Hackers steal SSL certificates for CIA, MI6, Mossad
"The Dutch government has since audited DigiNotar's performance and rescinded this assessment," Nightingale said. "This is not a temporary suspension, it is a complete removal from our trusted root program."
On Saturday, Piet Hein Donner, the Netherlands's Minister of the Interior, said the government could not guarantee the security of its websites because of the DigiNotar hack, and told citizens not to log into its sites until new certificates had been obtained from other sources.
The DigiNotar breach is being audited by Fox-IT, which told the Dutch government that it was likely certificates for its sites had been fraudulently acquired by hackers.
Several security researchers said the move by browser makers puts an end to DigiNotar's certificate business.
"Effectively a death sentence for DigiNotar," said Jeremiah Grossman, CTO of WhiteHat Security, in a Friday tweet.
Mozilla was scathing in its criticism of DigiNotar.
Nightingale ticked off the missteps that led Mozilla to permanently block all sites signed with the company's certificates, including DigiNotar's failure to notify browser vendors in July and its inability to tell how many certificates had been illegally obtained. "[And] the attack is not theoretical," Nightingale added. "We have received multiple reports of these certificates being used in the wild."
Markham went into greater detail on the hack and its ramifications. "It has now emerged that DigiNotar had not noticed the full extent of the compromise," said Markham in a Saturday post to his personal blog. "The attackers had managed to hide the traces of the misissuance -- perhaps by corrupting log files."
Because the Google certificate that prompted DigiNotar to acknowledge the intrusion was obtained before most of the others, Markham speculated that there had actually been two separate attacks, perhaps by different groups.
"It is at least possible (but entirely speculative) that an initial competent attacker has had access to [DigiNotar's] systems for an unknown amount of time, and a second attacker gained access more recently and their less-subtle, bull-in-a-china shop approach in issuing the [hundreds of] certificates triggered the alarms," he said.
Last week, Helsinki-based antivirus company F-Secure said it had found signs that DigiNotar's network had been compromised as early as May 2009.
Mozilla will update Firefox 6 and Firefox 3.6 on Tuesday to permanently block all DigiNotar-issued certificates, including those used by the Dutch government.
On Saturday Google updated Chrome to do the same.
Gregg Keizer covers Microsoft, security issues, Apple, Web browsers and general technology breaking news for Computerworld. Follow Gregg on Twitter at @gkeizer, on Google+ or subscribe to Gregg's RSS feed . His e-mail address is email@example.com.
- Nine charged with distributing Zeus malware
- The new security perimeter: Human Sensors
- Cyberattacks could paralyze U.S., former defense chief warns
- Security Manager's Journal: Thousands of dollars in phone calls? Management hates that.
- Everything You Know About Enterprise Security Is Wrong
- UK man charged with hacking Federal Reserve
- McAfee Offers Global Response to Nationalized Malware
- Tech Industry Praises Cybersecurity Framework From White House
- Ransomware like Cryptolocker uses Bitcoin, other virtual currencies for payment
- Trial for alleged Silk Road creator Ross Ulbricht set for November
Read more about Security in Computerworld's Security Topic Center.
- 2013 Cyber Risk Report The "Cyber risk report 2013 Executive summary" presents the major findings of HP Security Research's comprehensive dive into today's cyber vulnerability and threat...
- Why You Need a Next-Generation Firewall This white paper explores the reasons for implementing next-generation (NG) firewalls and lays out a path to success for overburdened IT organizations.
- Why Projects Fail CIOs are expected to deliver more projects that transform business, and do so on time, on budget and with limited resources.
- The New Business Case for Video Conferencing: 7 Real-World Benefits Beyond Cost-Savings This whitepaper provides insight into the value of video conferencing in today's business environment, and how organizations are using visual collaboration to find...
- LIVE EVENT: 5/7, The End of Data Protection As We Know It. Introducing a Next Generation Data Protection Architecture. Traditional backup is going away, but where does this leave end-users?
- On-demand webinar: "Mobility Mayhem: Balancing BYOD with Enterprise Security" Check out this on-demand webinar to hear Sophos senior security expert John Shier deep dive into how BYOD impacts your enterprise security strategy... All Malware and Vulnerabilities White Papers | Webcasts