When a Google Engineer Detect Fake/ Dodgy SSL Certificates

According to Google’s security team, NIC (India’s National Informatics Center) have been issuing unprincipled and dodgy SSL certificates. It has come to notice their that NIC has issued several unauthorized SSL certificates to various Google domains. These unauthorized certificates can be used to bluff and pretend as legit Google website on different servers and can put user’s information at risk.

Windows is the most common OS used by a large number of people as it supports a majority of programs. Users using Chrome on other OS than Windows like Android, IOS etc remains unaffected. Firefox also remains unmoved as it uses its own root store; therefore, SSL certificate is not required.  The major concern kicks in when the issuer is holding a number of intermediate CA certificates that are trusted by India CCA as well as by some western companies. Although no evidence of Windows using these fake certificates has come up so far, however, an investigation is ongoing to find if there are any.

This concern was brought to Indian agencies and Microsoft as a result of which all fake SSL certificates were withdrawn within a few days. Required steps were taken by authorities to protect user’s information. Not only this, but India CCA is investigating the issue to find the root cause as it happened earlier too.

Fake Certificate Security Issues

SSL/TLS (Security Socket Layer/ Transport Layer Security) encryption systems are badly hit by this dodgy SSL certificate, which was used to secure https:// connection. Various issues that have been raised so far are listed below:

• A warning was issued by Microsoft over ‘improper issued’ SSL certificate which could have resulted in a phishing attack.

• Apple also got alerted about the critical SSL flaw in Mac OS and iOS

• Google has warned CNNIC, an intermediate certificate authority, about the issuing of unauthorized digital certificates.


Certificate Transparency

Google accepts that it is a serious breach of CA system and such incidents indicate that Google’s Certificate Transparency efforts are critical for protecting the security of certificates in the future. Certificate transparency will help in:
  • Eliminating security flaws as it will provide an open framework to monitor and audit SSL certificate in near real time.
  • Detect fake SSLs.
  • Identifying CAs attempt to issue unauthorized SSL certificates
  • Pinning public key can specify authorized SSL certificates.
  • Issuing authorities as well as can reject fake dodge SSL certificates.
Google Logging System

Google engineers have come up with logging system that brings together CAs (ones that are trusted) and CAs working hard to build its goodwill. They have managed to issue a list of these CA’s on a public platform and specified those that are no longer trusted by browsers. The main mission of this system is to:

• Protect its user from fake and illegally issued SSL certificates


• Provide public record information about the certificates issued for specific domains.

Comments

Post a Comment

Popular posts from this blog

Does SSL Help Your Local Business’s SEO Rank To Improve On Google?

Image
About SSL SSL  is a Secure Socket Layer, which helps in securing data from being misused or modified by any third party by establishing encrypted link between the browser and the server or between servers. This link ensures that the data that is being transferred/shared between the server and the browser remains private and secure. How SEO Rank can be improved for our website/local business? We should comprehend this simplerly. At whatever point we have an inquiry in our mind, we tend to seek it online with the assistance of any search engine. When we compose our question, a list of results appear on our screen and out of each one of those outcomes more often than not we pick the specific first outcome. We do so because the main site appeared because of our query tends to be more proper or important than different sites or site pages. The site positioned better will be appeared preceding the sites whose positioning isn't that great when contrasted with the site which is positi...
Read more

What Studies Say About Comodo Positive SSL Wildcard and Essential SSL Wildcard Certificate?

Image
Every business has its own nature, some runs high-risk and some have a low-risk business. But the data which is there in hand is something very important for which a company’s owner works really hard enough to build a huge empire. What if?   What if the data got stolen? This is where the business suffers from an awful condition that takes a company month’s back. For that, every company needs security who keeps an eye on the thief’s who actually steals the encrypted data.  SSL Certificates  actually helps you to find out the threat and work as a shield to secure against that.      SSL Certificate SSL Certificate link ensures that all data passed between the web server and browsers remain private and integral. There are types of SSL Certificates Comodo Positive SSL Wildcard and Essential SSL Wildcard Certificate. Comodo Positive SSL Wildcard Certificate :  It’s a Certification Authority (C.A), which provides a list of SSL ce...
Read more

The Internet of Things is The Future; Protection Must Be, As Well

Image
Internet security is a major concern of all Internet users, whether you are a client or a website owner. This concern is due to increase in internet threats on daily basis. These threats include viruses, which can erase all the data on hard disk creates problem in smooth working of software and even are programmed in such a manner that it steals personal information, bank details and identity. To fight against such threats you need   internet security . But what's the web of things, or IoT, and why is it changing into a cybersecurity concern? the web of things is formed from billions of “smart” devices that hook up with the web. Examples embrace wearable technology, home devices and medical devices. additionally to driving innovation, IoT devices are getting progressively well-liked. Gartner lnc. predicts that by 2020, there'll be twenty.4 billion good devices in use worldwide. But there's risk. This increasing convergence of wearable technologies and cloud services in...
Read more