Unknown hackers have managed to attack the digital certificates (SSL) of web-services of companies like Google, Microsoft, Yahoo, Skype, and Mozilla that are used to authenticate users and protect the sessions from data interception.
To avoid the potential threat of hacking of account on these services, users must install updated versions of browsers (Microsoft Internet Explorer, Mozilla Firefox and Google Chrome), in which the issue has already been addressed, on their computers and the available security updates for your operating system.
SSL-certificates (Secure Sockets Layer) are necessary for Web browser to verify the authenticity of page, and no third party could intercept the data transfer. Compromise of certificate leads to the hacking of encrypted HTTPS-connection (used for above services) – and at the other end of the channel there may be a fake site, prepared by hackers to intercept data and other forms of phishing.
If the user enters correct address in the browser (for example mail.google.com) the compromised certificate will not prevent him connecting to the appropriate domain (in this case Gmail). But it is quite possible when a user opens some web-link received by mail or through instant messenger, he will not notice that it leads to a different domain. Thus, the compromised SSL-certificate will help attackers to create an illusion of working with Gmail and hack the username and password.
For the first time the attack was reported on March 15 by the officials of Comodo, which deals in registration of digital certificates SSL. However, Comodo revealed the issue only one week later.
Attackers broke into the system of Comodo, after which they were able to get an account for registration of fake certificates. Victims of the attack include the websites of Google (mail.google.com and google.com), Microsoft (Web Portal Live, login.live.com), Yahoo (login.yahoo.com), Skype (login.skype.com) and Mozilla (addons.mozilla.org).
Representatives of Comodo maintain that hackers that launched the attack were based in Iran, and it is quite possible that they are associated with the Iranian government. |
Now the interesting aspect is this. .The hacker actually left a note on Pastebin and i have a feeling it might get removed reason for posting here. #
Hello
#
#
I'm writing this to the world, so you'll know more about me,
#
#
At first I want to give some points, so you'll be sure I'm the hacker:
#
#
I hacked Comodo from InstantSSL.it, their CEO's e-mail address mfpenco@mfpenco.com
#
Their Comodo username/password was: user: gtadmin password: [trimmed]
#
Their DB name was: globaltrust and instantsslcms
#
#
GlobalTrust.it had a dll called TrustDLL.dll for handling Comodo requests, they had resellers and their url was:
#
http://www.globaltrust.it/reseller_admin/
#
#
Enough said, huh? Yes, enough said, someone who should know already knows, Am I right Mr. Abdulhayoglu?
#
#
Anyway, at first I should mention we have no relation to Iranian Cyber Army, we don't change DNSes, we
#
#
just hack and own.
#
#
I see Comodo CEO and others wrote that it was a managed attack, it was a planned attack, a group of
#
#
cyber criminals did it, etc. etc. etc.
#
#
Let me explain:
#
#
a) I'm not a group of hacker, I'm single hacker with experience of 1000 hackers, I'm single programmer with
#
#
experience of 1000 programmers, I'm single planner/project manager with experience of 1000 project
#
#
managers, so you are right, it's managed by a group of hackers, but it was only I with experience of 1000
#
#
hackers.
#
#
b) It was not really a managed hack. At first I decided to hack RSA algorithm, I did too much
#
#
investigation on SSL protocol, tried to find an algorithm for factoring integer, analyzed existing algorithms, for now I was not
#
#
able to do so, at least not yet, but I know it's not impossible and I'll prove it, anyway, I saw
#
#
that there is easier ways of doing it, like hacking a CA. I was looking to hack some CAs like Thawthe,
#
#
Verisign, Comodo, etc. I found some small vulnerabilities in their servers, but it wasn't enough to
#
#
gain access to server and sign my CSRs. During my search about InstantSSL of Comodo which signs CSRs immediately I found
#
#
InstantSSL.it which was doing it's job under control of Comodo.
#
#
After a little try, I analyzed their web server and easily (easy for me, so hard for others) I got FULL access on the server, after a little investigation on their
#
#
server, I found out that TrustDll.dll takes care of signing. It was coded in C# (ASP.NET).
#
#
I decompiled the DLL and I found username/password of their GeoTrust and Comodo reseller account.
