Episode
01 October 2017 Official episode · Official transcript
advanced persistent threat
The episode examines the DigiNotar certificate-authority breach, rogue certificates, and the resulting man-in-the-middle attack against Iranian Gmail users.
Topics: Certificate authorities and browser root stores, TLS/SSL certificate validation, Weakest-link risk in CA trust, Rogue or mis-issued certificates, Man-in-the-middle attacks, DNS poisoning and traffic redirection, Certificate revocation lists, Public key pinning, Emergency certificate revocation with OneCRL, Network segmentation and firewall bypass, Brute-forcing administrative passwords, Central logging and separation of critical systems
Links published on the Darknet Diaries episode page. Not LLM output.
No Sources heading on this episode page.
Qualified statements from this episode, not graph facts.
DigiNotar breach COMPROMISES DigiNotar
The incident was a breach in which a hacker entered and thoroughly penetrated DigiNotar's network.
Explicit Confidence 99% · Jack Rhysider EP 3 Details
“In the summer of 2011, DigiNotar made such a mistake and a hacker entered their network.”
DigiNotar breach CONTAINS rogue certificates
The breach resulted in the intruder issuing many rogue certificates, including certificates for Google domains.
Explicit Confidence 99% · Josephine Wolff EP 3 Details
“The intruder is able to issue a bunch of rogue certificates in the names of a whole variety of different domains.”
DigiNotar breach INVOLVES man-in-the-middle attack
The rogue certificates were used to conduct a man-in-the-middle attack against Gmail users in Iran.
Explicit Confidence 99% · Jack Rhysider EP 3 Details
“The hacker then took these certificates and proceeded to create a man-in-the-middle attack.”
DigiNotar breach INVOLVES DNS poisoning
DNS poisoning was presented as the best-supported theory for how users were redirected to the attacker's server, but the episode says this is not known definitively.
Uncertain Confidence 91% · Jack Rhysider EP 3 Details
“the best theory with the most supporting facts is he did a DNS poisoning attack”
“There’s no definitive proof that’s how the redirect happened.”
DigiNotar breach TARGETS Iran
The attack appeared to target Iranian civilians and redirected people in Iran to fraudulent sites.
Explicit Confidence 97% · Jack Rhysider EP 3 Details
“This attack seemed to be targeting Iranian civilians.”
DigiNotar breach DISCOVERED_BY Google
Google detected a mis-issued DigiNotar certificate being used in active attacks on users in Iran.
Explicit Confidence 99% · Gervase Markham EP 3 Details
“Google notified us that they had detected a mis-issued certificate for starter, google.com which was being used in active attacks on users in Iran.”
DigiNotar breach INVOLVES domain administrator account
Fox-IT found that DigiNotar's Windows domain administrator account had a simple password that was easy to brute force.
Explicit Confidence 98% · Jack Rhysider EP 3 Details
“They found the Windows domain administrator account had a simple password and was easy to brute force.”
DigiNotar breach ATTRIBUTED_TO Comodo Hacker
The person calling himself the Comodo Hacker claimed responsibility for also hacking DigiNotar, but this is based on a Pastebin claim rather than a confirmed identification.
Attributed Confidence 86% · Jack Rhysider EP 3 Details
“This Comodo hacker now takes credit for also hacking into DigiNotar”
DigiNotar breach ATTRIBUTED_TO National Security Agency
Bruce Schneier said the incident may have been the work of the NSA or an exploit of the NSA, based mainly on a leaked document showing NSA access to DigiNotar; the episode characterizes this theory as weak.
Uncertain Confidence 78% · Jack Rhysider EP 3 Details
“Bruce Schneier, a prominent security expert says it may be the work of NSA or an exploit of NSA”
“This theory isn’t very strong and has almost no other evidence”
DigiNotar breach ATTRIBUTED_TO Iranian government
The episode presents it as a strong theory that the hack was carried out by the Iranian government itself or by someone helping it, possibly to spy on dissidents.
Uncertain Confidence 82% · Jack Rhysider EP 3 Details
“It’s a strong theory that this hack was done by the Iranian government itself or someone trying to help the Iranian government.”
DigiNotar ASSOCIATED_WITH VASCO
VASCO bought DigiNotar in early 2011 for almost 13 million dollars.
Explicit Confidence 99% · Jack Rhysider EP 3 Details
“In early 2011 VASCO bought DigiNotar for almost 13 million dollars.”
public key pinning USES Google Chrome
Google used public key pinning in Chrome to accept only certificates issued from Google's CA and detect the DigiNotar certificate.
Explicit Confidence 98% · Jack Rhysider EP 3 Details
“They forced Chrome to only accept certificates issued from Google’s CA, essentially pinning the certificate to a specific CA.”
Firefox uses OneCRL as an emergency revocation system to block certificates without requiring a browser update.
Explicit Confidence 99% · Gervase Markham EP 3 Details
“We have a system called OneCRL which is, if you like, an emergency revocation system.”
Works mentioned in the transcript. Distinct from show-note sources.
Model gpt-5.6-luna · prompt 1.5.19 · schema 1.5.19 · 2026-09-12T17:48:19.939543+00:00