Reactions are running rampant after security firm Comodo revealed it was tricked into issuing rogue digital certificates, with some speculating that Iranian hackers launched the attack to facilitate government monitoring of citizens and others using the incident to highlight what they call inherent flaws in the SSL certificate ecosystem.
Comodo, a Jersey City, N.J.-based company that issues digital SSL certificates used by websites to validate their identity to visitors, disclosed Wednesday that it had mistakenly issued nine fradulent certificates for big name sites like Google, Yahoo, Skype and Microsoft's Hotmail. The certificates could have allowed attackers to set up fake versions of the sites and collect usernames and passwords, or read users' email messages, researchers have warned. Evidence indicates that the attack was state sponsored, according to Comodo.
The websites that attackers chose to target indicates something about their motive, Mikko Hypponen, chief research officer at anti-virus firm F-Secure, told SCMagazineUS.com on Thursday. By gaining access to Comodo's certificate generation system, the attackers could have issued as many certificates as they wanted for any website in the world. They generated nine, not for banks or online retailers, but for communication providers.
“They weren't interested in stealing money, they were interested in reading email and collecting logins,” Hypponen said. “And that would point to a nation that wants to snoop on its own people.”
The origin of the attack was traced to several IP addresses, mainly originating in Iran, Comodo explained on its website. The attacker gained entry to Comodo's systems after obtaining the username and password of an employee at one of the company's European resellers. The hackers then used the credentials to log into Comodo's systems and issue the fraudulent certificates.
“The attack was very clinically executed and cleanly carried out,” Melih Abdulhayoglu, CEO of Comodo, told SCMagazineUS.com on Thursday. “They did not have the telltale signs of cybercriminals. We have come to the conclusion that this isn't a typical cybercriminal, it is a state-sponsored attack.”
Abdulhayoglu added that the attackers could have been using proxy servers in Iran to disguise their location.
“Whether it is Iran or someone else, I can't say for sure, but it is most definitely state sponsored,” he said.
Although the attacker requested nine certificates, Comodo is uncertain whether all were issued. At least one was issued, but all certificates were revoked immediately on discovery. In addition, Microsoft has issued a Windows update to protect against the fraudulent digital certificates.
Moreover, the certificates would have been useless unless the attackers also had the ability to modify the domain name server (DNS) infrastructure to direct users to the phony sites associated with the fraudulent certificates, Abdulhayoglu said. Still, governments with control over communication companies would likely have access to the DNS infrastructure.
Comodo has instituted new controls "in the wake of this new threat to the authentication platform," Abdulhayoglu said. The company is still investigating the incident and has involved federal law enforcement agencies.
F-Secure's Hypponen, meanwhile, questioned the security of Comodo's certificate generation system in light of the incident.
“The way they allow their resellers to issue certificates doesn't sound very secure,” Hypponen said. “All resellers are allowed to issue certificates without any checks.” He suggested that extra precautions be taken when certificates are requested for high traffic sites.
Others have said the entire SSL certification system is flawed. Ivan Ristic, director of engineering at vulnerability management and compliance firm Qualys, told SCMagazineUS.com on Thursday that there are “many layers of problems” with the SSL ecosystem, starting with the fact that there are hundreds of certificate authorities (CA), any one of which can issue a certificate for any domain name.
“I am glad, in a way, that this is happening,” he said. “It will direct people's attention to the problem and speed up the ways to fix it.”
There are many different opinions as to how to improve the system, but some believe that implementing DNSSEC, a set of Internet Engineering Task Force extensions that provide authentication of DNS data, would help, Ristic said. If implemented, it would only be possible to specify one certificate from one CA per domain name, he added.
Others suggest a new authentication system is needed, such as Dane. The system places encrypted keys in secure DNS and is deployed in top-level domains.
