> series: anatomy_of_a_breach —— part: 027 —— target: comodo_ca —— fake_certs_for: google_yahoo_skype —— attacker: iranian_hacker<span class="cursor-blink">_</span>_
On 15 March 2011, Comodo, one of the world's largest certificate authorities, disclosed that an attacker had compromised one of its registration authority (RA) partners — a reseller authorised to validate and issue SSL certificates on Comodo's behalf — and used the access to fraudulently issue nine SSL certificates for high-value domains including mail.google.com, login.yahoo.com, login.skype.com, addons.mozilla.org, and login.live.com (Microsoft).
A fraudulent SSL certificate for mail.google.com, combined with DNS manipulation or network-level interception, would allow an attacker to perform a man-in-the-middle attack on Gmail traffic — intercepting emails, passwords, and attachments while the victim's browser displayed the trusted padlock icon. The attacker, who later identified himself online as a 21-year-old Iranian claiming patriotic motivation, stated his objective was to enable surveillance of Iranian dissidents' communications — the same motivation behind elements of Operation Aurora.
We'll scope your test for free and tell you exactly what you need. No obligation, no hard sell.
Free Scoping CallThe HTTPS padlock icon — the indicator that tells users their connection is secure — depends on the certificate authority system. Any CA trusted by the browser can issue a certificate for any domain. If a CA is compromised, an attacker can issue certificates that browsers will accept as legitimate. The Comodo breach demonstrated that the CA system's weakest link is not the cryptography — it is the human and organisational processes at hundreds of CAs and their reseller partners worldwide.
For organisations that depend on HTTPS (which is every organisation), the Comodo breach established that trusting the CA system blindly is insufficient. Proactive certificate security includes implementing CAA DNS records (specifying which CAs may issue certificates for your domain), monitoring Certificate Transparency logs for unauthorised issuance, deploying HSTS (HTTP Strict Transport Security) to prevent downgrade attacks, and including TLS configuration in your web application penetration testing scope.
SOC in a Box provides continuous monitoring including CT log surveillance. Our infrastructure testing assesses your TLS configuration, certificate management, and HTTPS deployment. Cyber Essentials establishes baseline security configuration. And UK Cyber Defence provides incident response when certificate-related attacks are detected.
Our <a href="/penetration-testing/web-application">web application testing</a> includes TLS configuration review and certificate security assessment. <a href="https://www.socinabox.co.uk">SOC in a Box</a> monitors Certificate Transparency logs for unauthorised certificates. Because the padlock only means something if the certificate behind it is genuine.
We'll scope your test for free and tell you exactly what you need. No obligation, no hard sell.
Free Scoping Call