Trust it or not, but rather as per Google's security group, NIC (India's National Informatics Center) have been issuing corrupt and fake SSL certificates. It has come to see there that NIC has issued a few unapproved SSL certificates to different Google domains. These unapproved authentications can be utilized to feign and imagine as genuine Google site on various servers and can put client's data in danger. With the utilization of such fake SSL certificate, it is anything but difficult to keep an eye on or tinker with client's encrypted communication.
The significant concern kicks in when the guarantor is holding various halfway CA certificates that are trusted by India CCA and also by some western organizations. Albeit no proof of Windows utilizing these fake SSL certificates has come up until now, in any case, an examination is continuous to discover if there are any. This worry was conveyed to Indian offices and Microsoft because of which all phony SSL certificates were withdrawn within a few days.
Required steps were taken by authorities to protect user’s information. Not only this, but India CCA is investigating the issue to find the root cause as it happened earlier too.
Google Logging System
Google engineers have thought of logging system that together CAs (ones that are trusted) and CAs endeavoring to construct its goodwill. They have figured out how to issue a rundown of these CA's on an open stage and indicated those that are never again trusted by browsers.
Fake Certificate Security Issues
SSL/TLS (Security Socket Layer/ Transport Layer Security) encryption systems are badly hit by this dodgy SSL certificate, which was used to secure https:// connection. Various issues that have been raised so far are listed below:
• A warning was issued by Microsoft over ‘improper issued’ SSL certificate which could have resulted in a phishing attack.
• Apple also got alerted about the critical SSL flaw in Mac OS and iOS.
• Google has warned CNNIC, an intermediate certificate authority, about the issuing of unauthorized digital certificates.
Certificate Transparency
Google accepts that it is a serious breach of the CA system and such incidents indicate that Google’s Certificate Transparency efforts are critical for protecting the security of certificates in the future. Certificate transparency will help in:
The significant concern kicks in when the guarantor is holding various halfway CA certificates that are trusted by India CCA and also by some western organizations. Albeit no proof of Windows utilizing these fake SSL certificates has come up until now, in any case, an examination is continuous to discover if there are any. This worry was conveyed to Indian offices and Microsoft because of which all phony SSL certificates were withdrawn within a few days.
Required steps were taken by authorities to protect user’s information. Not only this, but India CCA is investigating the issue to find the root cause as it happened earlier too.
Google Logging System
Google engineers have thought of logging system that together CAs (ones that are trusted) and CAs endeavoring to construct its goodwill. They have figured out how to issue a rundown of these CA's on an open stage and indicated those that are never again trusted by browsers.
Fake Certificate Security Issues
SSL/TLS (Security Socket Layer/ Transport Layer Security) encryption systems are badly hit by this dodgy SSL certificate, which was used to secure https:// connection. Various issues that have been raised so far are listed below:
• A warning was issued by Microsoft over ‘improper issued’ SSL certificate which could have resulted in a phishing attack.
• Apple also got alerted about the critical SSL flaw in Mac OS and iOS.
• Google has warned CNNIC, an intermediate certificate authority, about the issuing of unauthorized digital certificates.
Certificate Transparency
Google accepts that it is a serious breach of the CA system and such incidents indicate that Google’s Certificate Transparency efforts are critical for protecting the security of certificates in the future. Certificate transparency will help in:
- Eliminating security flaws as it will provide an open framework to monitor and audit SSL certificate in near real time.
- Detect fake SSLs.
- Identifying CAs attempt to issue unauthorized SSL certificates
- Pinning public key can specify authorized SSL certificates.
- Issuing authorities as well as can reject fake dodge SSL certificates.
No comments:
Post a Comment