized certificates, Langley wrote. CNNIC said that MCS Holdings was only supposed to use the intermediate certificate to generate other certificates for the domains it owns.

Instead, MCS Holdings put the CNNIC intermediate certificate into a firewall, which was designed to inspect traffic that is encrypted by SSL/TLS. Many companies and organizations terminate encrypted traffic at a proxy so they can inspect it for security reasons.

But such proxies aren't supposed to have the power to generate certificates for other domains, Langley wrote. CNNIC, he wrote, "delegated their substantial authority to an organization that was not fit to hold it."

CNNIC told Google it would revoke the certificate. MCS Holdings couldn't immediately be reached for comment.

Security experts have long warned of the problems with wrongly issued digital certificates. To combat the problem, Google has pushed its Certificate Transparency project, which is aimed at quickly detecting SSL/TLS certificates that have been mistakenly issued or acquired by hackers.

Many major online services are also using a technique called certificate key pinning to bolster security. It allows online services to specify which certificate authorities have issued valid digital certificates for their sites and reject ones that haven't come from known authorities.

Send news tips and comments to jeremy_kirk@idg.com. Follow me on Twitter: @jeremy_kirk

Join the newsletter!

Or

Sign up to gain exclusive access to email subscriptions, event invitations, competitions, giveaways, and much more.

Membership is free, and your security and privacy remain protected. View our privacy policy before signing up.

Error: Please check your email address.

Tags securityGooglemozillaMCS Holdings

Keep up with the latest tech news, reviews and previews by subscribing to the Good Gear Guide newsletter.

Jeremy Kirk

IDG News Service
Show Comments

Brand Post

Most Popular Reviews

Latest Articles

Resources

PCW Evaluation Team

Luke Hill

MSI GT75 TITAN

I need power and lots of it. As a Front End Web developer anything less just won’t cut it which is why the MSI GT75 is an outstanding laptop for me. It’s a sleek and futuristic looking, high quality, beast that has a touch of sci-fi flare about it.

Emily Tyson

MSI GE63 Raider

If you’re looking to invest in your next work horse laptop for work or home use, you can’t go wrong with the MSI GE63.

Laura Johnston

MSI GS65 Stealth Thin

If you can afford the price tag, it is well worth the money. It out performs any other laptop I have tried for gaming, and the transportable design and incredible display also make it ideal for work.

Andrew Teoh

Brother MFC-L9570CDW Multifunction Printer

Touch screen visibility and operation was great and easy to navigate. Each menu and sub-menu was in an understandable order and category

Louise Coady

Brother MFC-L9570CDW Multifunction Printer

The printer was convenient, produced clear and vibrant images and was very easy to use

Edwina Hargreaves

WD My Cloud Home

I would recommend this device for families and small businesses who want one safe place to store all their important digital content and a way to easily share it with friends, family, business partners, or customers.

Featured Content

Latest Jobs

Don’t have an account? Sign up here

Don't have an account? Sign up now

Forgot password?