Beanstalk's SEO News Blog

On March 15th 2011, a Comodo affiliate RA was compromised resulting in the fraudulent issue of 9 SSL certificates to sites in 7 domains:

• mail.google.com
• www.google.com
• login.live.com
• addons.mozilla.org
• login.skype.com
• login.yahoo.com

In the ongoing Comodo SSL Cert Scandal, Comodo claims they were infiltrated and that a computer cracker was able to bypass security with a valid username and password. This gave the unwanted user access to an affiliate of Comodo which issues SSL certificates through its UserTrust arm.

Essentially SSL certificates are used to prove that a site is legitimate. Stolen certificates can be used by unscrupulous admins to fool end users into thinking that they are accessing a registered site when in reality they are not.

Comodo has stated that their site was hacked from an Iranian IP address, which usually indicates that the source was anything but Iranian, however one of the bogus certs was used on an Iranian site for a short period of time.

CEO of Comodo: Melih Abdulhayoglu, stated on his company’s blog:

Why do we think these are state driven/funded?

"Well, one of the origin of the attack that we experienced is from Iran, what is being obtained would enable the perpetrator to intercept web based email/communication and the only way this could be done is if the perpetrator had access to the Country’s DNS infrastructure (and we believe it might be the case here). Of course this is our interpretation of the situation.
First time we are seeing a "state funded" attack against the "authentication" infrastructure. The Threat Model is changing and Comodo had already initiated a proposal for new standards in 2010 which would help mitigate some of these attacks. We will make sure to double our efforts in getting industry wide acceptance to these much needed standards so that we can continue to defend our security and freedom."

Comodo’s security blog went in to more detail regarding the Iranian connection and claimed that at least two Iranian IP addresses and one ISP were involved.

The question I keep wondering is; how did someone get a username and password from Comodo with sufficient privileges to issue the SSL certificates in the first place and who is monitoring the issuance of certificates?

How could Comodo issue an SSL certificates for google.com, live.com, yahoo.com, mozilla.org, and skype.com without somebody noticing or raising an alarm? Are there no watch lists in place to ensure that the issuance and distribution of SSL certificates to critical domain names is monitored? It seems to me that there is room for improvement withing the trusted certification system and it’s oversight.

Because each and every browser treats SSL certification revocation differently, and because there is no standardized methodology between them all to do so, Comodo would have had to remove anywhere from 85,000 to 205,000 perfectly legitimate certificates.

In a perfect internet, where all users have OCSP enabled, Google, Microsoft, Mozilla, and others, would be able to simply update their list of revoked certificates so that when each of their browsers checked to verify the certificate, an alarm would go off and the site would then be flagged for investigation or simply removed from the list of trusted sites.

Why are browser updates necessary in order to revoke the SSL certificates? Because OCSP is not mandatory, browser manufacturers are pushing the updates to the browsers themselves creating a delay in the updating of trusted certificates.

As increasingly more and more sites are moving towards using HTTPS, more efficiency and trust within the signing authority needs to be considered. Clearly we should also consider the need to monitor the issuance and distribution of trusted SSL certificates.
Even though the certificates have now been revoked, users should be sure to update their browsers immediately, and make sure OCSP is enabled, in order to verify that they have the latest list of trusted sites.

Peter Eckersley, from the Electronic Frontier Foundation, states the obvious by saying:

"What we need is a robust way to cross-check the good work that CAs currently do, to provide defense in depth and ensure (1) that a private key-compromise failure at a major CA does not lead to an Internet-wide cryptography meltdown and (2) that our software does not need to trust all of the CAs, for everything, all of the time."

The press was quick to label the offending perpetrators as originating from Iran. It is simply far too easy to spoof your IP address to hide your tracks and make it seem that you are coming from a different part of the word or from a different IP address. Claims that the attackers IP originated from Iran, are still ambiguous at best.

Comodo states:

"It does not escape [our] notice that the domains targeted would be of greatest use to a government attempting surveillance of Internet use by dissident groups. The attack comes at a time when many countries in North Africa and the [Persian] Gulf region are facing popular protests."

IMO, Comodo’s statement smacks of a conspiracy theory to me…or is it a convert attempt to divert us from seeing the truthfulness of the possibility of it being an inside job?

I think the bigger issue is not who was able to hack in and issue the bogus SSL certificates, security is always going to be a concern in any business. The fact that we do not have a single distinct authority monitoring all and issuing SSL certificates needs to be strongly examined.

SEO news blog post by guestpost @ 10:50 pm