Google Certificate Hackers May Have Stolen 200 Others

Hackers who obtained a fraudulent digital certificate for Google may have actually obtained more than 200 digital certificates for other top internet entities such as Mozilla, Yahoo and even the privacy and anonymizing service Tor.

Dutch certificate authority DigiNotar, which was hacked in July, has never acknowledged the number of fraudulent certificates the hackers managed to obtain, nor identified the possible targets other than Google.

But a Dutch security consultant told ComputerWorld this week that “about 200 certificates were generated by the attackers.”

Hans Van de Looy, who spoke with the publication, wouldn’t reveal his source, but the number he cited is close to the number of certificates that Google has since placed on the blacklist for its Chrome web browser. On Monday, Google increased the number of certificates its browser was blacklisting from 10 to 247.

News about the hack at DigiNotar broke this weekend after reports began circulating from people in Iran who claimed they were getting browser error messages when they tried to load the Gmail website. Google subsequently confirmed that a fraudulent Google certificate issued to a non-Google entity was operating in the wild, allowing someone to conduct a man-in-the-middle attack to intercept Gmail browsing.

DigiNotar, which is owned by Illinois-based Vasco Data Security, is one of numerous firms around the world that are authorized to generate security certificates to internet entities. The certificates authenticate web pages using the Secure Socket Layer protocol so that users can trust that their encrypted communication is going to the correct location.

DigiNotar acknowledged on Monday that it discovered the breach back on July 19 and said it had revoked all of the certificates the intruders had managed to obtain. But the Google certificate, which had been generated by the intruders on July 10, managed to slip through DigiNotar’s auditors, raising speculation that the Dutch company missed others as well.

Mozilla, which makes the Firefox browser, has since acknowledged that the attackers managed to obtain a certificate for the secure page hosting addons for its browser.

DigiNotar has been criticized for not disclosing the breach earlier to browser makers or the companies, like Google and Yahoo, who have had their digital certificates commandeered.

[Wired]

Japan earthquake search results already poisoned

It didn't take long for malware pushers to take advantage of Internet users' hunger for news and videos from Japan after it was hit today by the most powerful earthquake in the last 100 years:



According to Trend Micro, a search for the “most recent earthquake in Japan” will yield many search results that take users to pages where they are offered fake AV solutions.

As always, users are advised to search reputable news sites for up-to-date news. If you feel you must use Google, at least go to http://news.google.com/ to search, since those results are taken from legitimate sources.

As a side note, Google has taken advantage of its search engine popularity to post a Tsunami Alert on the engine's home page for a number of countries that are expected to be hit by waves caused by the tectonic shift.

The company has also launched a version of its Person Finder service for people that search for loved ones and friends in the wake of the earthquake.

[Net-Security]