Feeds

DigiNotar goes titsup: Disgraced certificate firm is sunk

Secrecy caused as much trouble as getting hacked

High performance access to file storage

Disgraced digital certificate firm DigiNotar has filed for bankruptcy in The Netherlands.

Hackers broke into DigiNotar's systems in June before creating forged digital certificates in the names of Google and other high-profile targets. The forged Google.com SSL credentials were used to spy on 300,000 Iranian internet users, according to a subsequent analysis of authentication lookup logs on DigiNotar's systems. Comodohacker, the boastful Iranian black hat who had claimed credit for an earlier attack on digital certificate firm Comodo, also claimed credit for the DigiNotar hack.

The hack itself was bad enough but what really did for DigiNotar were two additional aggravating factors: the shockingly insecure set-up of its systems and its failure to promptly come clean on its problems. DigiNotar began revoking certificates in 19 July, after it realised it had been hacked but only got around to revoking the forged *.google.com certificate on 29 July. It only went public a month later, leaving browser makers and internet users ignorant of a huge security hole.

DigiNotar became a security pariah as a result of its handling of the affair, which led browser and operating system developers to bin its certificates in August. A DigiNotar-controlled intermediate was involved in issuing certificates as part of the Dutch government’s public key infrastructure "PKIoverheid" scheme.

The Dutch government initially said that PKIoverheid site certs issued by DigiNotar were still trustworthy, but then changed its mind after getting wind of a damning security audit of DigiNotar's systems and ditching the firm. A preliminary reports from Fox-IT found that although DigiNotar boasted of state-of-the-art facilities, its security was childishly inadequate. Mistakes included a failure to run any anti-virus software on its servers and a lack of segmentation of its network that allowed hackers free rein to plant remote control trojans on its systems.

The certificate agency, which relies on trust to run its business, was never likely to recover from that, so its bankruptcy filing doesn't come as the complete surprise it might otherwise have been.

In a statement issued on Tuesday Vasco (which acquired DigiNotar in January) acknowledged the bankruptcy of its CA subsidiary but maintained this would have no effect on its core authentication business.

“We want to emphasize that the bankruptcy filing by DigiNotar, which was primarily a certificate authority, does not involve VASCO’s core two-factor authentication business,” said Jan Valcke, VASCO’s President and COO.  “While we do not plan to re-enter the certificate authority business in the near future, we expect that we will be able to integrate the PKI/identity verification technology acquired from DigiNotar into our core authentication platform.

"As a result, we expect to be able to offer a stronger authentication product line in the coming year to our traditional customers,” he added.

Vasco is in the process of winding up DigiNotar's business while it continues to assist the authorities in investigation the hack that took its subsidiary down. Vasco hopes the continuing value of the DigiNotar technology will help defray part of the write-off costs associated with the closure of the business. But it did admit that its losses may be substantial.

"While the losses associated with DigiNotar are expected to be significant, we do not expect, given the manner in which the acquisition of DigiNotar was structured, that the value of all of the intangible assets acquired will be fully impaired," said Cliff Bown, VASCO’s executive vice president and CFO.

Security watchers at The Internet Storm Centre said other certificate authorities should learn lessons from DigiNotar's demise.

"The CA business is all about selling trust," ISC staffer Swa Frantzen writes. "After all a CA is supposed to be a trusted third party. Let's hope all the remaining ones get the right message: it's not about not getting caught being hacked. On the contrary: it's about doing the right thing once you have been hacked. Let's hope it leads to more transparency and public scrutiny of the CAs we trust explicitly or implicitly though the choice of some of our vendors." ®

High performance access to file storage

More from The Register

next story
Obama allows NSA to exploit 0-days: report
If the spooks say they need it, they get it
Web data BLEEDOUT: Users to feel the pain as Heartbleed bug revealed
Vendors and ISPs have work to do updating firmware - if it's possible to fix this
OpenSSL Heartbleed: Bloody nose for open-source bleeding hearts
Bloke behind the cockup says not enough people are helping crucial crypto project
One year on: diplomatic fail as Chinese APT gangs get back to work
Mandiant says past 12 months shows Beijing won't call off its hackers
Call of Duty 'fragged using OpenSSL's Heartbleed exploit'
So it begins ... or maybe not, says one analyst
Heartbleed exploit, inoculation, both released
File under 'this is going to hurt you more than it hurts me'
Parent gabfest Mumsnet hit by SSL bug: My heart bleeds, grins hacker
Natter-board tells middle-class Britain to purée its passwords
Experian subsidiary faces MEGA-PROBE for 'selling consumer data to fraudster'
US attorneys general roll up sleeves, snap on gloves
prev story

Whitepapers

Mainstay ROI - Does application security pay?
In this whitepaper learn how you and your enterprise might benefit from better software security.
Five 3D headsets to be won!
We were so impressed by the Durovis Dive headset we’ve asked the company to give some away to Reg readers.
3 Big data security analytics techniques
Applying these Big Data security analytics techniques can help you make your business safer by detecting attacks early, before significant damage is done.
The benefits of software based PBX
Why you should break free from your proprietary PBX and how to leverage your existing server hardware.
Mobile application security study
Download this report to see the alarming realities regarding the sheer number of applications vulnerable to attack, as well as the most common and easily addressable vulnerability errors.