Hacker steals Microsoft security imprimatur
A hacker's ability to fool the world's largest producer of online identification documents has revealed persistent hazards in the way society determines who is and is not trustworthy online.
So far, no one has reported any damages related to VeriSign's issuance of bogus digital certificates to someone who claimed to be a Microsoft employee in late January. But the hacker now has tools that will let him post software supposedly written by Microsoft anywhere on the Net. That person may have already distributed any number of computer viruses, Trojan horses or other destructive payloads with Microsoft's seal of approval attached.
"The big failings all certificate [issuers] have are two[fold]: No. 1: What process do we use to link the certificate to the person using them?," said Mark Rasch, vice president of cyberlaw at Global Integrity, a computer security clearinghouse funded by the financial industry. "It's like the bouncer checking ID at the door. The second is certificate revocation," or how to take fake IDs out of the system after they have been issued.
Still, VeriSign officials said that the certificates it issued in late January are the only ones they know to be false, out of more than 500,000 issued for the purposes of identifying the origin of software and Web sites.
"I think in this case it was human error," said Mahi de Silva, vice president and general manager for applied trust services at VeriSign.
The company discovered the problem after Microsoft notified VeriSign that it had never ordered the certificate VeriSign had issued. Microsoft sent the notice earlier this month in response to a confirmation message.
VeriSign put those certificates on a blacklist, usually readable by Internet browsers. Microsoft's Internet Explorer could not take advantage of that action, due to the company's decision to temporarily disable automated certificate list revisions.
"We were heartened by the fact that our second-stage screening picked it up," de Silva said.
Ken van Wyk, chief technical officer at security provider Para-Protect Services in Alexandria, Va., said he had heard of no attacks that resulted from the exploit. Still, he said, VeriSign needed to do more than use the phone and e-mail to verify digital certificates.
"These certificates are not tightly authenticated," he said. "But this is the general state of practice on the Internet, even though people can do harm with these digital certificates."
De Silva, for his part, said that VeriSign was improving procedures, but declined to say what new hurdles hackers would face in the future.
Microsoft officials said they'll have a fix to prevent the hack soon.