CA hack: more bogus certificates

[J65nko]

From http://h-online.com/-1334651

Dutch SSL Certificate Authority (CA) DigiNotar is still keeping a low profile regarding the extent of the recently disclosed intrusion by hackers.

The source code of the Chromium browser project, on which Google Chrome is based, has now provided some evidence of the extent of the compromise: its list of blocked certificates has grown from 10 to 257. A source code comment makes it clear that the newly added certificates were issued by DigiNotar. Whether the blocked certificates affect further popular web sites remains unknown. In addition to the CA's root certificate, the Chromium developers have also blacklisted two intermediate certificates derived from it.

Also see the EFF article at http://www.eff.org/deeplinks/2011/08...against-google

[J65nko]

For a follow-up see Attackers behind CA hack also targeted Tor

[Carpetsmoker]

Yet another update:
Dutch government takes control of DigiNotar CA

The Dutch government website they link to has a certificate from ...........

[Carpetsmoker]

Here is the preliminary report from Fox-IT, which is investigating the DigiNotar situation:
http://tweakimg.net/files/upload/Ope...Tulip+v1.0.pdf

The highlight:

The most critical servers contain malicious software that can normally be detected by anti-virus software.
The separation of critical components was not functioning or was not in place. We have strong indications that the CA-servers, although physically very securely placed in a tempest proof environment, were accessible over the network from the management LAN.

The network has been severely breached. All CA servers were members of one Windows domain, which made it possible to access them all using one obtained user/password combination. The password was not very strong and could easily be brute-forced.

The software installed on the public web servers was outdated and not patched.

No antivirus protection was present on the investigated servers.

An intrusion prevention system is operational. It is not clear at the moment why it didn‟t block some of the outside web server attacks. No secure central network logging is in place.