Firm points finger at Iran for SSL certificate theft

Computerworld - Iran may have been involved in an attack that resulted in hackers acquiring bogus digital certificates for some of the Web's biggest sites, including Google and Gmail, Microsoft, Skype and Yahoo, a certificate issuing firm said today.

The bogus certificates -- which are used to prove that a site is legitimate -- were acquired by attackers last week when they used a valid username and password to access an affiliate of Comodo, which issues SSL certificates through its UserTrust arm.

Today, Comodo's CEO said his company believes the attack was state-sponsored and pointed a finger at Iran.

"We believe these are politically motivated, state driven/funded attacks," said Melih Abdulhayoglu, the CEO and founder of Comodo, a Jersey City, N.J.-based security company that is also allowed to issue site certificates.

"One of the origins of the attack that we experienced is from Iran," Abdulhayoglu said in an online statement. "What is being obtained would enable the perpetrator to intercept Web-based email/communication and the only way this could be done is if the perpetrator had access to the country's DNS infrastructure (and we believe it might be the case here)."

Comodo's security blog offered more details of the Iranian connection and claimed that at least two Iranian IP addresses and one ISP were involved.

"The IP address of the initial attack ... has been determined to be assigned to an ISP in Iran," said Comodo. "A Web survey revealed one of the certificates [was] deployed on another IP address assigned to an Iranian ISP."

That server went offline shortly after Comodo revoked the certificates.

Fake certificates can be used by attackers to fool users into thinking that they're at a legitimate site when in reality they're not, said Andrew Storms, director of security operations at nCircle Security.

"They would be used in a 'man in the middle' kind of attack," said Storms. "They could use [the bogus certificates] to host a site that looks like one of these real sites, then capture people's log-ins."

Comodo echoed Storms' take on the attack's implication but speculated that it was a government-backed effort.

"It does not escape [our] notice that the domains targeted would be of greatest use to a government attempting surveillance of Internet use by dissident groups," Comodo said. "The attack comes at a time when many countries in North Africa and the [Persian] Gulf region are facing popular protests."

According to a Microsoft security advisory published earlier today, the nine fake certificates were issued for login.live.com, mail.google.com, www.google.com, login.yahoo.com, login.skype.com, addons.mozilla.org and Global Trustee.

Three certificates were acquired for Yahoo, said Microsoft, and one each for the others.