Fraudulent Digital Certificates

some major borwsers have issued a relased because DIGINOTAR the former Certificate Authority whihc managed to issue more than 500 bogus digital certificates in the name of majore web service providers mainly

Facebook
Twitter
Microsoft
Google

even in the name of some intelligence agencies.

In recent update from MoZilla Firefox it have blocked any certificate signed by DigitNotar.

Microsoft have also released an update 2607712 permanently moving all five DigiNotar's root certificates to the Certificate Revokation List whihc provides protection to all Windows versions.



DigiNotar Root CA

DigiNotar Root CA G2

DigiNotar PKIoverheid CA Overheid

DigiNotar PKIoverheid CA Organisatie - G2

DigiNotar PKIoverheid CA Overheid en Bedrijven

Fraudulent Digital Certificates

Hi every one As all of you must have seen some alerts to download latest
update on your computers because Microsoft has issued a Security Advisory
warning that fraudulent digital certificates were issued by the Comodo
Certificate Authority. 

This would allow hackers to spoof very trusted and commonly visited
websites, including Google,Yahoo! Windows Live.

 


The advisory states how 9 certificates were fraudulently issued by

Comodo for the following names:

* login.live.com

* mail.google.com

* www.google.com

* login.yahoo.com (3 certificates)

* login.skype.com

* addons.mozilla.org

* "Global Trustee"



The major issue is that Comodo is a trusted root authority on all

default Windows and OS X installations. This means that an attacker could
easily masquerade a malicious website as one of the above with the HTTPS
authentication succeeding.



This kind of power would have any internet miscreant drooling over the
opportunity to construct phishing sites, perform man-in-the-middle attacks,
and any other content-spoofing attack that can be dreamed up.


Trust is transitively passed down the certificate chain, where as compromise at
any level breaks the chain completely -- and every chain has its weakest link.


The suggestion from experts are to enable certificate revocation checking in your browser