VeriSign has moved to address a flaw in its Secure Sockets Layer (SSL) certification technology, which could have allowed hackers to create false certificates.
SSL certificates are one of the most common ways for firms to prove that their web sites are secure and authentic. By creating false certificates, hackers could deter online shoppers and possibly undermine consumer faith in e-commerce.
The so-called 'collision attack' flaw, first published by researchers at the Chaos Communication Congress last week, was aimed at the MD5 hashing algorithm of certificates issued by the RapidSSL authority, according to VeriSign.
"This presentation showed how to combine MD5 collision attacks with some other clever bits of hacking to create a false certificate," Tim Callan, VeriSign's vice president of SSL product marketing, said in a blog posting.
"We have discontinued using MD5 when we issue RapidSSL certificates, and we've confirmed that all other SSL certificates we sell are not vulnerable to this attack."
VeriSign has now transitioned to the SHA-1 algorithm on new RapidSSL brand certificates, and said that it will replace MD5 certificates for existing customers free of charge.
Callan added that the company aims to discontinue MD5 in "all end entity certificates" by the end of this month.
Matthew Tyler, director of consultancy firm Evolution Security Systems, explained that the MD5 flaw highlights why certificate authorities must "keep up to speed" with the latest security threats.
"As computing power increases there is a need to keep algorithms in pace with this change. MD5 was created over 18 years ago and had issues even before it went live in 1996 over 12 years ago," he said.
"MD5 is an old and debunked hashing algorithm and should have been phased out by the slightly more secure SHA-1/2, with SHA-3 due for 2012."
Extended Validation SSL Certificates, which VeriSign has been promoting vigorously since their launch in late 2006, are not affected by the flaw.
Latest Tesla news: Tesla share price continues to fall after Saudi Arabia's sovereign wealth fund is linked to investment in rival
SEC 'probe' takes its toll on Tesla as new research suggests that Tesla loses $6,000 on every $35,000 Model 3
RTX 280 Ti will come with 11GB of fast GDDR6 video RAM with a 352-bit memory bus offering 616Gbps
The scale of jobs lost to automation will be at least as large as those in the first three industrial revolutions
10nm Cannon Lake Core i3-8121U CPUs make a rare outing with Intel's NUC mini PC