[LINK] A Post Mortem on the Iranian DigiNotar Attack (was Re: other CAs breached ..)

[Kim Holburn]

https://www.eff.org/deeplinks/2011/09/post-mortem-iranian-diginotar-attack

> A Post Mortem on the Iranian DigiNotar Attack

> SSL certificates are the glue that holds the encrypted portions of the Internet together — they are how your browser knows that the website you visit is the website you intended to visit. The official report on the attacks from Fox-IT includes data from DigiNotar that suggests that over 300,000 (primarily Iranian) Internet users may have been had their communications intercepted, but the danger to Internet users extends well beyond Iran.
> The problem we face with Certificate Authorities is not just that there are particular vulnerabilites in any one CA. Rather, the massive structural crisis is that, as the SSL Observatory has shown, there are many hundreds of certificate authorities and an attacker only needs to break into one of those order to start issuing fraudulent certificates. Furthermore, these CAs appear to exist within around fifty countries' jurisdictions. Any one of these countries could conceivably compel a CA to create fraudulent certificates for purposes of espionage or for spying on that country's citizens. The DigiNotar hack has merely underlined how fragile the certificate authority system really is. Anyone who values the privacy and security of their communications and financial transactions online should take steps to protect themselves.
> 
> Statements have appeared strongly suggesting that the DigiNotar attacker is the same person who attacked Comodo earlier this year. The Tor Project has published extensive updates on the scope of the attack, including the list of the 531 fraudulent certificates issued by DigiNotar. This list shows that the attacker was prepared to facilitate spying against many major Internet sites. The attacker claims to be an individual Iranian who has chosen to help the government monitor individuals' communications. Additionally, he claims to have compromised four additional as-yet-unspecified certificate authorities. If true, the Iranian government may still have the power to forge new certificates in the name of these other authorities.



> How can I protect myself?
> 
> Until we have augmented or replaced the CA system with something more secure, all of our fixes to the problem of HTTPS/TLS/SSL insecurity will be band-aids. However, some of these band-aids are important:
> 
> 	• The first thing that Internet users should do to protect themselves is to always install browser and operating system updates as quickly as possible when they become available.
> 	• Another useful step is to configure your browser to always check for certificate revocation before connecting to HTTPS websites (in Firefox, this setting is Edit→Preferences→Advanced→Encryption→Validation→When an OCSP server connection fails, treat the certificate as invalid).
> 	• Firefox users who are particularly concerned (and willing to do more work to protect themselves) may also consider installing Convergence to warn them when certificates they see are different from certificates seen elsewhere in the world and Certificate Patrol to warn them whenever certificates change — legitimately or otherwise.
> 	• Users of Google services in particular can choose to enable two-factor authentication, which makes it hard for attackers who steal Google passwords to reuse them later. Any user of Google service with a concrete concern that someone else wants to take over their Google accounts should consider using this protection.



-- 
Kim Holburn
IT Network & Security Consultant
T: +61 2 61402408  M: +61 404072753
mailto:kim at holburn.net  aim://kimholburn
skype://kholburn - PGP Public Key on request 

Sent from my steam driven difference engine