Here is the preliminary report from Fox-IT, which is investigating the DigiNotar situation:
http://tweakimg.net/files/upload/Ope...Tulip+v1.0.pdf
The highlight:
Quote:
The most critical servers contain malicious software that can normally be detected by anti-virus software.
The separation of critical components was not functioning or was not in place. We have strong indications that the CA-servers, although physically very securely placed in a tempest proof environment, were accessible over the network from the management LAN.
The network has been severely breached. All CA servers were members of one Windows domain, which made it possible to access them all using one obtained user/password combination. The password was not very strong and could easily be brute-forced.
The software installed on the public web servers was outdated and not patched.
No antivirus protection was present on the investigated servers.
An intrusion prevention system is operational. It is not clear at the moment why it didn‟t block some of the outside web server attacks. No secure central network logging is in place.
|
__________________
UNIX was not designed to stop you from doing stupid things, because that would also stop you from doing clever things.
|