7 ms·

DigiNotar Damage Disclosure (with full list of issued certs)

178 points by jen_h 15y ago

deleted 15y ago
[deleted]
jackowayed 15y ago
The most egregious certs issued were for *.*.com and *.*.org Why is that even possible? Does it ever make sense for that to exist? If the browsers currently accept that, I wouldn't be surprised if they stop accepting that since it almost certainly means someone got ahold of certs they shouldn't have.
- rhizome 15y ago
  HN eats asterisks, so for everybody else in tl;dr-land: "x.x.com" and "x.x.org". Diginotar is looking worse and worse with every revelation, which is probably why they're attempting the silent treatment. This article says "their audit trail is incomplete." Frankly, I think this should be approaching criminality, though I don't think the law has caught up to that. It's an egregious shitting-on-the-internet by Diginotar, though.
  - jackowayed 15y ago
    Thanks, did my best to fix. The spaces are suboptimal, but a least the *'s are there.
    - sp332 15y ago
      If you put two spaces at the beginning of the line, HN will ignore *asterisks*, switch to monospace, and won't wrap.
- 0x0 15y ago
  Yeah, I just asked about that in another thread (http://news.ycombinator.com/item?id=2959789 http://news.ycombinator.com/item?id=2959789) and pondered the use of the public suffix list for limiting wildcards.
- Duff 15y ago
  Many proxy servers within companies use such certificates to scan incoming traffic for malware/policy violations.
  - tptacek 15y ago
    It's just as easy for a proxy server to cut per-site certificates on the fly.
- tptacek 15y ago
  There is no reason that should have to be possible; it is straightforward for a browser to reject any "wildcard" certificate, and even easier to reject a cert that wants to claim all of ".com". Now, when you think about that, remember: the DNSSEC trust model starts with an entity that can sign anything under .COM. You can't not have that entity in DNSSEC. Now you understand one reason I think DNSSEC sucks.
  - __david__ 15y ago
    I don't know, it still seems better to me than our current situation which is 300 attack surfaces that are all effectively *.*
    - throwaway32 15y ago
      its much worse than that, there are an unknown amount of intermediate CAs that also have this abillity. Several CAs sell these certs freely. So not only can one of the 300 CAs get compromised and totally destroy ssl security, so can a large amount of people you have _no information about at all_.
    - bdonlan 15y ago
      It's also a LOT easier to recover from a key breach - you expire the old *.com certificate, and publish a new one under the root. No problem. The root key, of course, must be VERY carefully guarded - but since updates are infrequent, this can happen on an isolated system with no network connection (or even more paranoid systems, such as secret sharing schemes...)
      - tptacek 15y ago
        You can recover from a breach like Diginotar's instantly; just remove their cert from your browser. You have no control over .COM's recovery from a breach.
    - tptacek 15y ago
      You or I can point or click our way through dealing with a breach of a TLS certificate. Tell me what you'd personally do to deal with a rumored breach or misuse of .COM? Remember: under DNSSEC, Libya would have been BIT.LY's CA.
Tharkun 15y ago
Many thanks to the Tor folks for this disclosure, at least they (and other browser providers) are taking responsibility where Diginotar would not. It seems likely that Diginotar will be going out of business shortly, and rightly so, but I don't think this should stop there. Their lack of communication is very troubling. Not sure what their contractual obligations are, but when supplying trusted SSL certs trust seems pretty important, so maybe it's possible to sue for damages since that trust was obviously broken?
- stephank 15y ago
  As a Dutch citizen, I am ashamed our own government's CA was compromised. And I'm a bit angry, because this hardly concerns just us but the entire secure web. Frankly, I'm hoping for a lot more than just damages.
  - X-Istence 15y ago
    No, the Dutch root certificates were not compromised, insofar as I am aware. Root certs for services provided to the Dutch public were compromised as they were distributed through DigiNotar. The Dutch government has entirely different root certificates and it is where they are currently handing out certificates from to fix various different services that were using the DigiNotar certs.
- n0on3 15y ago
  The whole CA trust model is a complete mess. I suggest interested people to google for the work from moxie marlinspike (@moxie__), e.g., presentation from last BH (http://bit.ly/rbqMCq http://bit.ly/rbqMCq) and convergence (http://convergence.io/ http://convergence.io/).
  - Joakal 15y ago
    Full link: https://media.blackhat.com/bh-us-11/Marlinspike/BlackHat-USA-2011-Marlinspike-SSL-Future-Authenticity-SlidesOnly.mov https://media.blackhat.com/bh-us-11/Marlinspike/BlackHat-USA...
- 15y ago
joelhaasnoot 15y ago
Was just logging into the e-service portal DigiD which previously had a Government cert verified by DigiNotar. Now it's verified by Getronics PinkRoccade, a big dutch IT-services company belonging to former state-owned telco KPN.
- troels 15y ago
  I'm wondering. Considering how important these things are, would it make sense that governments set up their own CA?
  - onedognight 15y ago
    They have. Take a look at the default root CA list in your browser. The big governments are represented and therefore can MITM anyone they want.
    - dredmorbius 15y ago