#
#
GeoTrust reseller URL was not working, it was in ADTP.cs. Then I found out their Comodo account works
#
#
and Comodo URL is active. I logged into Comodo account and I saw I have right of signing using APIs. I
#
#
had no idea of APIs and how it works. I wrote a code for signing my CSRs using POST request to those
#
#
APIs, I learned their APIs so FAST and their TrustDLL.DLL was too old and was not working properly, it doesn't send all needed parameters,
#
#
it wasn't enough for signing a CSR. As I said, I rewrote the code for !AutoApplySSL and !PickUpSSL
#
APIs, first API returns OrderID of placed Order and second API returns entire signed
#
#
certificate if you pass OrderID from previous call. I learned all these stuff, re-wrote the code and
#
#
generated CSR for those sites all in about 10-15 minutes. I wasn't ready for these type of APIs, these
#
#
type of CSR generation, API calling, etc. But I did it very very fast.
#
#
Anyway, I know you are really shocked about my knowledge, my skill, my speed, my expertise and entire attack.
#
#
That's OK, all of it was so easy for me, I did more important things I can't talk about, so if you have to
#
#
worry, you can worry, I should mention my age is 21
#
#
Let's back to reason of posting this message.
#
#
I'm talking to the world, so listen carefully:
#
#
When USA and Israel creates Stuxnet, nobody talks about it, nobody blamed, nothing happened at all,
#
#
so when I sign certificates nothing should happen, I say that, when I sign certificates nothing should
#
#
happen. It's a simple deal.
#
#
I heard that some stupids tried to ask about it from Iran's ambassador in UN, really? How smartass you are?
#
Where were you when Stuxnet created by Israel and USA with millions of dollar budget, with access to SCADA systems and Nuclear softwares? Why no one asked a question from Israel and USA ambassador to UN?
#
So you can't ask about SSL situtation from my ambassador, I answer your question about situtation: "Ask about Stuxnet from USA and Israel", this is your answer, so don't waste my Iran's ambassador's worthy time.
#
#
When USA and Isrel can read my emails in Yahoo, Hotmail, Skype, Gmail, etc. without any simple
#
#
little problem, when they can spy using Echelon, I can do anything I can. It's a simple rule. You do,
#
#
I do, that's all. You stop, I don't stop. It's a rule, rule #1 (My Rules as I rule to internet, you should know it
#
#
already, )
#
#
Rule#2: So why all the world worried, internet shocked and all writers write about it, but nobody
#
#
writes about Stuxnet anymore? Nobody writes about HAARP, nobody writes about Echelon, So nobody
#
#
should write about SSL certificates.
#
#
Rule#3: Anyone inside Iran with problems, from fake green movement to all MKO members and two faced
#
#
terrorists, should afraid of me personally. I won't let anyone inside Iran, harm people of Iran, harm
#
#
my country's Nuclear Scientists, harm my Leader (which nobody can), harm my President, as I live, you
#
#
won't be able to do so. as I live, you don't have privacy in internet, you don't have security in
#
#
digital world, just wait and see, By the way, you already have seen it or you are blind, is there any larger target than a CA in internet?
#
#
Rule#4: Comodo and other CAs in the world: Never think you are safe, never think you can rule the
#
#
internet, ruling the world with a 256 digit number which nobody can find it's 2 prime factors (you think so), I'll show
#
#
you how someone in my age can rule the digital world, how your assumptions are wrong, you already understood it, huh?
#
#
Rule#5: To microsoft, mozilla and chrome who updated their softwares as soon as instructions came from
#
#
CIA. You are my targets too. Why Stuxnet's Printer vulnerability patched after 2 years? Because it was
#
#
needed in Stuxnet? So you'll learn sometimes you have to close your eyes on some stuff in internet,
#
#
you'll learn, You'll understand, I'll bring equality in internet. My orders will equal to CIA orders,
#
#
lol 
#
#
Rule#6: I'm a GHOST
#
#
Rule#7: I'm unstoppable, so afraid if you should afraid, worry if you should worry.
#
#
My message to people who have problem with Islamic Republic of Iran, SSL and RSA certificates are broken, I did it one time, make sure I'll do it again, but this time nobody will notice it.
#
I see some people suggests using VPNs, some people suggests TOR, some other suggests UltraSurf, etc. Are you sure you are safe using those? RSA 2048 was not able to resist in front of me, do you think UltraSurf can?
#
#
If you was doing a dirty business in internet inside Iran, I suggest you to quit your job, listen to sound of most of people of Iran, otherwise you'll be in a big trouble, also you can leave digital world
#
and return to using abacus.
#
#
A message in Persian: Janam Fadaye Rahbar |
