Incident
incident:diginotar_breach
Also: DigiNotar compromise
2011 compromise of DigiNotar in which attackers issued hundreds of rogue certificates and undermined trust in the CA.
2011 compromise of DigiNotar in which attackers issued hundreds of rogue certificates and undermined trust in the CA.
“In the summer of 2011, DigiNotar made such a mistake and a hacker entered their network.”
“he ended up issuing 531 rogue certificates.”
| Direction | Predicate | Other entity | Origin | EP |
|---|---|---|---|---|
| outgoing | COMPROMISES | DigiNotar | Explicit | 3 |
| outgoing | CONTAINS | rogue certificates | Explicit | 3 |
| outgoing | INVOLVES | man-in-the-middle attack | Explicit | 3 |
| outgoing | INVOLVES | DNS poisoning | Uncertain | 3 |
| outgoing | TARGETS | Iran | Explicit | 3 |
| outgoing | DISCOVERED_BY | Explicit | 3 | |
| outgoing | INVOLVES | domain administrator account | Explicit | 3 |
| outgoing | ATTRIBUTED_TO | Comodo Hacker | Attributed | 3 |
| outgoing | ATTRIBUTED_TO | National Security Agency | Uncertain | 3 |
| outgoing | ATTRIBUTED_TO | Iranian government | Uncertain | 3 |
DigiNotar breach COMPROMISES DigiNotar
The incident was a breach in which a hacker entered and thoroughly penetrated DigiNotar's network.
Explicit Confidence 99% · Jack Rhysider EP 3 Details
“In the summer of 2011, DigiNotar made such a mistake and a hacker entered their network.”
DigiNotar breach CONTAINS rogue certificates
The breach resulted in the intruder issuing many rogue certificates, including certificates for Google domains.
Explicit Confidence 99% · Josephine Wolff EP 3 Details
“The intruder is able to issue a bunch of rogue certificates in the names of a whole variety of different domains.”
DigiNotar breach INVOLVES man-in-the-middle attack
The rogue certificates were used to conduct a man-in-the-middle attack against Gmail users in Iran.
Explicit Confidence 99% · Jack Rhysider EP 3 Details
“The hacker then took these certificates and proceeded to create a man-in-the-middle attack.”
DigiNotar breach INVOLVES DNS poisoning
DNS poisoning was presented as the best-supported theory for how users were redirected to the attacker's server, but the episode says this is not known definitively.
Uncertain Confidence 91% · Jack Rhysider EP 3 Details
“the best theory with the most supporting facts is he did a DNS poisoning attack”
“There’s no definitive proof that’s how the redirect happened.”
DigiNotar breach TARGETS Iran
The attack appeared to target Iranian civilians and redirected people in Iran to fraudulent sites.
Explicit Confidence 97% · Jack Rhysider EP 3 Details
“This attack seemed to be targeting Iranian civilians.”
DigiNotar breach DISCOVERED_BY Google
Google detected a mis-issued DigiNotar certificate being used in active attacks on users in Iran.
Explicit Confidence 99% · Gervase Markham EP 3 Details
“Google notified us that they had detected a mis-issued certificate for starter, google.com which was being used in active attacks on users in Iran.”
DigiNotar breach INVOLVES domain administrator account
Fox-IT found that DigiNotar's Windows domain administrator account had a simple password that was easy to brute force.
Explicit Confidence 98% · Jack Rhysider EP 3 Details
“They found the Windows domain administrator account had a simple password and was easy to brute force.”
DigiNotar breach ATTRIBUTED_TO Comodo Hacker
The person calling himself the Comodo Hacker claimed responsibility for also hacking DigiNotar, but this is based on a Pastebin claim rather than a confirmed identification.
Attributed Confidence 86% · Jack Rhysider EP 3 Details
“This Comodo hacker now takes credit for also hacking into DigiNotar”
DigiNotar breach ATTRIBUTED_TO National Security Agency
Bruce Schneier said the incident may have been the work of the NSA or an exploit of the NSA, based mainly on a leaked document showing NSA access to DigiNotar; the episode characterizes this theory as weak.
Uncertain Confidence 78% · Jack Rhysider EP 3 Details
“Bruce Schneier, a prominent security expert says it may be the work of NSA or an exploit of NSA”
“This theory isn’t very strong and has almost no other evidence”
DigiNotar breach ATTRIBUTED_TO Iranian government
The episode presents it as a strong theory that the hack was carried out by the Iranian government itself or by someone helping it, possibly to spy on dissidents.
Uncertain Confidence 82% · Jack Rhysider EP 3 Details
“It’s a strong theory that this hack was done by the Iranian government itself or someone trying to help the Iranian government.”