Major Browsers Support SSL-Free Service Let's Encrypt

A new certificate authority (CA) which aims to encrypt all web traffic on the Internet and therefore will issue free SSL certificates is now supported by all major browsers, as announced the initiators of Let's Encrypt.

With an SSL certificate, websites can encrypt the traffic to and from visitors and identify themselves in front of visitors. Let's Encrypt is an initiative of the Internet Security Research Group (ISRG) and is supported by Mozilla, Akamai, Cisco, the American civil rights movement EFF and various other parties. According to the initiators, there are already parties that offer free certificates for websites, but the installation is still a tricky process, which is a fully encrypted web stands in the way.

Let's therefore Encrypt will automate the installation and issue of certificates. For this purpose has been developed a programming interface (API), as well as client software that makes use of this API. Administrators can use this client software on their own Web server to automatically install a certificate and configure their server so that henceforth use HTTPS.

To avoid warnings in the browser must Let's Encrypt or by the browser as a valid certificate authority are recognized.Something which is now achieved through the intermediate certificates of Let's Encrypt by IdenTrust be signed. All browsers accept IdenTrust and thereby also the certificates of Let's Encrypt. "This is a major milestone because it means that visitors to websites that use Let's Encrypt certificates without special modifications have a secure browsing experience," said Josh Aas of ISRG.

Chrome Gives Thousands Of EV SSL Certificates Wrong Again

Extended Validation (EV) SSL certificates, the browser address bar green color users should provide more security when visiting an HTTPS site, but thousands of these certificates are not displayed correctly in Google Chrome. Reported Internet company Netcraft.

EV SSL Certificates serve as regular SSL certificates as well as identification of the website and encrypt the traffic between web site and visitors. Unlike normal SSL certificates they issued after a rigorous control and are more expensive. However, Google requires that contain EV SSL Certificates "Certificate Transparency 'information.

Certificate Transparency is a framework developed by Google for monitoring of SSL certificates in real time. This makes it possible to discover SSL certificates issued in error, or are secured via a burglary at a Certificate Authority. Many Certificate Authorities, however, sell EV SSL certificates without this information, making them appear in Google Chrome as a normal SSL certificate.

According to Netcraft involves more than 10,000 EV SSL certificates, or 5% of all EV SSL certificates issued. For websites a costly miss. A normal SSL certificate is already available for $ 10 per year, while an EV SSL certificate can cost $ 1,000 per year.

Researcher: Root Certificates Added Quietly Windows

Microsoft has quietly 18 new root certificates to Windows without notice has been here somewhere. So says a researcher with the alias " Hexatomium ". Root Certificates determine which SSL certificates are trusted by the operating system.

It is therefore important to know which organizations and certificate authority's root certificate is added. The researcher reports that he is the new root certificates through the RCC-auditing tool has discovered. Through the program, users can control which root certificates are heard in the Windows root CA to store and which have been added quietly.

In addition to the SHA1 hash of the license and the name of the associated certificate authority is no additional information is available. On Hacker News lets a user know that the certificate authority named RXC C2 is actually Cisco. Remarkably Cisco sets its own documentation Cisco RXC certificate policy ( pdf ) which certificate authorities should always use meaningful names. Feather in the list of additional root certificates include certificates of Swedish, Tunisian and Indian authorities.

PrivDog: Only 57,000 Users At Risk

Adware PrivDog developer has released a security update after there was a vulnerability in the software detects allowing users targeted by Man-in-the-middle attack could be. In total, this "only" 57,000 users have run risk, says the developer. However, this is not the PrivDog software that comes with the programs of security provider and Certificate Authority Comodo. PrivDog makes adware that SSL connections are intercepted and software advertisements of "reliable partners" can inject.

Researchers discovered that PrivDog install a root certificate and thus intercepted each SSL certificate of websites using a self-signed certificate, even when it comes to SSL certificates that are not valid. As a result, the browser will accept HTTPS each certificate that is, whether by a Certificate Authority (CA) is signed or not. For example, users of public Wi-Fi networks could thus be the victim of a Man-in-the-middle attack. The vulnerability is present in versions 3.0.96.0 and 3.0.97.0 PrivDog.

These versions intercept SSL traffic and were downloaded from the website of PrivDog. Contrary to what was thought yesterday is Comodo Internet Security with an earlier version of PrivDog bundled working with a browser extension and thus is not directly vulnerable to this threat. That says researcher Hanno Boeck in addition to his research. PrivDog also confirms that the PrivDogplug-in that comes with the Comodo Browsers problem has not.

Globally, more than 57,000 people have downloaded the vulnerable PrivDog versions. According adware developer made ​​sure that the problem with some sites that use a self-signed certificate no certificate warning was given. However, the encryption was offered to the end user would remain intact, says PrivDog. Tonight there is rolled out an automatic update that fixes the problem by users.

Privdog Software Worse Than Superfish Adware

After computer manufacturer Lenovo appears to combine security provider Comodo adware with its own software SSL traffic intercepted, only the impact is much greater than with Lenovo's Superfish was. That says researcher Hanno Bock . Comodo is known software like Comodo Internet Security and Comodo Dragon Browser. With some of the programs PrivDog-adware is included.

Like Superfish intercepted PrivDog HTTPS traffic to inject ads from "reliable partners". Late last year, the ability to filter HTTPS traffic was already on the forum Comodo discussed . The software is after Superfish scandal now in the spotlight. A user decided because Superfish a test page to do, which warns users if their HTTPS connection is manipulated. Although the user is not used Superfish he got a warning. Then this user reported on Hacker News that the possible was the PrivDog-adware.

PrivDog not have the same vulnerability as Superfish, using a weak certificate and a weak password to protect the private key of the certificate, but one which is many times as possible according to Bock. Although Superfish same certificate and key used for all installations, PrivDog makes for each installation a separate key and certificate. The biggest problem is that each certificate PrivDog intercepted and replaced by a self-signed certificate.

It is also about certificates that were not valid in the first place. As a result, the browser will accept HTTPS each certificate that is, whether by a Certificate Authority (CA) is signed or not. "We are still trying to find out the details, but it looks bad," Bock says. The researcher also finds it strange that Comodo, which is itself a CA bundle adware with their own software. "If the CA would be their job to protect HTTPS, not break," the researcher concludes.

Meanwhile warns also the CERT Coordination Center (CERT / CC) at Carnegie Mellon University for PrivDog. An attacker could according to the CERT / CC HTTPS sites spoof and intercept HTTPS traffic without users see a certificate warning.Users will also be advised to remove PrivDog. This would also be the root certificate in question to be removed.

US-CERT writes: "Adtrustmedia PrivDog is promoted by the Comodo Group, which is an organization that offers SSL certificates and authentication solutions." A variant of PrivDog that is not affected by this issue is shipped with products produced by Comodo (see below). This makes this case especially interesting because Comodo itself is a certificate authority (they had issues before). As ACLU technologist Christopher Soghoian points out on Twitter the founder of PrivDog is the CEO of Comodo. (See this blog post.)

Update/Clarification: The dangerous TLS interception behaviour is part of the latest version of PrivDog 3.0.96.0, which can be downloaded from the PrivDog webpage. Comodo Internet Security bundles an earlier version of PrivDog that works with a browser extension, so it is not directly vulnerable to this threat. According to online sources PrivDog 3.0.96.0 was released in December 2014 and changed the TLS interception technology.

Update 2: Privdog published an Advisory.