Skip to main contentSkip to navigationSkip to navigation
Funeral of Iran's leading dissident cleric, Grand Ayatollah Hossein Ali Montazeri
Security analysts have warned that attackers could have exploited a faked web certificate to eavesdrop on Iranian dissidents using Google sites such as Gmail. Photograph: Reuters
Security analysts have warned that attackers could have exploited a faked web certificate to eavesdrop on Iranian dissidents using Google sites such as Gmail. Photograph: Reuters

Rogue web certificate could have been used to attack Iran dissidents

This article is more than 12 years old
Flaw could have let attackers steal passwords and data from apparently secure connections to Google sites such as Gmail

Security researchers are warning a web certificate is being used that could let hackers steal passwords and data from apparently secure connections to Google sites such as Gmail.

Internet users in Iran are believed to be at particular risk from the rogue SSL certificate, which is used to digitally "sign" HTTPS connections to any google.com site and was issued by a Dutch company called DigiNotar on 10 July. In particular, dissidents who trust Google's systems for their security may have been targeted in the attack.

DigiNotar – which does not have any direct business relationship with Google – has not said who the certificate was issued to, but the effect would be that someone could think they were logged securely into a site and that their communication would be encrypted; but instead attackers controlling the network could eavesdrop on all their keystrokes, including passwords. This is known as a "man in the middle", or "MITM", attack.

The first person to have noticed the rogue certificate appears to be an Iranian user, who posted about it on a Google support forum, asking whether it was an MITM attack. The problem was observed on multiple internet service providers, leading to concerns the government there might be using it to monitor dissidents and steal login details.

The user also noted that connections to google.com seemed to take a longer path than connections to youtube.com, yahoo.com and bing.com. The certificate did not seem to be in constant use: "I see this fake certificate only 30 minutes or one hour per day maybe they just test how sniff their users!", wrote the discoverer.

Microsoft on Monday night removed the certificate from its list of allowed certificates with its browsers. That should mean users would get an "invalid certificate" warning if they try to log in to a Google site that presents the rogue certificate, in which case they should reject the connection.

The discovery marks the second time in five months that rogue SSL certificates have been discovered circulating in the wild. In March, hackers cracked the systems used by the web certification company RSA and created a number of new, valid certificates for Google and for six other domains through a certification company called Comodo. The rogue certificates were in use for eight days before being revoked from major browsers, and longer for email programs.

Both incidents have created growing concern among security researchers about the levels of trust that can be placed in SSL certification, which is used to create a "web of trust" in which certification companies can authorise multiple sites so that users can trust that their communications are untapped. The March hack against Comodo is thought to have been carried out by an Iranian team.

The key weakness in the web certification system is that any company authorised to issue certificates can issue one that almost every browser will trust as being valid against any web property. Thus a DigiNotar certificate for google.com would be trusted by almost every browser, even if a hacking attack meant it had been issued to someone who was not working for Google.

"How many more DigiNotar-issued fake certificates are out there that nobody has noticed?" said Mikko Hypponen, chief research officer at the Finnish security company F-Secure.

Users of the latest version of Google's Chrome browser would have been safe from the attack in the past month because it uses a system called "pinning", in which it rejects certificates from all but a limited number of companies, which does not include DigiNotar. However, the DigiNotar certificate was issued on 10 July, and the version of Chrome that would reject its certificate did not appear until 10 August, leaving a crucial window during which users have been vulnerable to attack.

The Electronic Frontier Foundation said: "The certificate authority system was created decades ago in an era when the biggest online security concern was thought to be protecting users from having their credit card numbers intercepted by petty criminals. Today, internet users rely on this system to protect their privacy against nation states. We doubt it can bear this burden."

The EFF says certification authorities "have been caught issuing fraudulent certificates in at least half a dozen high-profile cases in the past two years" but that the concern over the latest is that it might have been used to spy on any number of Iranian users.

More on this story

More on this story

  • Iran frees 100 political prisoners

  • Iranian activist missing after arrest

  • Iranian doctor murdered after examining rape victims, says his son

Most viewed

Most viewed