DigiNotar (2011)

Date 	June 17, 2011. DigiNotar detected an intrusion into its Certificate Authority infrastructures on 19 July 2011.P Bright, “Independent Iranian hacker claims responsibility for Comodo hack”, (28 March 2011), Ars Technica.
Suspected actor	An independent Iranian hacker under the name of “Comodohacker”.E Mills, “Google users in Iran targeted in SSL spoof”, (30 August 2011), CNET. A report published by Fox-IT,Fox-IT, “DigiNotar public report version 1”, (5 September 2011), Government of the Netherlands. a security consultancy company hired by the Dutch government to investigate the breach against DigiNotar, found a link to an earlier attack conducted by the same actor against the Comodo Certificate Authority company. T Espiner, “DigiNotar hack details revealed by Dutch government”, (2 November 2012), SC Media UK.
Target 	DigiNotar, a Dutch Certificate Authority company owned by Vasco Data Security Itl. DigiNotar was also providing certificates for the Dutch government.S Frantzen, “DigiNotar breach - the story so far”, (1 September 2011), Sans InfoSec Diary Blog.
Target systems 	Servers managing the certificate authorities within the DigiNotar company.
Method 	The attacker entered the servers in DigiNotar’s external Demilitarized Zone (called DMZ-ext-net), exploiting them for exchanging files between internal and external systems. After breaching DigiNotar’s Secure-net, the hacker was able to penetrate deeper, reaching the Qualified-CA servers, which were exploited to issue accredited qualified as well as government certificates. D Fisher, “Final Report on DigiNotar Hack Shows Total Compromise of CA Servers”, (31 October 2012), Threatpost.
Purpose 	The hacker described the attack as a political retaliation against the Dutch government for failing to prevent the Srebrenica genocide, which saw the death of 8,000 Muslims during the Bosnian conflict in 1995.COMODOHACKER, “Striking Back…”, (5 September 2011), Pastebin.
Result 	After preliminary investigations, all certificates issued by DigiNotar have been deemed untrustworthy by major companies such as Microsoft,MSRC Team, “Microsoft updates Security Advisory 2607712”, (6 September 2011), Microsoft TechNet Blog. Google and Mozilla.C Arthur and Agencies, “DigiNotar SSL certificate hack amounts to cyberwar, says expert”, (5 September 2011), The Guardian. As the intruder was able to delete all log files, the extent of the damage cannot be calculated and the exact number of fraudulent certificates issued by the hacker cannot be established.J Leyden, “Inside 'Operation Black Tulip': DigiNotar hack analysed”, (6 September 2011), The Register. The Fox-IT audit report on the incident provided a non-exhaustive list of 531 rogue certificates that has been issued by the malicious actor, comprehending Google, Facebook, Skype, and Microsoft. F Rosch, “DigiNotar SSL Breach Update”, (7 September 2011), Symantec Official Blog.
Aftermath 	Due to the impossibility to detect many of the rogue certificates issued since the breach suffered by DigiNotar, all of the certificates released by the company have been blacklisted.K Zetter, “DigiNotar Files for Bankruptcy in Wake of Devastating Hack”, (20 September 2011), Wired. Ultimately, the breach resulted in a huge loss of trust and the company dissolved by declaring bankruptcy.ENISA, “Operation Black Tulip: Certificate authorities lose authority”, ENISA report.
Analysed in 	Scenario 08: Certificate authority hack
Collected by: Samuele De Tomas Colatin
Category:Example
Category:2011