      The fact that Honest Achmed's Used Cars & Ceritficates would, if issued a root cert, be as able as any other certificate authority to issue a cert for any entity including: *.*.com *.*.org ... is like saying that you'll accept a US Passport issued by any country in the world, including, say, North Korea or Iran. While the crypto behind SSL/TLS is strong, the trust model is very clearly very broken. With governments able to issue certs, as onedognight notes, there's no option of a commercial death sentence. As experiences with RIM/India and Microsoft / Google and China show, at least some governments would be able to apply sufficient pressure on software producers to be able to at least make governmental root revocation not automatic in all circumstances. http://www.livehacking.com/2011/04/25/honest-achmeds-used-cars-and-certificates-wants-to-become-a-trusted-certificate-authority/ http://www.livehacking.com/2011/04/25/honest-achmeds-used-ca...
      - ctz 15y ago
        Let's be clear: the SSL/TLS protocol specifies no certification structure. This structure was built by the members of CAB in the relatively distant past. It /is/ possible to use TLS to make a genuinely good secure web. Unfortunately at the moment there isn't a strong enough economic reason to fix the current certification structure -- while fundamentally broken, it isn't broken enough in practice yet. Something like an large ISP-level compromise of banking services using mis-issued certificates would probably incur some action.
xpaulbettsx 15y ago
If you're running Windows, you need to disable this root CA immediately, as you are now vulnerable to having arbitrary code run on your machine as SYSTEM if someone spoofs Windows Update.
cft 15y ago
Iranian govmnt revenge for stuxnet?
xtacy 15y ago
Is there an AdBlock like community collected list of "safe" certificates that I should have in my system? Till date, I have removed COMODO, DigiNotar, but I suspect there are more.
- sp332 15y ago
  Maybe check out convergence.io? Also Certificate Patrol http://patrol.psyced.org/ http://patrol.psyced.org/ , Perspectives http://perspectives-project.org/ http://perspectives-project.org/ , or just plain SSL Blacklist http://codefromthe70s.org/sslblacklist.aspx http://codefromthe70s.org/sslblacklist.aspx .
shabble 15y ago
I don't know if this has been covered in one of the other threads (no obvious searches showed it up): As an attacker, why would you choose to limit the valid-until date on certificates you generate to a very small value? You might expect people to notice they're being MitM'd fairly fast, and the breach to be uncovered and your certs distrusted quickly, but that's not really a good reason to deliberately limit yourself. The only sensible answer I can think of is that maybe there is some internal auditing that generating very short-duration certificates gets around? Anyone got any better ideas?
tzury 15y ago
facebbok, google, cia, skype, twitter, mozilla, logmein, and many more, scary! https://svn.torproject.org/svn/projects/misc/diginotar/rogue-certs-2011-09-04.csv https://svn.torproject.org/svn/projects/misc/diginotar/rogue...
zby 15y ago
some more info: http://blog.gerv.net/2011/09/diginotar-compromise/ http://blog.gerv.net/2011/09/diginotar-compromise/
merlincorey 15y ago
Grepping for "Tehran" revealed more secret messages: Extended Validation CA","unknown","unknown",".SahebeDonyayeDigital.com","CN=.SahebeDonyayeDigital.com,SN=PK000229200006592,OU=Elme Bikaran,L=Tehran,O=Daneshmande Bi nazir,C=IR" "2011-07-10 22:08:31","585a8ee9017a326d21bd19dce9d9777d","DigiNotar Extended Validation CA","unknown","unknown",".RamzShekaneBozorg.com","CN=.RamzShekaneBozorg.com,SN=PK000229200006593,OU=Sare Toro Ham Mishkanam,L=Tehran,O=Hameye Ramzaro Mishkanam,C=IR" "2011-07-10 22:11:59","aa239bf9fe84b25444be0799f40c9f67","DigiNotar Extended Validation CA","unknown","unknown",".JanamFadayeRahbar.com","CN=.JanamFadayeRahbar.com,SN=PK000229200006594,OU=Sarbaze Gomnam,L=Tehran,O=Ke Jano Janan Toyi,C=IR" Thankfully it seems someone already translated in the comments: --- Translation one --- Sahebeh Donya => Possessor of the World e.g. God. Sarbazeh Gomnam => Unknown Soldier Elme Bikaran => Science/Knowledge of the idle/unemployed Daneshmande Bi nazir => Peerless Scientist RamzShekaneBozorg => Great Cryptanalyst Toro Ham Mishkanam => I will breakTOR too Hameye Ramzaro Mishkanam => Will break all cyphers --- --- Translation Two --- Sahebeh Donya => Possessor of the World e.g. God. Sarbazeh Gomnam => Unknown Soldier Elme Bikaran => Science/Knowledge of the idle/unemployed Daneshmande Bi nazir => Peerless Scientist RamzShekaneBozorg => Great Cryptanalyst Toro Ham Mishkanam => I will breakTOR too Hameye Ramzaro Mishkanam => Will break all cyphers [edited for formatting]
Someone 15y ago
"the currently known bad DigiNotar related certificates" => that list is not necessarily a full list (and, given the reportedly incomplete audit trail, we may never know how long the full list is)
- speleding 15y ago
  It doesn't really matter if there are any other certificates we don't know about. If you don't have the Diginotar root certs block you have a problem, if you do have them blocked it's not relevant whatever else they issued.
sandGorgon 15y ago
hey guys - as an end user, how do I make sure that I am protected ? I mean is there a way to make sure these certificates dont affect me. I'm on Ubuntu Linux and have applied the recent updates... but how can I be sure ?
jdbeast00 15y ago
Wow, is this a typo?? "The most egregious certs issued were for [asterisk].[asterisk].com and [asterisk].[asterisk].org" I didn't know double wildcard certs were possible. This would be extremely helpful for us if that was. Anyone know? (Just to be extra clear, we would like one cert that covers a.b.example.org as well as d.e.example.org, and hopefully also still works for a.example.org) edit: We currently have a *.example.org cert, and while some browsers think that is valid for a.b.example.org, most do not.

