9 fraudulent digital certificates on the loose, Microsoft warns

Certificates seemingly associated with popular websites could be used for a variety of attacks

Nine fraudulent digital certificates associated with legitimate, popular websites are in circulation on the Internet and could be used for a number of malicious activities.

Microsoft described the problem in Security Advisory 2524375. The unauthorized certificates, issued by root certificate authority company Comodo Group, can allow hackers to carry out attacks and retain information from users through their Internet browsers. One certificate can affect Windows Live ID users, according to Microsoft.

"This is not a Microsoft security vulnerability; however, one of the certificates potentially affects Windows Live ID users via login.live.com," wrote Bruce Cowper, manager of the Microsoft Trustworthy group, in a blog posting. "These certificates may be used to spoof content, perform phishing attacks, or perform man-in-the-middle attacks against end users. We are unaware of any active attacks."

It was also reported that the fraudulent certificates offered to Comodo for authentication came from an Iranian IP address.

"An attacker obtained the username and password of a Comodo Trusted Partner in Southern Europe," wrote Phillip Hallam-Baker, a lead contributer at Comodo, in a blog post. "We are not yet clear about the nature or the details of the breach suffered by that partner other than knowing that other online accounts (not with Comodo) held by that partner were also compromised at about the same time."

The reasoning behind the hack was not discovered. However, Hallam-Baker theorized that the individuals responsible could be part of a government wanting to keep tabs on unrest or rebel groups. He also said that while the IP address was traced to Iran, the location could be a false trail for anyone searching for the culprits.

According to Microsoft, certificates associated with the following Web sites are affected:

  • addons.mozilla.org
  • login.skype.com
  • login.live.com
  • mail.google.com
  • www.google.com
  • login.yahoo.com (3 certificates)
  • "Global Trustee"

Since the disclosure, Comodo has retracted the certificates in question and listed them on its Certificate Revocation List. Users with the Online Certificate Status Protocol (OCSP) enabled in their browser will automatically have the fraudulent certificates blocked, according to Microsoft.

Microsoft, Google and the Mozilla Foundation have all since released patches and updates to their individual browsers. The Mozilla Foundation, in a press release, wrote that "current versions of Firefox are protected from this attack. We are still evaluating the possibility of further response to this issue. We encourage all users to keep their software up to date by regularly applying security updates."

For Windows users, an automatic security update is now available for all supported versions of Microsoft's OS.

Reader Comments

Tue, Apr 5, 2011

Why wouldn't such important accounts be protected with state-of-the-art biometrics, like Bio-key's fingerprint authentication? Usernames and passwords?

Tue, Mar 29, 2011 R T Romero Sandy Eggo

They still haven't figured out the Comodo cert trick I know.... However until the SMTP trap is off my email no one will be informed...

Please post your comments here. Comments are moderated, so they may not appear immediately after submitting. We will not post comments that we consider abusive or off-topic.

Please type the letters/numbers you see above