Close
  • Latest News
  • Big Data and Analytics
  • Cloud
  • Networking
  • Cybersecurity
  • Applications
  • IT Management
  • Storage
  • Sponsored
  • Mobile
  • Small Business
  • Development
  • Database
  • Servers
  • Android
  • Apple
  • Innovation
  • Blogs
  • PC Hardware
  • Reviews
  • Search Engines
  • Virtualization
Read Down
Sign in
Close
Welcome!Log into your account
Forgot your password?
Read Down
Password recovery
Recover your password
Close
Search
Menu
Search
  • Latest News
  • Big Data and Analytics
  • Cloud
  • Networking
  • Cybersecurity
  • Applications
  • IT Management
  • Storage
  • Sponsored
  • Mobile
  • Small Business
  • Development
  • Database
  • Servers
  • Android
  • Apple
  • Innovation
  • Blogs
  • PC Hardware
  • Reviews
  • Search Engines
  • Virtualization
More
    Home Applications
    • Applications
    • Cybersecurity
    • IT Management
    • Storage

    Google Shoring Up SSL Certificates After Comodo Attack

    By
    Clint Boulton
    -
    April 4, 2011
    Share
    Facebook
    Twitter
    Linkedin

      Google is working on two security projects to improve the public key infrastructure, which was rocked by the Comodo digital certificate spoofing incident late last month.

      A lone hacker infiltrated Comodo Security’s root authority system, logging in and issuing digital certificates to Websites owned by Microsoft, Google, Yahoo, Skype and Mozilla.

      The attacker obtained the user name and password of a Comodo trusted partner in Southern Europe who was authorized to perform primary validation of certificate requests. The certificates were revoked immediately and Comodo has not noticed any attempts to use the certificates.

      Google, which upgraded its Chrome Web browser with two reissued and blacklisted SSL (Secure Sockets Layer) certificates to protect against the Comodo attack, launched the Google Certificate Catalog and the DNS-based Authentication of Named Entities (DANE) Working Group at the Internet Engineering Task Force (IETF) April 1.

      The Google Certificate Catalog is a database of all of the SSL certificates Google’s Web crawlers record in the DNS for the company’s search engine and Web services.

      In order for the SHA-1 hash of a certificate to appear in Google’s database, it must be correctly signed and have the domain name that matches the one used to retrieve the certificate.

      If a certificate doesn’t appear in Google’s database, then there may be something suspicious about that certificate, even if it is correctly signed and has a matching domain name.

      Google said it will offer its Certificates Catalog database freely for anyone to use.

      Google’s second SSL-securing project, the DANE Working Group at the IETF, is intended to allow domain operators to publish information about SSL certificates used on their hosts.

      “It should be possible, using DANE DNS records, to specify particular certificates which are valid, or CAs that are allowed to sign certificates for those hosts,” said Google security team member Ben Laurie. “If a certificate is seen that isn’t consistent with the DANE records, it should be treated with suspicion.”

      Laurie noted that while the Google Certificate Catalog and DANE project rely on the relatively insecure DNA, the company is working on DNSSEC, which encrypts DNS records to shield them from the type of forgery and modification Comodo attack employed. DANE requires every domain to be able to use DNSSEC.

      Google is also figuring out how to use DNSSEC for the Certificate Catalog before the DNSSEC infrastructure is ready.

      Clint Boulton

      MOST POPULAR ARTICLES

      Android

      Samsung Galaxy XCover Pro: Durability for Tough...

      Chris Preimesberger - December 5, 2020 0
      Have you ever dropped your phone, winced and felt the pain as it hit the sidewalk? Either the screen splintered like a windshield being...
      Read more
      Cloud

      Why Data Security Will Face Even Harsher...

      Chris Preimesberger - December 1, 2020 0
      Who would know more about details of the hacking process than an actual former career hacker? And who wants to understand all they can...
      Read more
      Cybersecurity

      How Veritas Is Shining a Light Into...

      eWEEK EDITORS - September 25, 2020 0
      Protecting data has always been one of the most important tasks in all of IT, yet as more companies become data companies at the...
      Read more
      Big Data and Analytics

      How NVIDIA A100 Station Brings Data Center...

      Zeus Kerravala - November 18, 2020 0
      There’s little debate that graphics processor unit manufacturer NVIDIA is the de facto standard when it comes to providing silicon to power machine learning...
      Read more
      Apple

      Why iPhone 12 Pro Makes Sense for...

      Wayne Rash - November 26, 2020 0
      If you’ve been watching the Apple commercials for the past three weeks, you already know what the company thinks will happen if you buy...
      Read more

      eWeek has the latest technology news and analysis, buying guides, and product reviews for IT professionals and technology buyers. The site’s focus is on innovative solutions and covering in-depth technical content. eWeek stays on the cutting edge of technology news and IT trends through interviews and expert analysis. Gain insight from top innovators and thought leaders in the fields of IT, business, enterprise software, startups, and more.

      Facebook
      Linkedin
      RSS
      Twitter
      Youtube

      Advertisers

      Advertise with TechnologyAdvice on eWeek and our other IT-focused platforms.

      Advertise with Us

      Menu

      • About eWeek
      • Subscribe to our Newsletter
      • Latest News

      Our Brands

      • Privacy Policy
      • Terms
      • About
      • Contact
      • Advertise
      • Sitemap
      • California – Do Not Sell My Information

      Property of TechnologyAdvice.
      © 2021 TechnologyAdvice. All Rights Reserved

      Advertiser Disclosure: Some of the products that appear on this site are from companies from which TechnologyAdvice receives compensation. This compensation may impact how and where products appear on this site including, for example, the order in which they appear. TechnologyAdvice does not include all companies or all types of products available in the marketplace.

      ×