https://pzb-public-files.s3-us-west-2.amazonaws.com/B2.pdf
https://pzb-public-files.s3-us-west-2.amazonaws.com/B2.pdf
The story is perfectly believable: MCS wanted to become a CA, the easiest CA that would chain them an intermediate was CNNIC, they generated the cert from a Palo Alto Networks device because it was the only convenient hardware/FIPS-compliant device they had lying around, and a technician accidentally plugged their laptop on the "MITM me plz" port of the Palo Alto box and fired up Chrome, which automatically sent some alarm bells.
Honestly that makes me more worried for the state of internet security than active malice. If any individual, organization, government, etc. were intending to MITM someone, we could (in theory) track them down and fire them, blacklist their root, or otherwise expel them from the internet community. But nobody had such an intention here. It's terrifying that a series of honest mistakes (extremely grievous mistakes, but honest ones nonetheless) could lead to a valid cert for Google and Twitter in the hands of someone who didn't even want them.
I think a very tiny bit of blame should impute to Palo Alto Networks here. How have they built a device where it's easy to start MITMing certificates by accident? I'm all for usable crypto UI, but this seems excessive. (And should it be built with safeguards that warn you loudly when the MITM intermediate chains to a publicly-valid CA, instead of an in-house one?)
Regarding why I think it's perfectly believable that CNNIC was the easiest CA that would chain them an intermediate: everyone that runs an actual intermediate program sells (as required by the Baseline Requirements) a hardware security module, or better yet, a web interface to a cert that remains in the physical possession of the parent CA. There's an arduous audit process and key ceremony required for the intermediate CA, almost as arduous as required of the root CA. CNNIC, meanwhile, had no intermediate program, and wrote in their Certification Practices Statement that they don't intend to issue such things. So MCS was able to talk them into doing something irresponsible and handing them a CSR and no further details.