IDG News Service - Google has taken steps to close potential security holes created by a fraudulent certificate for its google.com domain, discovered in late December.
The certificate was erroneously issued by an intermediate certificate authority (CA) linking back to TurkTrust, a Turkish CA.
"Intermediate CA certificates carry the full authority of the CA, so anyone who has one can use it to create a certificate for any website they wish to impersonate," wrote Adam Langley, a Google software engineer, in a blog post Thursday.
Google detected the existence of the certificate on Christmas Eve, updated its Chrome browser the next day to block the intermediate CA and notified TurkTrust and other browser makers about the problem.
TurkTrust then conducted its own investigation and found out that in August 2011 it had mistakenly issued two intermediate CA certificates to organizations that should have instead received regular SSL certificates, according to Langley.
Google then updated Chrome again to block the second CA certificate and again notified other browser vendors.
"Our actions addressed the immediate problem for our users. Given the severity of the situation, we will update Chrome again in January to no longer indicate Extended Validation status for certificates issued by TurkTrust, though connections to TurkTrust-validated HTTPS servers may continue to be allowed," Langley wrote.
Google may take additional steps in reaction to this issue, he added.
A Google spokesman said via e-mail that although TurkTrust mistakenly issued two intermediate certificates, only one was used to generate an unauthorized certificate.
"We believe there was one case of the certificate being used internally on a company's network," the spokesman said.
The incident is "a really big deal," said Chester Wisniewski, a senior security advisor at Sophos, a security software vendor.
"Essentially what happened is that the certificate authority in Turkey gave the master keys to everybody's web browser to some random company by accident and it turned out it was later abused," he said.
Meanwhile, both Microsoft and Mozilla have issued their own alerts about the problem.
In a security advisory, Microsoft said it was aware of "active attacks" being carried out using the digital certificate.
"This fraudulent certificate could be used to spoof content, perform phishing attacks, or perform man-in-the-middle attacks against several Google web properties," the Microsoft alert said.
To protect Windows users, Microsoft has updated its Certificate Trust List (CTL) and is pushing out the new version to all supported releases of the OS.
Users whose systems are set up to receive automatic updates of revoked certificates don't need to do anything because their computers will be updated automatically. Other users are advised to implement this patch immediately.
In its blog post, Mozilla provided more information about the malicious use of the certificate, saying it was employed in a man-in-the-middle attack.
"We are also concerned that the private keys for these certificates were not kept as secure as would be expected for intermediate certificates," wrote Michael Coates, Mozilla's Director of Security Assurance, in the blog post.
Mozilla will update all supported versions of Firefox on Tuesday so that the browser will not accept the two fraudulent certificates.
