Feeds

GlobalSign says 'isolated' webserver was hacked

Crypto key system appears safe

Securing Web Applications Made Simple and Scalable

Web authentication authority GlobalSign, which voluntarily suspended operations last week while it investigated claims its security was breached, said it has uncovered evidence that one of its servers has been compromised.

"The breached web server has always been isolated from all other infrastructure and is used only to serve the www.globalsign.com website," the authorized issuer of secure sockets layer certificates said in an advisory published this weekend. "At present there is no further evidence of breach other than the isolated www web server. As an additional precaution, we continue to monitor all activity to all services closely."

The certificate authority went on to say that it's in the process of bringing its systems back online and expects to begin processing orders on Tuesday.

GlobalSign's notice that it was hacked comes two weeks after the discovery of a counterfeit SSL credential issued by disgraced certificate authority DigiNotar that was being used to spy on people in Iran as they visited Gmail and possibly other Google properties. Over the following week, an account holder on Pastebin.com published a file signed with the private key of the bogus Google certificate, proving he had close ties to the person or people behind the attack. The person claimed to have access to GlobalSign and three other certificate authorities, but provided no proof.

GlobalSign responded by temporarily suspending its operations while it investigated the claims. It brought in Dutch security auditor Fox-IT to assist. Fox-IT also worked with DigiNotar following its security breach.

With its admission, GlobalSign's breach becomes at least the seventh time an entity that issues SSL certificates has been hacked this year. Four resellers of Comodo have been compromised, including one that allowed the attackers to mint fraudulent credentials for GMail and six other sensitive addresses. A similar attack hit Israel-based StartSSL, but the attackers didn't succeed in securing the bogus certificates.

In March, the Pastebin account holder published a private key for the fraudulent Google certificate issued by a Comodo reseller, proving the individual also had close ties to at least one of those hacks.

Last week, Mozilla responded to the DigiNotar attack and its aftermath by requiring all certificate authorities included in the Firefox and Thunderbird programs to perform similar security audits and ensure that their systems use two-factor authentication when issuing certificates. ®

The smart choice: opportunity from uncertainty

More from The Register

next story
BMW's ConnectedDrive falls over, bosses blame upgrade snafu
Traffic flows up 20% as motorway middle lanes miraculously unclog
Putin: Crack Tor for me and I'll make you a MILLIONAIRE
Russian Interior Ministry offers big pile o' roubles for busting pro-privacy browser
Mozilla fixes CRITICAL security holes in Firefox, urges v31 upgrade
Misc memory hazards 'could be exploited' - and guess what, one's a Javascript vuln
Manic malware Mayhem spreads through Linux, FreeBSD web servers
And how Google could cripple infection rate in a second
How long is too long to wait for a security fix?
Synology finally patches OpenSSL bugs in Trevor's NAS
Don't look, Snowden: Security biz chases Tails with zero-day flaws alert
Exodus vows not to sell secrets of whistleblower's favorite OS
Roll out the welcome mat to hackers and crackers
Security chap pens guide to bug bounty programs that won't fail like Yahoo!'s
prev story

Whitepapers

Top three mobile application threats
Prevent sensitive data leakage over insecure channels or stolen mobile devices.
Implementing global e-invoicing with guaranteed legal certainty
Explaining the role local tax compliance plays in successful supply chain management and e-business and how leading global brands are addressing this.
Boost IT visibility and business value
How building a great service catalog relieves pressure points and demonstrates the value of IT service management.
Designing a Defense for Mobile Applications
Learn about the various considerations for defending mobile applications - from the application architecture itself to the myriad testing technologies.
Build a business case: developing custom apps
Learn how to maximize the value of custom applications by accelerating and simplifying their development.