Feeds

Web credential authority rebuked for 'poor' security

Digicert Malaysia banished from Chrome, IE, Firefox

Choosing a cloud hosting partner with confidence

Microsoft, Google, and Mozilla will banish yet another web authentication authority from their software after learning that it issued secure sockets layer certificates that could be used to attack people visiting Malaysian government websites.

Digicert Malaysia, an intermediate certificate authority that was certified by parent authority Entrust, issued 22 certificates with weak private keys and other serious deficiencies, the companies said. The lapses, which also included a failure to include revocation details and EKU, or extended key usage, designations, constituted a breach of obligations all CAs are required to follow to ensure the security of the SSL system.

“There is no indication that any certificates were issued fraudulently, however, these weak keys have allowed some of the certificates to be compromised,” Jerry Bryant, a spokesman in Microsoft's Trustworthy Computing group, wrote in a blog post. “The subordinate CA has clearly demonstrated poor CA security practices and Microsoft intends to revoke trust in the intermediate certificates.”

The public rebuke comes two months after software makers revoked the signing credentials of DigiNotar following revelations the Netherlands-based authority suffered a colossal security breach that allowed attackers to mint 531 bogus certificates for high-profile services. At least one of the counterfeits was exploited to spy on more than 300,000 Google Mail users in Iran.

In March, a security breach on a certificate reseller of rival CA Comodo resulted in the forgeries of credentials for many of the same domains, which in addition to Gmail, included Skype, Mozilla add-ons, and Microsoft update. Four months ago, another CA, Israel-based StartSSL, also said it was hacked, although the attackers were unable to obtain certificates that would allow them to spoof websites in a similar fashion. At least four other CAs have reported being compromised since June.

Entrust, the US-based CA whose imprimatur authorized Digicert Malaysia, said in its own blog post that it also planned to remove that trust. A separate advisory from Mozilla is here. This Chromium update indicates that Google is taking similar steps, and a spokesman confirmed the company also intend to revoke trust in the Malaysian CA.

The omissions of Digicert Malaysia appear to be a serious violation of CA security standards. Its use of 512-bit keys, for instance, stand in stark contrast to the minimum requirement that keys contain twice that length. What's more, the lack of revocation information makes it harder to recall Digicert Malaysia certificates if they're found to be flawed, and the failure to include EKU information allows them to be abused in ways that otherwise wouldn't be possible.

“An attacker could use one of these weak certificates to impersonate the legitimate owners,” Mozilla's statement warned. “This could deceive users into trusting websites or signed software appearing to originate from these owners, but actually containing malicious content or software.”

The 22 certificates belonged to a “mix of Malaysian government websites and internal systems.”

Digicert Malaysia's banishment is effective Tuesday. It's not clear if that means the certificates are susceptible to abuse until them. Digicert Malaysia has no affiliation to Digicert Inc. based in Utah. ®

Beginner's guide to SSL certificates

More from The Register

next story
Russian hackers exploit 'Sandworm' bug 'to spy on NATO, EU PCs'
Fix imminent from Microsoft for Vista, Server 2008, other stuff
Microsoft pulls another dodgy patch
Redmond makes a hash of hashing add-on
FYI: OS X Yosemite's Spotlight tells Apple EVERYTHING you're looking for
It's on by default – didn't you read the small print?
'LulzSec leader Aush0k' found to be naughty boy not worthy of jail
15 months home detention leaves egg on feds' faces as they grab for more power
Forget passwords, let's use SELFIES, says Obama's cyber tsar
Michael Daniel wants to kill passwords dead
FBI boss: We don't want a backdoor, we want the front door to phones
Claims it's what the Founding Fathers would have wanted – catching killers and pedos
Kill off SSL 3.0 NOW: HTTPS savaged by vicious POODLE
Pull it out ASAP, it is SWISS CHEESE
prev story

Whitepapers

Forging a new future with identity relationship management
Learn about ForgeRock's next generation IRM platform and how it is designed to empower CEOS's and enterprises to engage with consumers.
Cloud and hybrid-cloud data protection for VMware
Learn how quick and easy it is to configure backups and perform restores for VMware environments.
Three 1TB solid state scorchers up for grabs
Big SSDs can be expensive but think big and think free because you could be the lucky winner of one of three 1TB Samsung SSD 840 EVO drives that we’re giving away worth over £300 apiece.
Reg Reader Research: SaaS based Email and Office Productivity Tools
Read this Reg reader report which provides advice and guidance for SMBs towards the use of SaaS based email and Office productivity tools.
Security for virtualized datacentres
Legacy security solutions are inefficient due to the architectural differences between physical and virtual environments.