Flickr / Qfamily A Chinese firm has been accused of undermining internet security by issuing weak web-security certificates — the systems that make that lock appear next to a website address and show users the domain is secure — among other big issues.

Researchers at Mozilla put together a lengthy technical analysis of their findings, which accuse the Shenzhen-based WoSign of handing out certificates for websites to people who had no business getting them or backdating their date of issuance to get around security protocols.

WoSign is a certificate authority, which means it's trusted to issue valid credentials to website owners so their users can visit their sites and know everything is OK. When you visit a website like Amazon, for example, you'll see a lock next to the web address that you can click and examine. That certifies to users and website administrators that their data is safely moving back and forth through an encrypted tunnel, so outsiders can't eavesdrop on or intercept it.

Without it, credit-card numbers, personal information, and whatever else is susceptible to eavesdropping. Or, if a hacker were able to obtain a valid certificate for a website like Amazon, the hacker could conduct a man-in-the-middle attack, potentially modifying data from a user before it reaches the server.

And that's exactly what a systems administrator at the University of Central Florida found.

Late last month, Stephen Schrauger wrote a blog post about how he was able to obtain an SSL certificate for the domain Github.com — the super-popular code-sharing website used by millions of developers. Needless to say, Schrauger does not own Github.com.

A legitimate certificate. Paul Szoldra "WoSign signed my certificate, and lo and behold, I had a certificate that was valid for github.com, github.io, www.github.io, schrauger.github.com, and schrauger.github.io," he wrote. "I set up a test website on my local machine that responded to GitHub's domains. I loaded the site, saw that the location was https://github.com, and the browser said my connection was encrypted by a valid certificate signed by WoSign."

It's common practice for certificate authorities to verify that someone owns a website by providing a text file to upload. A domain administrator takes the file, uploads it to the server, and the certificate authority looks for that file on the server. If it's there, then presto, the administrator becomes trusted. And that's what Schrauger did for his subdomain on GitHub, schrauger.github.com.

But WoSign wasn't distinguishing between a subdomain and the main one. And Schrauger found that basically anyone with a subdomain could get a valid certificate. Just think of the possibilities: All you'd need to prove is ownership of yourdomain.tumblr.com and you could mess with people on Tumblr, for example.

It gets worse

According to Mozilla, WoSign was also issuing certificates offering super-weak security, ones that most internet companies have agreed to phase out. Those certs used SHA-1 encryption, which is slowly being replaced by the much stronger SHA-256.

This is important, because plenty of web browsers will be banning websites' use of SHA-1 next year. To prepare for that, browser developers like Mozilla prohibited certificate authorities from issuing new certificates with the old encryption starting January 1 of this year.

But WoSign apparently found a workaround in backdating these weak certs before that date. And Mozilla is not happy.

A Firefox logo at a Mozilla stand at the Mobile World Congress in Barcelona, Spain. Thomson Reuters

"Mozilla believes that continued public trust in the correct working of the CA certificate system is vital to the health of the Internet, and we will not hesitate to take steps such as those outlined above to maintain that public trust," Mozilla researchers wrote in their analysis. "We believe that the behavior documented here would be unacceptable in any CA, whatever their nationality, business model or position in the market."

Further, Mozilla said, WoSign didn't report that it had acquired a rival certificate authority, StartCom, even though certificate authorities are required to do so.

Besides its huge listing of problems with WoSign and StartCom, Mozilla also called out Ernst & Young, WoSign's auditor in Hong Kong, which it said "failed to detect multiple issues they should have detected."

Mozilla is considering a yearlong ban on WoSign, and it's very likely that other browsers will also consider such a move.

A Google representative told Ars Technica earlier this week that the company was investigating the matter. Google declined to comment further to Business Insider. WoSign also did not respond to a request for comment.