Rogue Comodo SSL Certs Used in Attack on Top Domains

[mamedesign]

IT security provider Comodo (www.comodo.com) revealed this week that a Registration Authority located in Southern Europe was hacked, leading to nine rogue SSL certificates on seven domains.

Top domains like Google, Yahoo, Skype and Windows Live were among the domains targeted.

In a statement released Wednesday, Comodo said the "attacker was well prepared and knew in advance what he was to try to achieve," armed with a "list of targets that he knew he wanted to obtain certificates for, was able quickly to generate the [requests] for these certificates and submit the orders" to the company's system to attain certificates.

The security firm says it immediately removed all nine certificates after discovering the attack, and it has not come across any other efforts to potentially exploit the certificates after the certificates were removed.

In an interview with CNET, Comodo CEO Melih Abdulhayoglu said the affected domain names "have to do with communications" and "are not financially motivated at all."

He believes the attack is an Iran state-sponsored move to breach the webmail accounts of political radicals.

Abdulhayoglu did not disclose the names of the southern European partner whose systems were breached, but confirmed that the Iranian server is now offline.

In a Comodo blog post, VP Philip Hallam-Baker wrote that the Iranian IP address was linked to the breach of the European registration authority tied to Comodo on March 15.

Though many IP addresses were used in the breach, most of these stemmed from Iran, according to another report.

Abdulhayoglu said the attacker first tested the certificate for login.yahoo.com, but because it had been revoked, the site would not appear as a trusted site when users tried to access it.

The Windows Live login domain, login.live.com, is just one of the domains that was breached by the nine rogue Comodo certificates.

Microsoft has since released a security advisory, as well as a mitigation update that updates the certificate revocation list on Windows PC. This will stop any more fraudlent certificates from being accepted as legitimate certificates.