Microsoft issues emergency update vs. fake SSL certificates

Microsoft over the weekend issued an emergency update for its Windows operating system and Windows Phone 8 and 8.1 to protect against rogue SSL (secure sockets layer) certificates.

In an advisory, Microsoft said it is aware of "improperly issued SSL certificates" that could be used to perform phishing or man-in-the-middle attacks.

"The subordinate CA (certifying authority) has been misused to issue SSL certificates for multiple sites, including Google web properties. These SSL certificates could be used to spoof content, perform phishing attacks, or perform man-in-the-middle attacks against web properties. The subordinate CAs may also have been used to issue certificates for other, currently unknown sites, which could be subject to similar attacks," it said.

Microsoft said it is updating the Certificate Trust list for all supported versions of Microsoft Windows.

It also said an automatic updater of revoked certificates is in supported editions of Windows 8, 8.1, RT, RT 8.1, Server 2012, and 2012 R2, as well as WP 8 and 8.1.

Microsoft said the improperly issued SSL certificates were from the National Informatics Center (NIC), which operates subordinate CAs under root CAs operated by the Government of India Controller of Certifying Authorities (CCA).

Such CAs are present in the Trusted Root Certification Authorities Store. — Joel Locsin /LBG, GMA News