Feeds

GlobalSign says 'isolated' webserver was hacked

Crypto key system appears safe

Security for virtualized datacentres

Web authentication authority GlobalSign, which voluntarily suspended operations last week while it investigated claims its security was breached, said it has uncovered evidence that one of its servers has been compromised.

"The breached web server has always been isolated from all other infrastructure and is used only to serve the www.globalsign.com website," the authorized issuer of secure sockets layer certificates said in an advisory published this weekend. "At present there is no further evidence of breach other than the isolated www web server. As an additional precaution, we continue to monitor all activity to all services closely."

The certificate authority went on to say that it's in the process of bringing its systems back online and expects to begin processing orders on Tuesday.

GlobalSign's notice that it was hacked comes two weeks after the discovery of a counterfeit SSL credential issued by disgraced certificate authority DigiNotar that was being used to spy on people in Iran as they visited Gmail and possibly other Google properties. Over the following week, an account holder on Pastebin.com published a file signed with the private key of the bogus Google certificate, proving he had close ties to the person or people behind the attack. The person claimed to have access to GlobalSign and three other certificate authorities, but provided no proof.

GlobalSign responded by temporarily suspending its operations while it investigated the claims. It brought in Dutch security auditor Fox-IT to assist. Fox-IT also worked with DigiNotar following its security breach.

With its admission, GlobalSign's breach becomes at least the seventh time an entity that issues SSL certificates has been hacked this year. Four resellers of Comodo have been compromised, including one that allowed the attackers to mint fraudulent credentials for GMail and six other sensitive addresses. A similar attack hit Israel-based StartSSL, but the attackers didn't succeed in securing the bogus certificates.

In March, the Pastebin account holder published a private key for the fraudulent Google certificate issued by a Comodo reseller, proving the individual also had close ties to at least one of those hacks.

Last week, Mozilla responded to the DigiNotar attack and its aftermath by requiring all certificate authorities included in the Firefox and Thunderbird programs to perform similar security audits and ensure that their systems use two-factor authentication when issuing certificates. ®

Beginner's guide to SSL certificates

Whitepapers

Cloud and hybrid-cloud data protection for VMware
Learn how quick and easy it is to configure backups and perform restores for VMware environments.
A strategic approach to identity relationship management
ForgeRock commissioned Forrester to evaluate companies’ IAM practices and requirements when it comes to customer-facing scenarios versus employee-facing ones.
High Performance for All
While HPC is not new, it has traditionally been seen as a specialist area – is it now geared up to meet more mainstream requirements?
Three 1TB solid state scorchers up for grabs
Big SSDs can be expensive but think big and think free because you could be the lucky winner of one of three 1TB Samsung SSD 840 EVO drives that we’re giving away worth over £300 apiece.
Security for virtualized datacentres
Legacy security solutions are inefficient due to the architectural differences between physical and virtual environments.