178 points by jen_h 15y ago

deleted 15y ago

[deleted]

The most egregious certs issued were for *.*.com and *.*.org Why is that even possible? Does it ever make sense for that to exist? If the browsers currently accept that, I wouldn't be surprised if they stop accepting that since it almost certainly means someone got ahold of certs they shouldn't have.

rhizome 15y ago
HN eats asterisks, so for everybody else in tl;dr-land: "x.x.com" and "x.x.org". Diginotar is looking worse and worse with every revelation, which is probably why they're attempting the silent treatment. This article says "their audit trail is incomplete." Frankly, I think this should be approaching criminality, though I don't think the law has caught up to that. It's an egregious shitting-on-the-internet by Diginotar, though.
- jackowayed 15y ago
  Thanks, did my best to fix. The spaces are suboptimal, but a least the *'s are there.
  - sp332 15y ago
    If you put two spaces at the beginning of the line, HN will ignore *asterisks*, switch to monospace, and won't wrap.
0x0 15y ago
Yeah, I just asked about that in another thread (http://news.ycombinator.com/item?id=2959789 http://news.ycombinator.com/item?id=2959789) and pondered the use of the public suffix list for limiting wildcards.
Duff 15y ago
Many proxy servers within companies use such certificates to scan incoming traffic for malware/policy violations.
- tptacek 15y ago
  It's just as easy for a proxy server to cut per-site certificates on the fly.
tptacek 15y ago
There is no reason that should have to be possible; it is straightforward for a browser to reject any "wildcard" certificate, and even easier to reject a cert that wants to claim all of ".com". Now, when you think about that, remember: the DNSSEC trust model starts with an entity that can sign anything under .COM. You can't not have that entity in DNSSEC. Now you understand one reason I think DNSSEC sucks.
- __david__ 15y ago
  I don't know, it still seems better to me than our current situation which is 300 attack surfaces that are all effectively *.*
  - throwaway32 15y ago
    its much worse than that, there are an unknown amount of intermediate CAs that also have this abillity. Several CAs sell these certs freely. So not only can one of the 300 CAs get compromised and totally destroy ssl security, so can a large amount of people you have _no information about at all_.
  - bdonlan 15y ago
    It's also a LOT easier to recover from a key breach - you expire the old *.com certificate, and publish a new one under the root. No problem. The root key, of course, must be VERY carefully guarded - but since updates are infrequent, this can happen on an isolated system with no network connection (or even more paranoid systems, such as secret sharing schemes...)
    - tptacek 15y ago
      You can recover from a breach like Diginotar's instantly; just remove their cert from your browser. You have no control over .COM's recovery from a breach.
  - tptacek 15y ago
    You or I can point or click our way through dealing with a breach of a TLS certificate. Tell me what you'd personally do to deal with a rumored breach or misuse of .COM? Remember: under DNSSEC, Libya would have been BIT.LY's CA.

