Feeds

Web credential authority rebuked for 'poor' security

Digicert Malaysia banished from Chrome, IE, Firefox

Providing a secure and efficient Helpdesk

Microsoft, Google, and Mozilla will banish yet another web authentication authority from their software after learning that it issued secure sockets layer certificates that could be used to attack people visiting Malaysian government websites.

Digicert Malaysia, an intermediate certificate authority that was certified by parent authority Entrust, issued 22 certificates with weak private keys and other serious deficiencies, the companies said. The lapses, which also included a failure to include revocation details and EKU, or extended key usage, designations, constituted a breach of obligations all CAs are required to follow to ensure the security of the SSL system.

“There is no indication that any certificates were issued fraudulently, however, these weak keys have allowed some of the certificates to be compromised,” Jerry Bryant, a spokesman in Microsoft's Trustworthy Computing group, wrote in a blog post. “The subordinate CA has clearly demonstrated poor CA security practices and Microsoft intends to revoke trust in the intermediate certificates.”

The public rebuke comes two months after software makers revoked the signing credentials of DigiNotar following revelations the Netherlands-based authority suffered a colossal security breach that allowed attackers to mint 531 bogus certificates for high-profile services. At least one of the counterfeits was exploited to spy on more than 300,000 Google Mail users in Iran.

In March, a security breach on a certificate reseller of rival CA Comodo resulted in the forgeries of credentials for many of the same domains, which in addition to Gmail, included Skype, Mozilla add-ons, and Microsoft update. Four months ago, another CA, Israel-based StartSSL, also said it was hacked, although the attackers were unable to obtain certificates that would allow them to spoof websites in a similar fashion. At least four other CAs have reported being compromised since June.

Entrust, the US-based CA whose imprimatur authorized Digicert Malaysia, said in its own blog post that it also planned to remove that trust. A separate advisory from Mozilla is here. This Chromium update indicates that Google is taking similar steps, and a spokesman confirmed the company also intend to revoke trust in the Malaysian CA.

The omissions of Digicert Malaysia appear to be a serious violation of CA security standards. Its use of 512-bit keys, for instance, stand in stark contrast to the minimum requirement that keys contain twice that length. What's more, the lack of revocation information makes it harder to recall Digicert Malaysia certificates if they're found to be flawed, and the failure to include EKU information allows them to be abused in ways that otherwise wouldn't be possible.

“An attacker could use one of these weak certificates to impersonate the legitimate owners,” Mozilla's statement warned. “This could deceive users into trusting websites or signed software appearing to originate from these owners, but actually containing malicious content or software.”

The 22 certificates belonged to a “mix of Malaysian government websites and internal systems.”

Digicert Malaysia's banishment is effective Tuesday. It's not clear if that means the certificates are susceptible to abuse until them. Digicert Malaysia has no affiliation to Digicert Inc. based in Utah. ®

Choosing a cloud hosting partner with confidence

More from The Register

next story
SMASH the Bash bug! Apple and Red Hat scramble for patch batches
'Applying multiple security updates is extremely difficult'
Shellshock: 'Larger scale attack' on its way, warn securo-bods
Not just web servers under threat - though TENS of THOUSANDS have been hit
Apple's new iPhone 6 vulnerable to last year's TouchID fingerprint hack
But unsophisticated thieves need not attempt this trick
Oracle SHELLSHOCKER - data titan lists unpatchables
Database kingpin lists 32 products that can't be patched (yet) as GNU fixes second vuln
Who.is does the Harlem Shake
Blame it on LOLing XSS terroristas
Researchers tell black hats: 'YOU'RE SOOO PREDICTABLE'
Want to register that domain? We're way ahead of you.
Stunned by Shellshock Bash bug? Patch all you can – or be punished
UK data watchdog rolls up its sleeves, polishes truncheon
prev story

Whitepapers

A strategic approach to identity relationship management
ForgeRock commissioned Forrester to evaluate companies’ IAM practices and requirements when it comes to customer-facing scenarios versus employee-facing ones.
Storage capacity and performance optimization at Mizuno USA
Mizuno USA turn to Tegile storage technology to solve both their SAN and backup issues.
High Performance for All
While HPC is not new, it has traditionally been seen as a specialist area – is it now geared up to meet more mainstream requirements?
Beginner's guide to SSL certificates
De-mystify the technology involved and give you the information you need to make the best decision when considering your online security options.
Security for virtualized datacentres
Legacy security solutions are inefficient due to the architectural differences between physical and virtual environments.