January 16, 2017 By Larry Loeb 2 min read

GoDaddy recently discovered that almost 9,000 SSL certificates that it has issued since July 29, 2016, had to be revoked and reissued. A code bug that occurred during a service upgrade caused this SSL certificate security problem.

In July, GoDaddy changed its validation code. This change unintentionally allowed certain servers that were configured in a particular way to bypass GoDaddy’s authentication process, which is necessary to deliver an SSL certificate.

SSL Certificate Security Incident Reported

Wayne Thayer, GoDaddy’s general manager of security products, declared in an incident report that the company had fixed the problem.

“We are currently unaware of any malicious exploitation of this bug to procure a certificate for a domain that was not authorized,” he wrote. “The customer who discovered the bug revoked the certificate they obtained and subsequent certificates issued as the result of requests used for testing by Microsoft and GoDaddy have been revoked. Further, any certificate requests made for domains we flag as high-risk were also subjected to manual review, rather than being issued purely based on an invalid domain authorization.”

SecurityWeek noted that GoDaddy has identified 8,951 certificates that were issued without the proper domain validation. That would be about 2 percent of the total number of certificates issued between July 29, 2016, and Jan. 10, 2017. GoDaddy reported that the incident affected approximately 6,100 customers.

CA Inconsistency

Discussion on the Google board after Thayer’s incident report was published revolved around possible underlying operational inconsistency among certificate authorities (CA).

“As you will know, the method being used by GoDaddy here corresponds broadly to method 3.2.2.4.6 from ballot 169 — “Agreed-Upon Change to Website,” one user wrote. “Although this method is not currently in the BaselineRequirements due to it being part of ballot 182 and having a related IPR disclosure, at least one root store operator has suggested they are going to require strict adherence to the methods listed in that ballot by March 1.”

In other words, the exact implementation of a baseline requirement by a CA may vary from one CA to another. This points to a need for standardized approaches.

More from

CISA hit by hackers, key systems taken offline

3 min read - The Cybersecurity and Infrastructure Security Agency (CISA) — responsible for cybersecurity and infrastructure protection across all levels of the United States government — has been hacked.“About a month ago, CISA identified activity indicating the exploitation of vulnerabilities in Ivanti products the agency uses,” a CISA spokesperson announced.In late February, CISA had already issued a warning that cyber threat actors are exploiting previously identified vulnerabilities in Ivanti Connect Secure and Ivanti Policy Secure gateways. Ivanti Connect Secure is a widely deployed…

Cloud security evolution: Years of progress and challenges

7 min read - Over a decade since its advent, cloud computing continues to enable organizational agility through scalability, efficiency and resilience. As clients shift from early experiments to strategic workloads, persistent security gaps demand urgent attention even as providers expand infrastructure safeguards.The prevalence of cloud-native services has grown exponentially over the past decade, with cloud providers consistently introducing a multitude of new services at an impressive pace. Now, the contemporary cloud environment is not only larger but also more diverse. Unfortunately, that size…

PixPirate: The Brazilian financial malware you can’t see

10 min read - Malicious software always aims to stay hidden, making itself invisible so the victims can’t detect it. The constantly mutating PixPirate malware has taken that strategy to a new extreme. PixPirate is a sophisticated financial remote access trojan (RAT) malware that heavily utilizes anti-research techniques. This malware’s infection vector is based on two malicious apps: a downloader and a droppee. Operating together, these two apps communicate with each other to execute the fraud. So far, IBM Trusteer researchers have observed this…

Topic updates

Get email updates and stay ahead of the latest threats to the security landscape, thought leadership and research.
Subscribe today