Attack to Iranian Gmail users: How to safeguard yourself.

Attack to Iranian Gmail Users

This Saturday/Sunday, the world-famous emailing system, GMail was attacked by some hackers who mainly targeted the Iranian Gmail users. This imposes a huge information leak risk for other gmail users too, if they do not validate correctly about the digital certificate before providing user-id and password in Gmail log-in page. This very important to safeguard a gmail user itself from being a victim of such attack.

As per google's statement, the attackers somehow managed to get a Secure Socket Layer (SSL) certificate issued to *.google.com  domain. This means that the attackers had a valid certificate which they were able to use to fool any web site surfer that the site they are using is actually a Google's site.

Relevant AD	This ad may be helpful, if relevant to your search.

Now, the main question, which will provide you a solution too, is how did they get a valid SSL certificate issued for Google's domain?

In the internet world, there are some private/public (but mainly private) companies who are very famous or mainly authorized by the government of a country to issue these SSL certificates to a person or an organization. These companies are called as Certificate Authority or CA. Individuals or organizations who are requesting such SSL certificate, need to provide a valid set of documents proving their identity along with theirs address proofs, in order to prove what they are claiming for and who they are. Its a responsibility of CA to confirm such requests and requester's identity and other stuffs before issuing a digital certificate.

How Hackers could plan and execute the attack

In this hacking fraud case, the DigiNotar CA, a Dutch company, issued an SSL digital certificate to a non verified entity with the valid certificate for *.Google.com domain. This gave the attackers to fool the users and gained some type controls over the gmail accounts of several user's; those end-user who believed that they are opening a genuine Gmail site. The attackers used this valid (but not for them logically) certificate along with the DNS entry details to hack some of Iranian Gmail users.

The important thing to note here is that Google uses different CA for their SSL certificate not this CA ie. DigiNoter.

Immediate Available Solutions

All of us should now not believe this CA i.e DigiNotar. Go ahead and delete to root certificate of the CA which is stored in your computer's certificate store. Don't know how to open the certificate store ? No Problem. Refer my another article "Digital certificate and secure communication" on this site. You will come to know how to open the certificate store.

For more details on this recent Gmail attack news, refer this link. Google has re-configured its Chrome browser to flag a warning if the user's PC is trying to use this certificate issued by The important thing to note here is the Google uses different CA for their SSL certificate not this CA i.e. DigiNotar.

Mozilla, in its blogs, said that they will soon release a new version Firefox to fix this issue by not trusting this CA.

Microsoft also said on Monday, that they will remove the DigiNotar from its trusted certificate provider list in the internet explorer browser.

But these preventive steps will take time, at least few days. So better we should manually remove all the root certificates of this CA from our computers. You can check another post here about how to remove a digital SSL certificate from your computer if is not an authenticate one and need to be removed or need to be put into the blacklisted list.

[Did you like this post ? Do leave a comment or share with your Facebook friends. This will give me more reasons to write such posts.]