Feeds

Web credential authority rebuked for 'poor' security

Digicert Malaysia banished from Chrome, IE, Firefox

Secure remote control for conventional and virtual desktops

Microsoft, Google, and Mozilla will banish yet another web authentication authority from their software after learning that it issued secure sockets layer certificates that could be used to attack people visiting Malaysian government websites.

Digicert Malaysia, an intermediate certificate authority that was certified by parent authority Entrust, issued 22 certificates with weak private keys and other serious deficiencies, the companies said. The lapses, which also included a failure to include revocation details and EKU, or extended key usage, designations, constituted a breach of obligations all CAs are required to follow to ensure the security of the SSL system.

“There is no indication that any certificates were issued fraudulently, however, these weak keys have allowed some of the certificates to be compromised,” Jerry Bryant, a spokesman in Microsoft's Trustworthy Computing group, wrote in a blog post. “The subordinate CA has clearly demonstrated poor CA security practices and Microsoft intends to revoke trust in the intermediate certificates.”

The public rebuke comes two months after software makers revoked the signing credentials of DigiNotar following revelations the Netherlands-based authority suffered a colossal security breach that allowed attackers to mint 531 bogus certificates for high-profile services. At least one of the counterfeits was exploited to spy on more than 300,000 Google Mail users in Iran.

In March, a security breach on a certificate reseller of rival CA Comodo resulted in the forgeries of credentials for many of the same domains, which in addition to Gmail, included Skype, Mozilla add-ons, and Microsoft update. Four months ago, another CA, Israel-based StartSSL, also said it was hacked, although the attackers were unable to obtain certificates that would allow them to spoof websites in a similar fashion. At least four other CAs have reported being compromised since June.

Entrust, the US-based CA whose imprimatur authorized Digicert Malaysia, said in its own blog post that it also planned to remove that trust. A separate advisory from Mozilla is here. This Chromium update indicates that Google is taking similar steps, and a spokesman confirmed the company also intend to revoke trust in the Malaysian CA.

The omissions of Digicert Malaysia appear to be a serious violation of CA security standards. Its use of 512-bit keys, for instance, stand in stark contrast to the minimum requirement that keys contain twice that length. What's more, the lack of revocation information makes it harder to recall Digicert Malaysia certificates if they're found to be flawed, and the failure to include EKU information allows them to be abused in ways that otherwise wouldn't be possible.

“An attacker could use one of these weak certificates to impersonate the legitimate owners,” Mozilla's statement warned. “This could deceive users into trusting websites or signed software appearing to originate from these owners, but actually containing malicious content or software.”

The 22 certificates belonged to a “mix of Malaysian government websites and internal systems.”

Digicert Malaysia's banishment is effective Tuesday. It's not clear if that means the certificates are susceptible to abuse until them. Digicert Malaysia has no affiliation to Digicert Inc. based in Utah. ®

Secure remote control for conventional and virtual desktops

More from The Register

next story
You really need to do some tech support for Aunty Agnes
Free anti-virus software, expires, stops updating and p0wns the world
USB coding anarchy: Consider all sticks licked
Thumb drive design ruled by almighty buck
Attack reveals 81 percent of Tor users but admins call for calm
Cisco Netflow a handy tool for cheapskate attackers
Privacy bods offer GOV SPY VICTIMS a FREE SPYWARE SNIFFER
Looks for gov malware that evades most antivirus
Patch NOW! Microsoft slings emergency bug fix at Windows admins
Vulnerability promotes lusers to domain overlords ... oops
Oi, Europe! Tell US feds to GTFO of our servers, say Microsoft and pals
By writing a really angry letter about how it's harming our cloud business, ta
prev story

Whitepapers

Why and how to choose the right cloud vendor
The benefits of cloud-based storage in your processes. Eliminate onsite, disk-based backup and archiving in favor of cloud-based data protection.
A strategic approach to identity relationship management
ForgeRock commissioned Forrester to evaluate companies’ IAM practices and requirements when it comes to customer-facing scenarios versus employee-facing ones.
Reg Reader Research: SaaS based Email and Office Productivity Tools
Read this Reg reader report which provides advice and guidance for SMBs towards the use of SaaS based email and Office productivity tools.
Managing SSL certificates with ease
The lack of operational efficiencies and compliance pitfalls associated with poor SSL certificate management, and how the right SSL certificate management tool can help.
Intelligent flash storage arrays
Tegile Intelligent Storage Arrays with IntelliFlash helps IT boost storage utilization and effciency while delivering unmatched storage savings and performance.