Feeds

Comodo admits 2 more resellers pwned in SSL cert hack

How deep does the rabbit hole go?

5 things you didn’t know about cloud backup

Comodo has admitted a further two registration authorities tied to the digital certificates firm were hit by a high-profile forged digital certificate attack earlier this month.

No forged certificates were issued as a result of the assault on victims two and three of the attack, but confirmation that multiple resellers in the Comodo community were compromised is bound to renew questions about the trust model applied by the firm.

Comodo has previously admitted that the compromise of one of its partners in southern Europe on 15 March allowed a hacker to generate bogus SSL certificates for Skype, Yahoo, Windows Live, mail.google.com and addons.mozilla.org. These certificates were revoked hours after they were issued, but the incident only became public a week later after browser developers including Microsoft and Mozilla had published updates. The certificates create a means to mount convincing man-in-the-middle or phishing attacks.

Earlier this week an Iranian hacker claimed responsibility for the assault, claiming that he acted alone and naming GlobalTrust.it and InstantSSL.it as the targets of his assault. He published fragments of digital certificate programming interfaces on Pastebin to substantiate his claims. The presumed hacker also posted the forged certificate for Mozilla that he created for himself, as well as the associated private key for this certificates.

The miscreant also published what he claimed were tables from files on Comodo's database in a post on Tuesday, as further proof of his self-described elite skills against those who doubted his initial claims. He called on Comodo to come clean about the hack, the exact motives for which remain more than a little unclear.

Comodo has now discovered that two more of its registration authorities (also unnamed) were hit by the same attack. Robin Alden, CTO of Comodo, stated in a post to mozilla.dev.security.policy about the attack: "Two further RA accounts have since been compromised and had RA privileges withdrawn. No further mis-issued certificates have resulted from those compromises."

Alden said Comodo was in the process of rolling out two-factor authentication products to its resellers (registration authorities), as a safeguard against future attacks. this process is likely to take around two weeks. In the meantime Comodo has promised to review validation work by its resellers before issuing certificates, rather than trusting the whole process to its resellers.

Responding to criticism from Mozilla that Comodo should not have allowed its RAs resellers to issue digital certificates directly from the root, a practice that invalidated possible countermeasures to the attack, Comodo said it was changing its business practices to move away from this model. ®

Secure remote control for conventional and virtual desktops

More from The Register

next story
One HUNDRED FAMOUS LADIES exposed NUDE online
Celebrity women victimised as Apple iCloud accounts reportedly popped
Rubbish WPS config sees WiFi router keys popped in seconds
Another day, another way in to your home router
Goog says patch⁵⁰ your Chrome
64-bit browser loads cat vids FIFTEEN PERCENT faster!
NIST to sysadmins: clean up your SSH mess
Too many keys, too badly managed
Scratched PC-dispatch patch patched, hatched in batch rematch
Windows security update fixed after triggering blue screens (and screams) of death
Researchers camouflage haxxor traps with fake application traffic
Honeypots sweetened to resemble actual workloads, complete with 'secure' logins
Attack flogged through shiny-clicky social media buttons
66,000 users popped by malicious Flash fudging add-on
New Snowden leak: How NSA shared 850-billion-plus metadata records
'Federated search' spaffed info all over Five Eyes chums
Three quarters of South Korea popped in online gaming raids
Records used to plunder game items, sold off to low lifes
prev story

Whitepapers

Endpoint data privacy in the cloud is easier than you think
Innovations in encryption and storage resolve issues of data privacy and key requirements for companies to look for in a solution.
Implementing global e-invoicing with guaranteed legal certainty
Explaining the role local tax compliance plays in successful supply chain management and e-business and how leading global brands are addressing this.
Advanced data protection for your virtualized environments
Find a natural fit for optimizing protection for the often resource-constrained data protection process found in virtual environments.
Boost IT visibility and business value
How building a great service catalog relieves pressure points and demonstrates the value of IT service management.
Next gen security for virtualised datacentres
Legacy security solutions are inefficient due to the architectural differences between physical and virtual environments.