Global Security Watch > Fraudulent *.google.com Certificate at Mozilla Security Blog

[Mozilla Security Blog] Not quite: Mozilla (and Google, and Debian…) are killing a CA for issuing a fraudulent certificate (lack of security), failing to detect and revoke the fraudulent cert in their db until it was discovered in the wild (lack of audit) and most importantly failing to provide any detail on what the hell happened (lack of trust).

Previous [Previous] Microsoft Releases Security Advisory 2607712 - MSRC - Site ...

Next [Next] Reawakening Virtues: Social Security and The Virtue of Saving ...

Some related posts from Technorati and Google.

[OFW Magazine] Rogue Google web cert prompts Firefox, Chrome security update ...: Mozilla, which makes the open-source Firefox browser, said the questioned certificate has since been revoked by its issuer, DigiNotar.

[groovyPost] Security Alert: DigiNotar Issues Fraudulent Google.com Certificate ...: The powers that be have already leapt into action, and the certificate has been added to the certificate revocation list (CRL). This means that if you attempt to browse one of these phony redirected sites, you should be alerted that something is afoot.

[LIVE HACKING] Fraudulent Google.com Digital Certificate in the Wild | LIVE HACKING: It is likely that others like Apple and Mozilla will also block this certificate in the near future. This isn't the firs time that a fake certificate for Google.com has been issued by a certificate authority.

[Naked Security - Sophos] Falsely issued Google SSL certificate in the wild for ... - Naked Security: I presume this is because DigiNotar has not explained how the Google certificate was signed and to prevent further abuse. This could cause issues for websites who have purchased certificates from DigiNotar.

[Inter5.Org Research] Inter5.Org Research » Fraudulent *.google.com certificate issued: The Mozilla Security Blog carries an advisory that DigiNotar has revoked a fake digital certificate it issued for Google's domain. “Users on a compromised network could be directed to sites using a fraudulent certificate and .

[Sun Country's Weblog] Fraudulent *.google.com Certificate « Sun Country's Weblog: https://blog.mozilla.com/security/2011/08/29/fraudulent-google-com-certificate/ Includes clean up instructions. Using Google Tasks API and OAuth 2.0 on...

[news4geeks.net] Hackers acquire Google certificate, could hijack Gmail accounts ...: Security researcher and Tor developer Jacob Applebaum confirmed that the certificate was valid in an email answer to Computerworld questions, as did noted SSL researcher Moxie Marlinspike on Twitter. "Yep, just verified the signature, that pastebin *.google.com certificate is real," said Marlinspike.

[Manmade Mag RSS Feed] Fraudulent Google credential found in the wild | ManmadeMag: Security researchers have discovered a counterfeit web certificate for Google.com circulating on the internet that gives attackers the encryption keys needed to impersonate Gmail and virtually every other digitally signed Google property. slashdot.org: An anonymous reader writes "A blog post published by Mozilla community contributor Tyler Downer claims the Mozilla Triage QA process is broken, and he believes that the rapid release implementation does not work .

[Analysing all aspects of modern Security] Fraudulent *.google.com ... - Analysing all aspects of modern Security: About Mozilla Security … We encourage all users to keep their software up-to-date by regularly applying security updates.

[Mozilla Security Blog] Firefox Blocking Fraudulent Certificates at Mozilla Security Blog: Who asked Mozilla to keep the fact that a CA (which Mozilla had configured users’ web browsers to trust) had issued fraudulent certificates secret from the intended victims, and why did the Mozilla Foundation and its employees choose to aid ”˜cyber-terrorists’ by agreeing to keep the attack secret?

Reflected tags on Technorati: Blog, ,