eWEEK content and product recommendations are editorially independent. We may make money when you click on links to our partners. Learn More.
After a cyber-attacker bragged online about having compromised Dutch certificate authority DigiNotar and several others, Mozilla has demanded the companies audit their systems to ensure they haven’t been breached.
Mozilla wants the certificate authorities it recognizes in its software, including the likes of Symantec, Verizon and Go Daddy, to audit their systems to ensure they have not been compromised, Mozilla Certificate Authority Certificates Module owner Kathleen Wilson said in a Sept. 8 email.
The audit needs to confirm that nobody can issue a digital certificate for a site without two-factor authentication and that security processes are in place with any resellers or other partners who can issue certificates with the CA’s root key, according to the email, which was posted on a Mozilla security discussion forum.
The CAs also must have “automatic blocks in place for high-profile domain names,” Wilson wrote. Putting manual verification in place would make it harder for attackers to issue fraudulent Secure Sockets Layer (SSL) certificates for popular and high-traffic sites, such as Microsoft, Google and Yahoo, which were targeted in both the Comodo and DigiNotar attacks thus far this year. The fake certificates for Google and Facebook from DigiNotar may have affected 300,000 Iranian users in the past month as part of a man-in-the-middle attack.
“Please further confirm your process for manually verifying such requests, when blocked,” Wilson wrote.
The most worrying part of the claim made by “Comodohacker” in the statement posted Sept. 5 on text-sharing site Pastebin was the fact that the attacker still had access to the compromised systems and can still issue certificates. “Comodohacker” claims to have been behind the breaches on multiple Comodo resellers earlier this year and on DigiNotar in June. Comodohacker claimed to have compromised DigiNotar and four other certificate authorities (CAs), including GlobalSign.
“I have access to their entire server…BUT YOU HAVE TO HEAR SO MUCH MORE! SO MUCH MORE! At least 3 more, AT LEAST! Wait and see,” according to the post.
While all Comodo-signed certificates had been revoked almost immediately after they were issued, many of the fake certificates issued by DigiNotar have not yet been revoked. The company initially claimed that “dozens” of certificates were fraudulently issued. That number has ballooned to over 500 after an audit by digital forensics firm Fox-IT.
GlobalSign suspended issuing digital certificates after the post appeared and hired Fox-IT to perform a security audit. The Belgian company said on its Twitter feed that it plans to resume issuing certificates on Sept. 12.
Certificate Security Relies on Fragile Thread of Trust
Web browsers and other Internet programs rely on digital certificates to be sure that the servers displaying the Websites are legitimate. A Web browser can look at the digital certificate of a site and be assured that the Gmail site being displayed is actually being served up from Google servers and not from a malicious server intent on phishing.
If malicious perpetrators can trick the companies to issue certificates for legitimate sites, then they can launch man-in-the-middle attacks to steal data or eavesdrop on compromised users. There are over 600 trusted certificate authorities around the world, making the “trust system” a little unwieldy.
The encryption used in the certificates hasn’t been broken and the existing system still does what it’s supposed to do, James Lyne, director of technology strategy at Sophos, told eWEEK. However, “how we’ve globally deployed this system and the fragile link of digital trust to the physical world causes the problem we see here,” Lyne said.
Shortly after the Comodo attack, Melih Abdulhayoglu, the company’s CEO, told eWEEK that the current CA system is “not working” because there are many “fly-by-night operators offering certificates for $10” that sign certificates without performing even the most minimal checks. Abdulhayoglu claimed Comodo had stringent checks in place and promised more controls, but that many companies aren’t following the same processes.
To further strengthen the CA trust system, Comodo presented a proposal in April at the 80th meeting of the Internet Engineering Task Force in Prague to create a new resource record in a Website’s (Domain Name System) DNS record. The resource record would indicate which certificate authority the Website owner had designated as the “trusted” authority. Browsers can check the valid digital certificate and make sure it is signed by the authorized CA listed on the DNS record, Philip Hallam-Baker, Comodo vice president, said in the proposal.
At Black Hat, security researcher Moxie Marlinspike talked about a new way to bypass certificate authorities altogether. Convergence, currently available as a Firefox plug-in, relies on user-defined “notaries” instead.
The CAs have until Sept. 16 to respond to Mozilla. What Mozilla would do to any CA that chooses to not respond is anybody’s guess.
“Participation in Mozilla’s root program is at our sole discretion, and we will take whatever steps are necessary to keep our users safe,” Wilson wrote.