Microsoft today warned that Comodo has issued nine fraudulent digital certificates to a third party whose identity could not be sufficiently validated, a scenario that could allow attackers to spoof content, perform phishing attacks, or perform man-in-the-middle attacks against all Web surfers.
According to the Microsoft advisory, the fraudulent
Web certificates affect the Microsoft Live service, Google’s mail system, Yahoo and Skype log-ins.
- login.live.com
- mail.google.com
- www.google.com
- login.yahoo.com (3 certificates)
- login.skype.com
- addons.mozilla.org
- “Global Trustee”
The fact that valid HTTPS certificates for high-value web sites were issued to attackers is a worrying development (see essay from the Tor Project), especially since Comodo is a certification authority present in the Trusted Root Certification Authorities Store on all supported versions of Microsoft Windows.
Comodo has revoked these certificates, and they are listed in Comodo’s current Certificate Revocation List (CRL). In addition, browsers which have enabled the Online Certificate Status Protocol (OCSP) will interactively validate these certificates and block them from being used.
The Tor Project’s Jake Appelbaum has seen evidence of Mozilla and Google also revoking certificates on Firefox and Chrome.
Mozilla has confirmed it has blacklisted the fraudulent certificates and warns of the potential risks:
Users on a compromised network could be directed to sites using the fraudulent certificates and mistake them for the legitimate sites. This could deceive them into revealing personal information such as usernames and passwords. It may also deceive users into downloading malware if they believe it’s coming from a trusted site.
Microsoft has pushed out an update for all supported versions of Windows to help address this issue and notes that no action is required from Windows users with automatic update enabled. The company’s advisory contains instructions on manually applying the update.
UPDATE: Attack originated in Iran
Comodo has published a blog post and an incident report with a claim that the attack originated from IP addresses in Iran.
An attacker obtained the username and password of a Comodo Trusted Partner in Southern Europe. We are not yet clear about the nature or the details of the breach suffered by that partner other than knowing that other online accounts (not with Comodo) held by that partner were also compromised at about the same time.
The attacker used the username and password to login to the particular Comodo RA account and effect the fraudulent issue of the certificates.
The attacker was still using the account when the breach was identified and the account suspended. The attacker may have intended to target additional domains had they had the opportunity.
Remediation efforts began immediately the breach was discovered. The certificates have all been revoked and no Web browser should now accept the fraudulently issued certificates if revocation checking is enabled. Additional audits and controls have been deployed as described in the detailed incident report.
The IP address of the initial attack was recorded and has been determined to be assigned to an ISP in Iran. A web survey revealed one of the certificates deployed on another IP address assigned to an Iranian ISP. The server in question stopped responding to requests shortly after the certificate was revoked.
While the involvement of two IP addresses assigned to Iranian ISPs is suggestive of an origin, this may be the result of an attacker attempting to lay a false trail.
It does not escape notice that the domains targeted would be of greatest use to a government attempting surveillance of Internet use by dissident groups. The attack comes at a time when many countries in North Africa and the Gulf region are facing popular protests and many commentators have identified the Internet and in particular social networking sites as a major organizing tool for the protests.
- The circumstantial evidence suggests that the attack originated in Iran.
- The perpetrator has focussed simply on the communication infrastructure (not the financial infrastructure as a typical cyber-criminal might).
- The perpetrator can only make use of these certificates if it had control of the DNS infrastructure.
- The perpetrator has executed its attacks with clinical accuracy.
- The Iranian government has recently attacked other encrypted methods of communication.
- All of the above leads us to one conclusion only:- that this was likely to be a state-driven attack.
