[cabfpub] CA/Browser Forum mentioned in SANS newsletter

[Rick Andrews]

This is from the latest edition of the SANS NewsBites email. Please read the editor's note.

--Companies Revoke Trust in Unauthorized Google Digital Certificates (January 3, 2013) Google, Microsoft, and Mozilla have revoked (trust) for two digital certificates that were released by a Turkish certificate authority (CA).
The certificates were issued by an intermediate certificate authority that links back to TURKTRUST, which has acknowledged that in August 2011, it inadvertently issued two intermediate CA certificates to organizations that should have received regular SSL certificates. The certificates are being used in active phishing attacks.
http://www.computerworld.com/s/article/9235218/Google_finds_unauthorized_google.com_domain_certificate_scrambles_to_fix?taxonomyId=17
http://krebsonsecurity.com/2013/01/turkish-registrar-enabled-phishers-to-spoof-google/
http://www.darkreading.com/authentication/167901072/security/attacks-breaches/240145512/phony-google-digital-certificate-blocked-by-browser-vendors.html
[Editor's Note (Pescatore): The CA/Browser Forum seemed to make little progress (and actually lost members due to intellectual property issues) in 2012 in improving the sorry state of SSL certificate issuance. They met in December; I hope their 2013 New Year's Resolution was a much more aggressive approach this year.
(Shpantzer): A non-technical article about SSL trust and the Turkish CA, including the interesting idea that the browser companies are where the rubber meets the road:
http://erratasec.blogspot.com/2013/01/notes-on-turktrust-fiasco.html ]

-Rick

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.cabforum.org/pipermail/public/attachments/20130104/d6698c1c/attachment-0003.html>