Penetration Test Report (Fox-IT): Fox IT   DigiNotar

Black Tulip
Report of the investigation into the
DigiNotar Certificate Authority breach
Classification PUBLIC
Customer Ministry of the Interior and Kingdom Relations
Project no./Ref. no. PR-110202
Date 13 August 2012
Version 1.0
Team Hans Hoogstraaten (Team leader)
Ronald Prins (CEO)
Daniël Niggebrugge
Danny Heppener
Frank Groenewegen
Janna Wettinck
Kevin Strooy
Pascal Arends
Paul Pols
Robbert Kouprie
Steffen Moorrees
Xander van Pelt
Yun Zheng Hu
Business Unit Cybercrime
Pages 101
WARNING
Misuse of this document or any of its information is prohibited and will be prosecuted to the maximum penalty
possible. Fox-IT cannot be held responsible for any misconduct or malicious use of this document by a third party or
damage caused by any information this document contains.
Fox-IT BV
Olof Palmestraat 6
2616 LM Delft
P.O. box 638
2600 AP Delft
The Netherlands
Phone: +31 (0)15 284 7999
Fax: +31 (0)15 284 7990
Email: fox@fox-it.com
Internet: www.fox-it.com
Trademark
Fox-IT and the Fox-IT logo are trademarks of Fox-IT BV. All other trademarks mentioned in this document are owned
by the mentioned legacy body or organization. The general service conditions of Fox-IT BV apply to this
documentation, unless it is explicitly specified otherwise.
PUBLIC 2
Management summary
DigiNotar B.V. was founded as a privately-owned notarial collaboration in 1998. DigiNotar provided digital
certificate services as a Trusted Third Party and hosted a number of Certificate Authorities (CAs). The
certificates issued by DigiNotar were trusted worldwide to secure digital communication on the basis of a
Public Key Infrastructure (PKI). The services that DigiNotar provided included issuing Secure Sockets
Layer (SSL) certificates to secure websites, issuing accredited qualified certificates that could be used as
the legal equivalent of a handwritten signature and issuing PKIoverheid certificates for various Dutch
eGovernment purposes. In June and July of 2011 DigiNotar suffered a breach, which resulted in rogue
certificates being issued that were subsequently abused in a large scale attack in August of 2011.
Following the detection of the breach on July 19 of 2011, DigiNotar took several measures to control the
incident, including the revocation of known rogue certificates and the hiring of a third party specialized in
IT security to investigate the intrusion. At the end of July 2011, DigiNotar was under the impression that
the intrusion of its network and services had been contained. On August 28, 2011, the content of a rogue
wildcard certificate for the google.com domain was posted publicly, which had been issued by DigiNotar
but which had not yet been revoked. For weeks the rogue certificate had been abused in a large scale
Man-In-The-Middle (MITM) attack on approximately 300,000 users that were almost exclusively located
in the Islamic Republic of Iran. Traffic that was intended for Google subdomains is likely to have been
intercepted or redirected during the MITM-attack, potentially exposing the contents of the intercepted
traffic as well as the Google credentials of the affected users.
On August 30, 2011, Fox-IT was asked to investigate the breach at DigiNotar. In the ensuing
investigation traces were recovered that indicated that the outer limits of DigiNotar's network were first
breached on June 17, 2011. The network that was used by DigiNotar was segmented and the Secure-net
network segment that contained all the CA servers could not directly be reached from the Internet. By
tunneling connections through other compromised systems in DigiNotar's network, the intruder gained
access to the Secure-net network segment on July 1, 2011. The first attempts to create rogue certificates
were made on July 2 and the first rogue certificate was successfully issued on July 10, 2011.
The investigation by Fox-IT showed that all eight servers that managed Certificate Authorities had been
compromised by the intruder. The log files were generally stored on the same servers that had been
compromised and evidence was found that they had been tampered with. Consequently, while these log
files could be used to make inconclusive observations regarding unauthorized actions that took place, the
absence of suspicious entries could not be used to conclude that no unauthorized actions took place.
Serial numbers for certificates that did not match the official records of DigiNotar were recovered on
multiple CA servers, including the Qualified-CA server which was used to issue both accredited qualified
and government certificates, indicating that these servers may have been used to issue additional and
currently unknown rogue certificates.
A fingerprint that was left by the intruder was recovered on a Certificate Authority server, which was also
identified after the breach of the Certificate Service Provider Comodo in March of 2011. Over the course
of the intrusion at DigiNotar, the intruder used multiple systems as proxies in order to obscure his true
identity. However, several traces were recovered during the investigation by Fox-IT that independently
point to a perpetrator located in the Islamic Republic of Iran. A complete list of all the IP-addresses that
were identified during the investigation that are suspected to have been abused by the intruder were
handed over to the Dutch police (KLPD).
The intruder at DigiNotar appears to have had the specific intention of abusing certificates that had been
issued by a trusted party in order to spy on a large number of users in the Islamic Republic of Iran. The
intrusion at DigiNotar and the ensuing MITM-attack resulted in an erosion of trust of the general public in
the existing Public Key Infrastructure, which is central to its operation. Given the impact of a breach at a
Certificate Authority on the Public Key Infrastructure as a whole, ensuring the security of every Certificate
Authority is paramount to the trust in a Public Key Infrastructure and its role in providing security for a
diverse range of activities on the Internet. While the approach to protecting the potential targets from
this type of intrusion does not differ significantly from other threats, the range of scenarios that need to
be taken into account is rapidly expanding.
PUBLIC 3
Investigative summary
Commissioning of Fox-IT and subsequent measures
On August 30, 2011, Fox-IT was asked by DigiNotar to investigate the intrusion of its network. One of the
first measures taken by Fox-IT was to place an incident monitoring service on DigiNotar’s network, to
determine if unauthorized activity was still taking place. A sensor captures and monitors all traffic
between the internal network and the Internet. For the Fox-IT monitoring service, at least one person is
on standby at all times to analyze suspicious traffic in real time. Additionally, the behavior of the Online
Certificate Status Protocol (OCSP) responder1 at DigiNotar was changed on September 1, 2011 as a
precautionary measure, which effectively revoked all remaining rogue certificates that had been issued by
the intruder.
On September 3, 2011, an operational director that acted on behalf of the Dutch state was appointed by
the board of DigiNotar under Power of Attorney and the Dutch state. An interim report with preliminary
findings was provided to DigiNotar and was published on September 5, 2011 by the Dutch state. At the
instruction of the Dutch National Police Services Agency (KLPD) and the public prosecutor’s office (OM),
identifying evidence regarding the intruder was specifically included in the continued investigation. This
definitive report is the outcome of that fact finding investigation performed by Fox-IT into the intrusion of
DigiNotar’s network and the subsequent MITM attack.
The primary aims of the combined investigation that Fox-IT performed at the request of DigiNotar and
the Dutch Ministry of the Interior and Kingdom Relations (BZK) were to determine how DigiNotar’s
network had been breached, to what extent it had been br