Hackers stole Google SSL certificate, Dutch firm admits

Chrome and Firefox face updates, Microsoft blacklists firm’s certs in Windows 7 and Vista, but not XP

Computerworld – The Dutch company that issued a rogue digital certificate for all Google Internet domains said today that its network had been hacked last month Microsoft 70-640 Training .”

According to Google, users of Chrome 13 and newer were protected against the rogue certificate because the browser has Google’s legitimate certificates, and only Google’s, hard-coded into it.

 

Best Microsoft MCTS Training – Microsoft MCITP Certification at Certkingdom.com

Yesterday, Mozilla promised that it would update both the desktop and Android editions of Firefox to revoke all DigiNotar certificates because “the extent of the mis-issuance is not clear.”

Microsoft also weighed in with a security advisory of its own that announced it had nuked all DigiNotar certificates by adding the Dutch company’s root to its list of banned certificates.

Windows Vista, Windows 7, Server 2008 and 2008 R2 users are now protected from attacks using any DigiNotar certificate, said Microsoft, but Windows XP and Server 2003 users are not. “Microsoft will release a future update to address this issue for all supported editions of Windows XP and Windows Server 2003,” the advisory read.

XP still accounts for the largest chunk of Windows users, according to metrics vendor Net Applications, which measured the decade-old operating system’s usage share at just under 50% last month.

Other browsers, such as Safari, will likely follow suit, said Chet Wisniewski, a security researcher with U.K.-based Sophos, as soon as Apple adds the DigiNotar root certificate to Mac OS X’s blacklist Microsoft Free MCTS Training and MCTS Online Training.

“But Apple has a bad track record on this,” said Wisniewski today, noting that Apple took three weeks last spring to update Safari after the Comodo hack disclosure.