Google latest to shut out Chinese certificate authority for 'deception'

Following in Apple and Mozilla's footsteps, Google's Chrome web browser will no longer trust the Chinese company WoSign after its actions and "deception" allegedly "put the security and privacy of every web user at risk."

Following in Apple and Mozilla‘s footsteps, Google’s Chrome web browser will no longer trust the Chinese company WoSign after its actions and “deception” allegedly “put the security and privacy of every web user at risk.”

WoSign is a certificate authority, meaning it distributes digital certificates that authenticate secure connections to websites. In the transport layer security (TLS) system that underpins security on the web, a trusted third party authority like WoSign is meant to offer proof that your browser is visiting the website you mean it to. When you aim for your bank’s website, this is how the bank can authenticate its website and protect its communication with you.

A lengthy investigation by both Google and Mozilla was triggered when WoSign issued a TLS certificate for GitHub.com to a university employee with no connection to the site. The subsequent inquiry accuses WoSign of fraudulently using outdated and insecure certificates as well as buying another certificate authority, the Israel-based firm StartCom, and failing to disclose the purchase.

“It was rather surreal when I realized I had actual valid SSL/TLS certificates for the primary GitHub domains,” Stephen Schrauger wrote in an August blogpost that began the firestorm. “Https is supposed to prevent eavesdropping, yet with these keys, I could become a man-in-the-middle with relative ease.”

“Google has determined that two [certificate authorities], WoSign and StartCom, have not maintained the high standards expected of CAs and will no longer be trusted by Google Chrome, in accordance with our Root Certificate Policy,” Andrew Whalley from the Chrome Security team wrote.

The WoSign saga brings back memories of the DigiNotar hack in 2010. Using counterfeit certificates made possible by a breach, attackers fooled over 300,000 people with ties to Iran browsing websites — GMail and Yahoo most dangerously — with fraudulent certificates.

Mozilla and Google now distrust WoSign and StartCom certificates issued on Oct. 21 or later. Apple is taking similar actions, blocking new intermediate certificates from WoSign and StartCom. In the future, Google will distrust all WoSign and StartCom certificates completely.

“Any attempt by WoSign or StartCom to circumvent these controls will result in immediate and complete removal of trust,” Whalley explained.

Microsoft Edge and Opera have yet to take any action against WoSign. Neither company returned a request for comment.

Government

• FBI officials say AI is bolstering adversaries, emphasizing need to focus on cyber basics, patching

• Feds accuse China of ‘systematic’ distillation of U.S. AI models

• CIA’s Michael Ellis says cyber intelligence is changing how the agency operates

• Jail time for Maine child in 764 marks turning point in federal law enforcement

Technology

• FCC proposes public scorecard to rate telecoms on anti-robocall efforts

• Pegasus, NoviSpy variant spyware found on devices of Serbian activists

• Wyden seeks upgraded NSA security guidance on commercial VPN use

• The Collective Cyber Defense letter wrote your next vendor questionnaire

Threats

• Chinese espionage groups swarm to exploit triple-link chain of zero-days

• Microsoft discloses two actively exploited zero-days among 974 vulnerabilities

• Russian national extradited to US for alleged involvement in bank-account takeover scheme

• Attackers exploit zero-days in consistently besieged SonicWall product

Policy

• Whistleblower says USPS deploying new, ‘untested’ IT systems governing mail-in ballots

• ‘Watershed 250’ test program in Texas looks to private sector for water cybersecurity help

• Former sexual abuse victims say Grok used their images, videos to train deepfake capabilities

• Cyber threats nudge Trump to sign executive order on foreign equipment in U.S. energy infrastructure