AfterDawn: Tech news

Iran blamed for net security attack

Written by James Delahunty @ 25 Mar 2011 8:51 User comments (1)

Iran blamed for net security attack

The finger of blame is being pointed at Iran in what's being called a state-driven attack on Internet security.
Attackers managed to trick a HTTPS/TLS Certificate Authority into issuing fraudulent certificates. The improperly issued certs covered high-value domains including google.com, login.yahoo.com and addons.mozilla.org. One cert was for "global trustee" which could have enabled the impersonation of any domain on the web.

The CA involved, Comodo, said that one fraudulent login.yahoo.com cert was briefly deployed on an Iranian server. The attack on Comodo came primarily from IP addresses from Iran.

The system attacked acts as a guarantee of identity for some of the world's most popular web services. The certificate acts as a digital passport which is checked by the web browser in use. Most browsers have since been updated to detect the use of the bogus certificates to protect users. An obtained fraudulent certificate could aid in impersonating a popular web service on a malicious server.



Comodo said the attack exhibited "clinical accuracy" and added it was likely to be a state-driven attack. Since it came from Iranian sources and appears to have targeted mainly web communications services, it is thought to have been carried out at the request of Iranian authorities in pursuit of opposition groups in the country that use the web to coordinate their activities on the ground.

The incident has raised questions about web security in general. An article on the Electronic Frontier Foundation's website is worth a read.

Tags: Iran
Previous Next  

1 user comment

126.3.2011 04:25

Mozilla admits to mishandling Comodo disclosure....
http://goo.gl/fb/V33fX

Microsoft Shuts off HTTPS in Hotmail for Over a Dozen Countries:
http://goo.gl/fb/1RpLu

This message has been edited since its posting. Latest edit was made on 26 Mar 2011 @ 4:45

Comments have been disabled for this article.

Latest news

Roomba Combo j7+ review - Clever trick allows robot vacuum finally to tackle home with rugs and carpets Roomba Combo j7+ review - Clever trick allows robot vacuum finally to tackle home with rugs and carpets (06 Jun 2023 9:19)
Roomba Combo j7+ is the very first Roomba model to combine robot vacuum with mopping features. And Roomba Combo j7+ does all that with a very clever trick, which tackles the problem with mopping and carpets. But is it any good? We found out.
Neato, the robot vacuum company, ends its operations Neato, the robot vacuum company, ends its operations (02 May 2023 3:38)
Neato Robotics has ceased its operations. American robot vacuum pioneer founded in 2005 has finally called it quits and company will cease its operations and sales. Only a skeleton crew will remain who will keep the servers running until 2028.
5 user comments
How to Send Messages to Yourself on WhatsApp How to Send Messages to Yourself on WhatsApp (20 Mar 2023 1:25)
The world's most popular messaging platform, Meta-owned WhatsApp has enabled sending messages to yourself. While at first, this might seem like an odd feature, it can be very useful in a lot of situations. ....
18 user comments
How to Enable Bluetooth on Stadia Controller How to Enable Bluetooth on Stadia Controller (11 Feb 2023 1:04)
Google shut down its streaming game service Stadia late last month and this means that some people have Stadia controllers lying around that seem to be of no use. That is fortunately not the ....
2 user comments
Guide: How to Kick Unwanted Guests from Your Netflix Account Guide: How to Kick Unwanted Guests from Your Netflix Account (26 Jan 2023 2:14)
Sharing a Netflix account with a person in a different location is possible and indeed very common, although the company doesn't necessarily enjoy this behavior from their customers. However, ....

News archive