DigiNotar Hacker Comes Out
Almost from the beginning of the DigiNotar CA Disaster (report here), we had a reason to believe the case was connected to “ComodoGate” — the hacking of another Certificate Authority earlier this year, by an Iranian attacker. — This connection has now been confirmed.
Context & Ripple Effects
The DigiNotar incident followed a March successful Comodo certificate-authority attack that was already attributed to an Iranian attacker. Confirmation of the connection turns two breaches into a repeated compromise pattern affecting the same trust layer.
Reports of more than 200 potentially stolen SSL certificates and alleged targeting of intelligence agencies sharpened the stakes: fraudulent certificates are not merely a vendor-security problem when they can be used against high-value communications.
First-order effects
- DigiNotar and the previously breached Comodo are tied to the same confirmed attacker, making their certificate-issuance security and incident response part of one connected risk assessment.
- Browser vendors and organizations relying on certificates issued by DigiNotar face greater urgency to determine which certificates and communications may be affected by the breach.
Second-order effects
- Other certificate authorities must contend with customers and browser vendors judging them against two related compromises, increasing pressure for stronger controls and clearer evidence of compromise detection.
- Security teams protecting high-value targets, including those named in reports of intelligence-agency targeting, must treat certificate trust as a potential interception path rather than solely a routine authentication dependency.
Third-order effects
- Repeated attacks on certificate authorities expose an auditability gap in a web trust model where compromise at one issuer can affect many relying parties.
- If certificate-authority compromises continue to be linked across providers, browser trust decisions are likely to place more weight on issuers' operational security and disclosure practices, not just their technical role in issuing certificates.
The trend: The DigiNotar and Comodo incidents are a data point in growing scrutiny of centralized certificate authorities as high-leverage targets in web-security attacks.