Rogue SSL certificates issued for popular websites
Certificates revoked, but browsers still need to be updated.
Comodo, a major vendor of SSL certificates, has admitted to one of its affiliates' servers being hacked,
leading to nine rogue SSL certificates for popular domains to be issued.
SSL (secure socket layer) allows for traffic over the Internet that can not be intercepted by intermediates. HTTP over
SSL (commonly known as HTTPS) is essential for confidential traffic, such as password and online banking details, between
users and websites. More and more websites, including recently Facebook and Twitter, allow for all the
traffic to be sent via HTTPS.
However, one of the weaknesses of the protocol is that it does not guarantee that the website is indeed the one it claims to
be. That is why a number of trusted organisations, of which Comodo is one, sell certificates that provide proof
to the user's browser that communication is happening with the right website.
A hacker trying to re-route traffic attempting to access a certain website (to instead go to a malicious site) - for instance by installing malware on a
computer, or by hacking into DNS servers - is significantly more likely to succeed if they can obtain
a certificate for the domain. This appears to have happened at Comodo, where certificates were issued for, among
others, Google, Yahoo, Skype and Mozilla.
Certificate issuers have the option to revoke certificates and indeed, Comodo did so immediately upon discovering
the hack. However, as pointed out by Sophos's Mike Wood in his
VB2010 presentation on signatures, most
browsers do not check for revoked certificates by default. It is thus both important and understandable that both
Microsoft (whose Internet Explorer 9 does have the
correct defaults) and Mozilla
have released updates that recognize the rogue certificates.
In a statement on its blog,
Comodo said the initial attack was performed from an IP address in Iran. While the company acknowledges that this
may be a false trail laid by the attacker, it also points out that issuing rogue certificates, combined with re-routing
traffic, may be a very useful tool for governments who want to spy on their citizens.
More at Kaspersky's Threatpost blog
at Sophos's Naked Security blog
, certificates, comodo, iran, ssl.
Posted on 24 March 2011 by Virus Bulletin.
Leave a comment.
0 comments. del.icio.us digg this
Login to leave a comment
Please login to leave a comment - or click here to register if you are a new user.