9 fraudulent digital certificates on the loose, Microsoft warns
Connecting state and local government leaders
The certificates, seemingly associated with popular websites, could be used for spoofing, phishing or man-in-the-middle attacks.
Nine fraudulent digital certificates associated with legitimate, popular websites are in circulation on the Internet and could be used for a number of malicious activities.
Microsoft described the problem in Security Advisory 2524375. The unauthorized certificates, issued by root certificate authority company Comodo Group, can allow hackers to carry out attacks and retain information from users through their Internet browsers. One certificate can affect Windows Live ID users, according to Microsoft.
"This is not a Microsoft security vulnerability; however, one of the certificates potentially affects Windows Live ID users via login.live.com," wrote Bruce Cowper, manager of the Microsoft Trustworthy group, in a blog posting. "These certificates may be used to spoof content, perform phishing attacks, or perform man-in-the-middle attacks against end users. We are unaware of any active attacks."
It was also reported that the fraudulent certificates offered to Comodo for authentication came from an Iranian IP address.
"An attacker obtained the username and password of a Comodo Trusted Partner in Southern Europe," wrote Phillip Hallam-Baker, a lead contributer at Comodo, in a blog post. "We are not yet clear about the nature or the details of the breach suffered by that partner other than knowing that other online accounts (not with Comodo) held by that partner were also compromised at about the same time."
The reasoning behind the hack was not discovered. However, Hallam-Baker theorized that the individuals responsible could be part of a government wanting to keep tabs on unrest or rebel groups. He also said that while the IP address was traced to Iran, the location could be a false trail for anyone searching for the culprits.
According to Microsoft, certificates associated with the following Web sites are affected:
- addons.mozilla.org
- login.skype.com
- login.live.com
- mail.google.com
- www.google.com
- login.yahoo.com (3 certificates)
- "Global Trustee"
Since the disclosure, Comodo has retracted the certificates in question and listed them on its Certificate Revocation List. Users with the Online Certificate Status Protocol (OCSP) enabled in their browser will automatically have the fraudulent certificates blocked, according to Microsoft.
Microsoft, Google and the Mozilla Foundation have all since released patches and updates to their individual browsers. The Mozilla Foundation, in a press release, wrote that "current versions of Firefox are protected from this attack. We are still evaluating the possibility of further response to this issue. We encourage all users to keep their software up to date by regularly applying security updates."
For Windows users, an automatic security update is now available for all supported versions of Microsoft's OS.