Tharkun 15y ago

Many thanks to the Tor folks for this disclosure, at least they (and other browser providers) are taking responsibility where Diginotar would not. It seems likely that Diginotar will be going out of business shortly, and rightly so, but I don't think this should stop there. Their lack of communication is very troubling. Not sure what their contractual obligations are, but when supplying trusted SSL certs trust seems pretty important, so maybe it's possible to sue for damages since that trust was obviously broken?

stephank 15y ago
As a Dutch citizen, I am ashamed our own government's CA was compromised. And I'm a bit angry, because this hardly concerns just us but the entire secure web. Frankly, I'm hoping for a lot more than just damages.
- X-Istence 15y ago
  No, the Dutch root certificates were not compromised, insofar as I am aware. Root certs for services provided to the Dutch public were compromised as they were distributed through DigiNotar. The Dutch government has entirely different root certificates and it is where they are currently handing out certificates from to fix various different services that were using the DigiNotar certs.
n0on3 15y ago
The whole CA trust model is a complete mess. I suggest interested people to google for the work from moxie marlinspike (@moxie__), e.g., presentation from last BH (http://bit.ly/rbqMCq http://bit.ly/rbqMCq) and convergence (http://convergence.io/ http://convergence.io/).
- Joakal 15y ago
  Full link: https://media.blackhat.com/bh-us-11/Marlinspike/BlackHat-USA-2011-Marlinspike-SSL-Future-Authenticity-SlidesOnly.mov https://media.blackhat.com/bh-us-11/Marlinspike/BlackHat-USA...
15y ago

joelhaasnoot 15y ago

Was just logging into the e-service portal DigiD which previously had a Government cert verified by DigiNotar. Now it's verified by Getronics PinkRoccade, a big dutch IT-services company belonging to former state-owned telco KPN.

troels 15y ago
I'm wondering. Considering how important these things are, would it make sense that governments set up their own CA?
- onedognight 15y ago
  They have. Take a look at the default root CA list in your browser. The big governments are represented and therefore can MITM anyone they want.
  - dredmorbius 15y ago
    The fact that Honest Achmed's Used Cars & Ceritficates would, if issued a root cert, be as able as any other certificate authority to issue a cert for any entity including: *.*.com *.*.org ... is like saying that you'll accept a US Passport issued by any country in the world, including, say, North Korea or Iran. While the crypto behind SSL/TLS is strong, the trust model is very clearly very broken. With governments able to issue certs, as onedognight notes, there's no option of a commercial death sentence. As experiences with RIM/India and Microsoft / Google and China show, at least some governments would be able to apply sufficient pressure on software producers to be able to at least make governmental root revocation not automatic in all circumstances. http://www.livehacking.com/2011/04/25/honest-achmeds-used-cars-and-certificates-wants-to-become-a-trusted-certificate-authority/ http://www.livehacking.com/2011/04/25/honest-achmeds-used-ca...
    - ctz 15y ago
      Let's be clear: the SSL/TLS protocol specifies no certification structure. This structure was built by the members of CAB in the relatively distant past. It /is/ possible to use TLS to make a genuinely good secure web. Unfortunately at the moment there isn't a strong enough economic reason to fix the current certification structure -- while fundamentally broken, it isn't broken enough in practice yet. Something like an large ISP-level compromise of banking services using mis-issued certificates would probably incur some action.

xpaulbettsx 15y ago

If you're running Windows, you need to disable this root CA immediately, as you are now vulnerable to having arbitrary code run on your machine as SYSTEM if someone spoofs Windows Update.

cft 15y ago

Iranian govmnt revenge for stuxnet?

xtacy 15y ago

Is there an AdBlock like community collected list of "safe" certificates that I should have in my system? Till date, I have removed COMODO, DigiNotar, but I suspect there are more.

