Feeds

Digital certificate authority suspends ops following breach

Hackers access database, gain control over website

Internet Security Threat Report 2014

Websites belonging to a Netherlands-based issuer of digital certificates were unavailable following reports hackers penetrated their security and accessed databases that should have been off limits.

Dutch telecommunications giant KPN issued a statement (translation here) that said it temporarily shut the website of it's Gemnet subsidiary while it investigated the hack. A second website belonging to a KPN subsidiary that issues digital certificates to the Dutch government was also taken down.

The breach, which was first reported by Webwereld journalist Brenno de Winter, is the latest to compromise one of the several hundred online businesses authorized to mint digital certificates millions of websites and government and corporate networks rely on to shield communications from eavesdroppers. In August, another Netherlands-based certificate authority also suspended operations after it issued a fraudulent secure sockets layer certificate for Google.

DigiNotar eventually went bankrupt after an investigation revealed that shoddy security led to the issuance of dozens of counterfeit credentials, including one for Google Mail that was used to target more than 300,000 people accessing their Gmail accounts.

A half-dozen or so other authorities are also known to have suffered security breaches in the past year or so. One of them happened last month to KPN Corporate Market, which is owned by the same Netherlands-based firm that operates Gemnet.

According to de Winter's report on Webwereld, a hacker broke into a Gemnet database after exploiting poor password policies set up on its PHPMyAdmin server. As a result, attackers were not only able to access all documents stored on the machine, but also to take control of it. The article said the hacker came forward to prevent the kind of debacle DigiNotar created, but "he has also found evidence that he is not the first person who have gained access to the systems."

In its statement, KPN said there was no connection between the possible website breach and the issuance of digital certificates. It appears that the only contents available in the database was the information visible to website visitors, the company said. It said it decided to temporarily close the website out of an abundance of caution.

Representatives of Microsoft, Mozilla, and Google, makers of the world's three most widely used browsers, said security personnel are investigating the reports to learn if end users are at risk. This article will be updated if they respond with their findings.

The breach is being investigated by the Dutch government, IT World reported. Both Gemnet and Gemnet CSP provide digital certificates to the Dutch government, the publication said. ®

Internet Security Threat Report 2014

More from The Register

next story
George Clooney, WikiLeaks' lawyer wife hand out burner phones to wedding guests
Day 4: 'News'-papers STILL rammed with Clooney nuptials
Shellshock: 'Larger scale attack' on its way, warn securo-bods
Not just web servers under threat - though TENS of THOUSANDS have been hit
Apple's new iPhone 6 vulnerable to last year's TouchID fingerprint hack
But unsophisticated thieves need not attempt this trick
PEAK IPV4? Global IPv6 traffic is growing, DDoS dying, says Akamai
First time the cache network has seen drop in use of 32-bit-wide IP addresses
Oracle SHELLSHOCKER - data titan lists unpatchables
Database kingpin lists 32 products that can't be patched (yet) as GNU fixes second vuln
Researchers tell black hats: 'YOU'RE SOOO PREDICTABLE'
Want to register that domain? We're way ahead of you.
Stunned by Shellshock Bash bug? Patch all you can – or be punished
UK data watchdog rolls up its sleeves, polishes truncheon
prev story

Whitepapers

Forging a new future with identity relationship management
Learn about ForgeRock's next generation IRM platform and how it is designed to empower CEOS's and enterprises to engage with consumers.
Storage capacity and performance optimization at Mizuno USA
Mizuno USA turn to Tegile storage technology to solve both their SAN and backup issues.
The next step in data security
With recent increased privacy concerns and computers becoming more powerful, the chance of hackers being able to crack smaller-sized RSA keys increases.
Security for virtualized datacentres
Legacy security solutions are inefficient due to the architectural differences between physical and virtual environments.
A strategic approach to identity relationship management
ForgeRock commissioned Forrester to evaluate companies’ IAM practices and requirements when it comes to customer-facing scenarios versus employee-facing ones.