Topic: 9 fraudulent digital certificates affect the Google, Skype, Yahoo & Microsoft

[Samker]

Microsoft today warned that Comodo has issued nine fraudulent digital certificates to a third party whose identity could not be sufficiently validated, a scenario that could allow attackers to spoof content, perform phishing attacks, or perform man-in-the-middle attacks against all Web surfers.

According to the Microsoft advisory: http://www.microsoft.com/technet/security/advisory/2524375.mspx , the fraudulent

Web certificates affect the Microsoft Live service, Google’s mail system, Yahoo and Skype log-ins:

    * login.live.com
    * mail.google.com
    * www.google.com
    * login.yahoo.com (3 certificates)
    * login.skype.com
    * addons.mozilla.org
    * “Global Trustee”


The fact that valid HTTPS certificates for high-value web sites were issued to attackers is a worrying development (see essay from the Tor Project: https://blog.torproject.org/blog/detecting-certificate-authority-compromises-and-web-browser-collusion ), especially since Comodo is a certification authority present in the Trusted Root Certification Authorities Store on all supported versions of Microsoft Windows.

Comodo has revoked these certificates, and they are listed in Comodo’s current Certificate Revocation List (CRL). In addition, browsers which have enabled the Online Certificate Status Protocol (OCSP) will interactively validate these certificates and block them from being used.

The Tor Project’s Jake Appelbaum has seen evidence of Mozilla and Google also revoking certificates on Firefox and Chrome: https://blog.torproject.org/blog/detecting-certificate-authority-compromises-and-web-browser-collusion

Mozilla has confirmed it has blacklisted the fraudulent certificates: http://blog.mozilla.com/security/2011/03/22/firefox-blocking-fraudulent-certificates/ and warns of the potential risks:

    Users on a compromised network could be directed to sites using the fraudulent certificates and mistake them for the legitimate sites. This could deceive them into revealing personal information such as usernames and passwords. It may also deceive users into downloading malware if they believe it’s coming from a trusted site.

Microsoft has pushed out an update for all supported versions of Windows to help address this issue and notes that no action is required from Windows users with automatic update enabled.  The company’s advisory contains instructions on manually applying the update.

UPDATE: Attack originated in Iran

Comodo has published a blog post: http://blogs.comodo.com/it-security/data-security/the-recent-ca-compromise/ and an incident report: http://www.comodo.com/Comodo-Fraud-Incident-2011-03-23.html with a claim that the attack originated from IP addresses in Iran.

An attacker obtained the username and password of a Comodo Trusted Partner in Southern Europe. We are not yet clear about the nature or the details of the breach suffered by that partner other than knowing that other online accounts (not with Comodo) held by that partner were also compromised at about the same time.

The attacker used the username and password to login to the particular Comodo RA account and effect the fraudulent issue of the certificates.

The attacker was still using the account when the breach was identified and the account suspended. The attacker may have intended to target additional domains had they had the opportunity.

Remediation efforts began immediately the breach was discovered. The certificates have all been revoked and no Web browser should now accept the fraudulently issued certificates if revocation checking is enabled. Additional audits and controls have been deployed as described in the detailed incident report.

The IP address of the initial attack was recorded and has been determined to be assigned to an ISP in Iran. A web survey revealed one of the certificates deployed on another IP address assigned to an Iranian ISP. The server in question stopped responding to requests shortly after the certificate was revoked.

While the involvement of two IP addresses assigned to Iranian ISPs is suggestive of an origin, this may be the result of an attacker attempting to lay a false trail.

It does not escape notice that the domains targeted would be of greatest use to a government attempting surveillance of Internet use by dissident groups. The attack comes at a time when many countries in North Africa and the Gulf region are facing popular protests and many commentators have identified the Internet and in particular social networking sites as a major organizing tool for the protests.


The incident report offers even more details:

    * The circumstantial evidence suggests that the attack originated in Iran.
    * The perpetrator has focussed simply on the communication infrastructure (not the financial infrastructure as a typical cyber-criminal might).
    * The perpetrator can only make use of these certificates if it had control of the DNS infrastructure.
    * The perpetrator has executed its attacks with clinical accuracy.
    * The Iranian government has recently attacked other encrypted methods of communication.
    * All of the above leads us to one conclusion only:- that this was likely to be a state-driven attack.

