Google, Mozilla Considering Limiting Certificate Validity to 60 Months

In the wake of a parade of problems with certificate authorities and attackers using stolen digital certificates, both Google and Mozilla are poised to enforce new rules in their browsers for how long end-entity certificates should be trusted.

The changes will begin taking effect at the beginning of 2014, at least in Google Chrome, and will result in the browser no longer trusting any certificate that’s more than 60 months old. Mozilla also is considering a similar move for its Firefox browser. The change is the result of the adoption of the CA/Browser Forum Baseline Requirements, a document that lays out a long list of requirements for the operation of a certificate authority and issuance of certificates. The requirements specify that CAs should not issue any certificates with a validity period longer than five years.

In a message Aug. 19 on the CA/B Forum mailing list, a Google employee said that the company is planning to comply with this rule in Chrome and Chrome OS beginning in 2014 with Developer and Beta channel builds, eventually moving to the Stable channel sometime during the first quarter.

“These checks, which will be landed into the Chromium repository in the beginning of 2014, will reject as invalid any and all certificates that have been issued after the Baseline Requirements Effective Date of 2012-07-1 and which have a validity period exceeding the specified maximum of 60 months. Per the Chromium release cycle, these changes can be expected to be seen in a Chrome Stable release within 1Q 2014, after first appearing Dev and Beta releases,” Ryan Sleevi of Google said in the message.

“Our view is that such certificates are non-compliant with the Baseline Requirements. Chrome and Chromium will no longer be considering such certificates as valid for the many reasons that have been discussed previously on this list.”

Mozilla developers also have begun the process of making the same change to Firefox, creating an entry in its Bugzilla change system.

Certificate authorities have had a rough go of it for the last couple of years, beginning with the attacks on Comodo and DigiNotar and following with the use of stolen digital certificates in a number of pieces of malware recently. One of the results of the attacks on CAs is that the browser vendors end up being the ones who have to clean up the mess, removing trust for compromised certificates and helping to make sure users aren’t harmed by attackers using the bad certificates. The new restriction on the validity period of certificates won’t solve those problems, but it is a move to help limit the practice of continuously reissuing certificates once they’ve been approved.

Courtesy By Dennis Fisher

Google Blocks High Profile Sites After Advertising Provider NetSeer is Hacked

Google Chrome users, among others, couldn't access some of the most popular Web sites Monday after an advertising network's corporate Web site was injected with malware. But, according to the ad company's chief executive, those sites were safe.

Those who called up sites such as The Huffington Post, New York Times, Los Angeles Times, Washington Post and many other media sites, among others, were greeted with a warning that the sites contained malware. An example of a warning: "Content from cm.netseer.com, a known malware distributor, has been inserted into this web page. Visiting this page now is very likely to infect your computer with malware." Another warned that the virus peddler was images.buddytv.com.

In both cases, the culprit turned out to be the Santa Clara, Calif. startup Netseer, an advertising provider with a considerable global digital footprint.

"Early this morning we received alerts that our 3rd party hosted corporate website (netseer.com) was hacked and infected with malware. Consequently, Google added our domain to the list of malware affected websites and Chrome and some other browsers started blocking any sites that had ‘netseer.com’ code," according to a letter from the CEO on the company's homepage.  

 

"Our ad serving infrastructure is completely different from the corporate website but shares the same domain (netseer.com). So although the malware never impacted the ad serving all our ad serving partners saw Chrome and other browsers flagging malware warnings to users. To reiterate, the malware was never served into ad serving stream and the browser behavior was completely due to ad serving and the corporate website sharing the same domain name."

The company said Google had removed the site from its malware impacted site list by 9:30 a.m. Pacific time, but users continued to report blocked sites hours throughtout the day.

According to various news reports, Internet Explorer users had no trouble accessing the impacted sites with that browser.

Courtesy by Anne Saita