After breaching the Dutch CA (Certification Authority) DigiNotar, Iranian hackers managed to sign forged certificates for the domains of spy agencies CIA, Mossad and MI6. Leading certification authorities like VeriSign and Thawte were also targeted, as were Iranian dissident sites.
The cyber attack on DigiNotar, a Dutch subsidiary of VASCO Data Security International Inc, is much more serious than previously thought. Last July hackers gained access to the network and infrastructure of several of DigiNotar’s CAs. Once inside, they generated hundreds of forged certificates for third party domains.
With these certificates hackers can potentially syphon off user login credentials by spoofing a legitimate site, complete with a functioning but forged SSL-certificate, apparently issued by DigiNotar.
The forged certificates match domains of the U.S. Central Intelligence Agency, the Israeli secret service Mossad and the British spy agency MI6. On top of that the hackers created false certificates of other CA’s like VeriSign and Thawte, in an attempt to also misuse their trusted position in securing Internet communications.
The partial list of domains with forged certificates was published on Saturday by Gervase Markham, programmer at Mozilla. Sources close to the investigation into the DigiNotar hack have confirmed to Webwereld that the list is authentic. Chrome engineer Adam Langley also told Webwereld Google has the same list.
Later, the Dutch public broadcaster NOS published the full list of over fifty domains for which false certificates were issued. Among them are Google, Yahoo, Microsoft and Skype, as well as numerous sites popular among Iranian dissidents. The cyber attackers even created fake certificates with messages praising the Iranian Revolutionary Guard, NOS reported.
It’s still unknown how successful the hackers have been in harvesting logins and spying on email and chat messages. Most certificates have either elapsed or were revoked after DigiNotar discovered the breach in mid July.
Chris Soghoian, security and privacy researcher at Indiana University and Graduate Fellow at the Center for Applied Cybersecurity Research, said the list is a “very interesting set of sites”. However, he’s sceptical that the hackers could have penetrated into the networks of the spy agencies with the forged certificates.
“Actually I think the secret service domains are the least alarming part. It’s sexy, and will probably lead to a lot of questions and interest from government agencies. Of course, nobody wants to get caught with their pants down, but there’s really no classified information on these domains. Those are on separate, secured internal
networks. So the practical security impact of the Iranian government getting a certificate for the CIA is nill. It’s really just very embarrassing, that’s all”, said Soghoian in an interview with Webwereld.
Still, the cyber hack at DigiNotar has a very high profile. “What is alarming is that they forged certificates for other CA’s, like VeriSign and Thawte. But the most problematic are sites like Google and Facebook. And also Walla, which is one the biggest mail providers in Israel.” Through forged SSL certificates of these sites the Iranian regime would be able to syphon the accounts and online communications of countless people, explained Soghoian.
Google has already updated its Chrome browser so it blocks access to any site which uses a DigiNotar certificate. Mozilla and Microsoft are expected to issue patches for their browsers soon. The Microsoft Security Response team tweeted earlier: “We’re in the process of moving all DigiNotar CAs to the Untrusted Root Store which will deny access to any website using DigiNotar CAs.”
This means hundreds of Dutch government sites will become inaccessible by browsers over the coming days if the agencies don’t switch to another certificate issuer in time.
Last week, Dutch security company Fox-IT carried out a forensic examination of the cyber hack at DigiNotar. The preliminary results prompted the government in The Hague to go into crisis mode, putting in effect an immediate stop to any DigiNotar services, and taking over the operational management of the DigiNotar Certification Authority.
