Believe it or not, but according to Google’s security team, NIC (India’s National Informatics Center) have been issuing unprincipled and dodgy SSL certificates. It has come to notice their that NIC has issued several unauthorized SSL certificates to various Google domains. These unauthorized certificates can be used to bluff and pretend as legit Google website on different servers and can put user’s information at risk. With the use of such dodgy SSL certificate, it is easy to spy on or fiddle with user’s encrypted communication.
The thing that is most disturbing about this scam is that ‘India CCA’ (Indian Controller of Certifying Authorities) is incorporated with Microsoft Root Store because of which it is trusted by a majority of programs such as Internet Explorer and chrome. Windows is the most common OS used by a large number of people as it supports a majority of programs. Users using Chrome on other OS than Windows like Android, IOS etc remains unaffected. Firefox also remains unmoved as it uses its own root store; therefore, SSL certificate is not required. There is a relief to other operating systems other than windows as there are no other root stores that incorporate with India CCA certificates.
The major concern kicks in when the issuer is holding a number of intermediate CA certificates that are trusted by India CCA as well as by some western companies. Although no evidence of Windows using these fake certificates has come up so far, however, an investigation is ongoing to find if there are any. This concern was brought to Indian agencies and Microsoft as a result of which all fake SSL certificates were withdrawn within few days. Required steps were taken by authorities to protect user’s information. Not only this, but India CCA is investigating the issue to find the root cause as it happened earlier too.
Fake Certificate Security Issues
SSL/TLS (Security Socket Layer/ Transport Layer Security) encryption systems are badly hit by this dodgy SSL certificate, which was used to secure https:// connection. Various issues that have been raised so far are listed below:
• A warning was issued by Microsoft over ‘improper issued’ SSL certificate which could have resulted in a phishing attack.
• Apple also got alerted about the critical SSL flaw in Mac OS and iOS
• Google has warned CNNIC, an intermediate certificate authority, about the issuing of unauthorized digital certificates.
Certificate Transparency
Google accepts that it is a serious breach of CA system and such incidents indicate that Google’s Certificate Transparency efforts are critical for protecting the security of certificates in the future. Certificate transparency will help in:
-
Eliminating security flaws as it will provide an open framework to monitor and audit SSL certificate in near real time.
-
Detect fake SSLs.
-
Identifying CAs attempt to issue unauthorized SSL certificates
-
Pinning public key can specify authorized SSL certificates.
-
Issuing authorities as well as can reject fake dodge SSL certificates.
Google Logging System
Google engineers have come up with logging system that brings together CAs (ones that are trusted) and CAs working hard to build its goodwill. They have managed to issue a list of these CA’s on a public platform and specified those that are no longer trusted by browsers. The main mission of this system is to:
• Protect its user from fake and illegally issued SSL certificates
• Provide public record information of the certificates issued for specific domains.