La magie de l'infrastructure de distribution x509, as usual :')

« In a major breach of public trust and confidence, the Chinese digital certificate authority China Internet Network Information Center (CNNIC) certified false credentials for numerous domains, including several owned by Google. The deliberate breach had the potential to seriously endanger vulnerable users, such as journalists communicating with sources. The breach was discovered by Google and published on its security blog on March 23. Despite this serious lapse, it appears CNNIC's authority will not be revoked, and that its credentials will continue to be trusted by almost all computers around the world.

[...]

Each CA also publishes its own documents called a certificate policy and/or certification practice statement (CP/CPS). In these, the CA describes what it will and won't do. CNNIC's CPS was controversial from the start. The practice statement noted that the CA "takes orders from the [Chinese] Ministry of Information Industry to conduct daily business."
[NDLR : sans surprise, ça a toujours été l'objet de cette AC. ]

[...]

Last week, many of those fears were realized. In violation of its certification practice statement, CNNIC delegated its certificate-signing power to Egyptian IT company MCS Holdings, according to the certificate chain, which Google published.
[ NDLR : donc maintenant, il ne s'agit plus de faire confiance à X AC dont on ne sait rien mais également à leurs X prestataires techniques... Joie. ]

[...]

The certificate could have been used to falsify credentials for any online communication. According to Google's analysis of its Certificate Transparency logs, MCS used it to do just that, falsifying certificates for several domains, including Gmail and Google's homepage, according to Microsoft security advisory. MCS said in a statement issued March 25 that it used the certificate in a system designed to intercept Internet traffic "for testing purposes."
[ NDLR : on est dans une région "à risque" (le printemps arabe n'est pas loin et la stabilité pas encore gagnée), on intercepte du trafic chiffré, on force le bypass de la phase d'authentification sur les clients (oui, l'usage d'un faux certificat pour berner l'auth, je nomme ça contournement) et on déchiffre le trafic... tout ça pour des tests... Mais bien sûr... ]

[...]

Google reported that MCS failed to use the required hardware security module. This breach could have allowed an attacker to gain access to MCS' certificate. With its certificate, attackers could have attempted to intercept any communication anywhere in the world, attacking anyone who relies on the security of the CA system. »
[ NDLR : comme dans l'histoire Lenovo... ]

Début avril : https://cpj.org/2015/04/google-revokes-authority-of-cnnic-after-breach-of-.php
« San Francisco, April 2, 2015--The Committee to Protect Journalists welcomes Google's plan to revoke the authority of root certificates belonging to China Internet Network Information Center (CNNIC) following CNNIC's major breach of the trust placed in them to underpin global Internet security. Mozilla also said it will not trust any CNNIC certificates dated after April 1, and is considering further action. »