sp332 15y ago
Maybe check out convergence.io? Also Certificate Patrol http://patrol.psyced.org/ http://patrol.psyced.org/ , Perspectives http://perspectives-project.org/ http://perspectives-project.org/ , or just plain SSL Blacklist http://codefromthe70s.org/sslblacklist.aspx http://codefromthe70s.org/sslblacklist.aspx .

shabble 15y ago

I don't know if this has been covered in one of the other threads (no obvious searches showed it up): As an attacker, why would you choose to limit the valid-until date on certificates you generate to a very small value? You might expect people to notice they're being MitM'd fairly fast, and the breach to be uncovered and your certs distrusted quickly, but that's not really a good reason to deliberately limit yourself. The only sensible answer I can think of is that maybe there is some internal auditing that generating very short-duration certificates gets around? Anyone got any better ideas?

tzury 15y ago

facebbok, google, cia, skype, twitter, mozilla, logmein, and many more, scary! https://svn.torproject.org/svn/projects/misc/diginotar/rogue-certs-2011-09-04.csv https://svn.torproject.org/svn/projects/misc/diginotar/rogue...

zby 15y ago

some more info: http://blog.gerv.net/2011/09/diginotar-compromise/ http://blog.gerv.net/2011/09/diginotar-compromise/

merlincorey 15y ago

Grepping for "Tehran" revealed more secret messages: Extended Validation CA","unknown","unknown",".SahebeDonyayeDigital.com","CN=.SahebeDonyayeDigital.com,SN=PK000229200006592,OU=Elme Bikaran,L=Tehran,O=Daneshmande Bi nazir,C=IR" "2011-07-10 22:08:31","585a8ee9017a326d21bd19dce9d9777d","DigiNotar Extended Validation CA","unknown","unknown",".RamzShekaneBozorg.com","CN=.RamzShekaneBozorg.com,SN=PK000229200006593,OU=Sare Toro Ham Mishkanam,L=Tehran,O=Hameye Ramzaro Mishkanam,C=IR" "2011-07-10 22:11:59","aa239bf9fe84b25444be0799f40c9f67","DigiNotar Extended Validation CA","unknown","unknown",".JanamFadayeRahbar.com","CN=.JanamFadayeRahbar.com,SN=PK000229200006594,OU=Sarbaze Gomnam,L=Tehran,O=Ke Jano Janan Toyi,C=IR" Thankfully it seems someone already translated in the comments: --- Translation one --- Sahebeh Donya => Possessor of the World e.g. God. Sarbazeh Gomnam => Unknown Soldier Elme Bikaran => Science/Knowledge of the idle/unemployed Daneshmande Bi nazir => Peerless Scientist RamzShekaneBozorg => Great Cryptanalyst Toro Ham Mishkanam => I will breakTOR too Hameye Ramzaro Mishkanam => Will break all cyphers --- --- Translation Two --- Sahebeh Donya => Possessor of the World e.g. God. Sarbazeh Gomnam => Unknown Soldier Elme Bikaran => Science/Knowledge of the idle/unemployed Daneshmande Bi nazir => Peerless Scientist RamzShekaneBozorg => Great Cryptanalyst Toro Ham Mishkanam => I will breakTOR too Hameye Ramzaro Mishkanam => Will break all cyphers [edited for formatting]

Someone 15y ago

"the currently known bad DigiNotar related certificates" => that list is not necessarily a full list (and, given the reportedly incomplete audit trail, we may never know how long the full list is)

speleding 15y ago
It doesn't really matter if there are any other certificates we don't know about. If you don't have the Diginotar root certs block you have a problem, if you do have them blocked it's not relevant whatever else they issued.

sandGorgon 15y ago

hey guys - as an end user, how do I make sure that I am protected ? I mean is there a way to make sure these certificates dont affect me. I'm on Ubuntu Linux and have applied the recent updates... but how can I be sure ?

jdbeast00 15y ago

Wow, is this a typo?? "The most egregious certs issued were for [asterisk].[asterisk].com and [asterisk].[asterisk].org" I didn't know double wildcard certs were possible. This would be extremely helpful for us if that was. Anyone know? (Just to be extra clear, we would like one cert that covers a.b.example.org as well as d.e.example.org, and hopefully also still works for a.example.org) edit: We currently have a *.example.org cert, and while some browsers think that is valid for a.b.example.org, most do not.