“The attacker was well prepared and knew in advance what he was to try to achieve. He seemed to have a list of targets that he knew he wanted to obtain certificates for, was able quickly to generate the CSRs for these certificates and submit the orders to our system so that the certificates would be produced and made available to him,” Comodo said.

(ZDnet)

[vishwanath99]

Microsoft has always has some issue. earlier wt driver now wt certificat

[Samker]

Comodo-gate hacker brags about forged certificate exploit

An Iranian hacker has stepped forward to claim responsibility for the SSL certificate hack against Comodo, providing an insight into how the high-profile hack might have been pulled off.

The lock-picker – who claimed he had "1,000 times" the experience of any hacker or programmer – asserted that after compromising Comodo's partner in Italy (GlobalTrust.it and InstantSSL.it) he was able to generate bogus SSL certificates for Skype, Yahoo, Windows Live, mail.google.com and addons.mozilla.org. These forged certificates created the means for others to pose as the targeted websites in man-in-the-middle or phishing attacks. The approach also cleared the way towards preventing users from installing censorship-circumvention Firefox extensions, at least in theory.

A total of nine certificates for seven domains were issued during the breach, which occurred on the evening of 15 March. The incident only became public a week later, after browser makers had issued an update: http://www.microsoft.com/technet/security/advisory/2524375.mspx , and long after the offending digital certificates had been revoked.

The incident sparked a debate about about how digital certificates are issued and revoked.

Mozilla, while praising Comodo for quickly revoking the certificate, criticised the firm for placing too much trust in its resellers: "The practice of issuing certs directly from the root eliminated some possible steps we could have taken to mitigate the problem: http://blog.mozilla.com/security/2011/03/25/comodo-certificate-issue-follow-up
We are concerned about the amount of trust Comodo seems to have placed in RAs whose network security they did not oversee."

Comodo last week admitted that an affiliate registration authority, which it didn't name beyond saying it was based in southern Europe, had been hacked as part of an assault that it traced back to Iran: http://blogs.comodo.com/it-security/data-security/the-recent-ra-compromise
It suggests that the level of expertise that featured in the attack indicated it might be state-sponsored in some way.

However the hacker who stepped forward to claim responsibility for the attack claimed he had acted alone and was not affiliated with the Iranian Cyber Army, a Iranian government affiliated hacking cadre. The Iranian Cyber Army was previously known for an DNS hijack attack against Twitter and a DNS records hack against Chinese search engine Baidu that redirected surfers to a counterfeit (defaced) page back in January 2010.

The Comodo hacker said that he had set himself the goal of compromising the SSL root certificate system. After finding the RSA algorithm that underpins the security of the system too hard a nut to crack, he said he then began to look at the security of Certificate Authorities (CAs), later hitting on a Comodo partner in Italy as a weak link in the chain of trust that underpins the digital certificate system.

He discovered that InstantSSL.it provided application interfaces that allowed developers to submit certificate signing requests. Looking further, he reportedly discovered that plain text login credentials were used as part of this Certificate Signing Requests (CSRs) submission process, a howler that allowed him to forge countersigning signatures for digital certificates.

The hacker posted portions of what purports to be the offending library (TrustDLL.dll) to pastebin in order to substantiate his claims. These coding snippets included programming routines for authentication that appeared to rely on an unencrypted password.

It's very difficult to verify the claims beyond saying that the scenario is plausible and fits Comodo's explanation of the sequence of events, especially since the websites of GlobalTrust.it and InstantSSL.it have each been pulled down for repairs.

More commentary on the latest chapter of the Comodo-gate saga, including screenshots featuring the offending code snippets and the hacker's rather inflated claims, can be found in a blog post by Sophos here: http://nakedsecurity.sophos.com/2011/03/27/comodo-hacker-outs-himself-claims-no-relation-to-iranian-cyber-army

(ElReg)

[Rosie667]

The software giant issued a security advisory on Wednesday explaining that a certification authority, present in the Trusted Root Certification Authorities Store on all supported versions of Windows, issued nine fraudulent certificates. The certificates were issued by Comodo, an Internet security solutions firm.
Comodo explained the certificates theft in a blog posting on Wednesday. “We believe these are politically motivated, state driven/funded attacks,” said Melih Abdulhayoglu, the CEO and founder of Comodo. “One of the origins of the attack that we experienced is from Iran,” he added.