An Industry Wide Attack
9/9/2011: Globalsign admitted evidence of a breach to the web server hosting the www website:
Today we found evidence of a breach to the web server hosting the www website. The breached web server has always been isolated from all other infrastructure and is used only to serve the http://www.globalsign.com website. At present there is no further evidence of breach other than the isolated www web server. As an additional precaution, we continue to monitor all activity to all services closely. The investigation and high threat approach to returning services to normal continues.
Starting from March 2011, one might say that the authentication bastions have been crumbling one after another. In hindsight, one event in particular occurred during March 2011 has been mostly underestimated. Of course I am not referring to the RSA affair, but to the Comodo Hack, whose only blame was to happen too close in time to the RSA Breach, which ended up obfuscating its impact for the Information Security Landscape … At least until August 2011.
As a matter of fact when, immediately after the Comodo Hack, the so called Comodo Hacker published on pastebin his declaration of Cyberwar, no one considered the hypothesis that other Certification Authorities could have been equally compromised. Consequently, although the hack was classified as a serious cyberattack, driven by a political matrix and capable to establish a new (unwelcome) record, it was considered an isolated episode, mainly due to the scarce attention to application security by the targeted Comodo partner. Moreover the final target (Google) and the political reasons behind the attack deserved much more attention than the means used to perpetrate the attack itself: the first-time compromission of a Certification Authority, a completely inedited attack vector.
Nearly four months later, the Diginotar hack (again an attack with alleged political reasons behind although according to Trend Micro it targeted Iranian Internet users) has shown to the world the weaknesses of our authentication model and its chain of trust. Not only the hacker was able to forge more than 500 fake Code Sign and SSL certificates, but he also claimed to have access to other four CAs, quoting explicitly GlobalSign, and indirectly another one StartCom, which was able to avoid the hack since its CEO was sitting in front of the HSM during the attack, although the Comodo Hacker claims to own email, DB Backup and Customer data.
Trust in Diginotar Certificate Authority has been revoked from all browsers and OSes, permanently from all Mozilla Products, but not from Smartphones, with heavy consequences for the Dutch government’s PKIoverheid (PKIgovernment) program. Of course, easily predictable, the assertions from Comodo Hacker triggered panic between cert providers. On September the 6th GlobalSign decided to temporary cease issuance of all certificates as a precautionary measure and appointed Fox-IT to perform an intensive audit (Fox-IT is the same Dutch Cybsersecurity Company which performed the audit on Diginotar); on September the 7th Symantec released a statement to reassure their customers their infrastructure has been audited and it is not compromised. A similar announcement has been published by Thawte after an erroneous report from a Dutch Government agency according to which the Security firm had been breached. Unfortunately the story does not end here and although the Comodo Hacker promises further disclosures.
If I can spend few words on the question, the best way to describe it is to quote a statement from GlobalSign: “these claims (from Comodo Hacker) represent an industry wide attack”. Said in simple words: the aftermaths of the Diginotar hack will force to rethink the current authentication model and chain of trust (even because authentication technologies and vendors are increasingly tied) even if we seriously risk to run out of ammo: in this year we lost tokens and CAs… Now What Else?
- 717,450 hits since November 2010
08/13/2011 - My Post on Android Malware Mentioned on Engadget.
04/14/2011 - The Article Smart Grid: L'ultima Frontiera del Cybercrime published on ICT Security Magazine May 2011.
03/14/2011 - Security Summit 2011: Paolo Passeri guest at Round Table "Mobile Security: Rischi, Tecnologie, Mercato"
02/14/2011 - The Article Gears of Cyberwar published on ICT Security Magazine January 2011.
About This Blog
In this blog I express my personal opinion, which does not necessarily reflects the opinion of my organization, about events and news or interest, concerning information security, winking to mobile world and, why not, to some curious personal event.
Every information is reported with its source.
Anyone intending to use information contained in my post is free to do so, provided that mention my blog in your article.
Top Posts & Pages
- List Of Hacked Celebrities Who Had (Nude) Photos Leaked
- 2013 Cyber Attacks Timeline Master Index
- August 2013 Cyber Attacks Statistics
- 2012 Cyber Attacks Statistics
- 1-15 February 2014 Cyber Attacks Timeline
- 2013 Cyber Attacks Statistics
- 16-31 August 2013 Cyber Attacks Timeline
- A (Graphical) World of Botnets and Cyber Attacks
- 2012 Cyber Attacks Timeline Master Index
- 2013 Cyber Attacks Statistics (Summary)
- Web Security For Advanced Malware And Persistent Threats info.lastline.com/blog/web-secur… - 1 day ago
- @lazy_daemon @malm0u53 @unibirmingham @lastlineinc You can find it in the project main page together with the report: c2report.org - 1 day ago
- An Interesting #infographic from the same project promoted by @unibirmingham in collaboration with @lastlineinc http://t.co/OlrisuUkNZ - 1 day ago
- Command & Control, Understanding, Denying and Detecting: c2report.org/report.pdf - 1 day ago
- RT @lastlineinc: The New Age Of The Security Startup - @TechCrunch article featuring Lastline: hub.am/1dnTBGu http://t.co/9oOZUVgMH9 - 3 days ago
- 1-15 February 2014 Cyber Attacks Timeline wp.me/p14J6X-2xl - 4 days ago
- RT @lastlineinc: @RSAConference is far from over. Come meet our team at booth 2537 to talk everything security! http://t.co/mQNB8cbQtw - 1 week ago
- @lastlineinc named Best Security Startup at the Annual Info Security 2014 Global Excellence Industry Awards info.lastline.com/blog/lastline-… - 1 week ago
- RT @lastlineinc: Kicking off @RSAConference with 5 wins, including Best New Security Start-Up @infosecuritypg Excellence Awards: http://t.c… - 1 week ago
- @lastlineinc announces Interoperability with @hpsecurity TippingPoint lastline.com/company/press-… - 1 week ago