4 ms·

The Dutch government has taken over operational management from DigiNotar.

61 points by franze 15y ago

stingraycharles 15y ago
More specifically, they have taken over operational management of the DigiNotar servers : "On 3 September, the Dutch government has taken over operational management of the DigiNotar systems that are used for certificates." http://www.govcert.nl/binaries/live/govcert/hst%3Acontent/english/service-provision/knowledge-and-publications/factsheets/factsheet-fraudulently-issued-security-certificate-discovered/factsheet-fraudulently-issued-security-certificate-discovered/govcert%3AdocumentResource/govcert%3Aresource http://www.govcert.nl/binaries/live/govcert/hst%3Acontent/en...
michiel3 15y ago
And they denounced trust in all certificates that are issued by DigiNotar and currently migrating to new CAs (Getronics). The digital identity portal DigiD for government services is already migrated to Getronics CA.
deleted 15y ago
[deleted]
- jrockway 15y ago
  Are you sure about this? Github uses DigiCert, which has nothing to do with DigiNotar: http://en.wikipedia.org/wiki/DigiCert http://en.wikipedia.org/wiki/DigiCert * Server certificate: * subject: businessCategory=Private Organization; 1.3.6.1.4.1.311.60.2.1.3=US; 1.3.6.1.4.1.311.60.2.1.2=California; serialNumber=C3268102; C=US; ST=California; L=San Francisco; O=GitHub, Inc.; CN=github.com * start date: 2011-05-27 00:00:00 GMT * expire date: 2013-07-29 12:00:00 GMT * subjectAltName: github.com matched * issuer: C=US; O=DigiCert Inc; OU=www.digicert.com; CN=DigiCert High Assurance EV CA-1 * SSL certificate verify ok.
mkopinsky 15y ago
Does the Dutch government have the expertise necessary to run a CA?
- burgerbrain 15y ago
  Does it particularly matter? All the browsers have de-trusted them already. Not like they could really do any worse. Under previous management they literally allowed the one thing no CA must ever allow to happen.
  - tripzilch 15y ago
    You're conflating the Dutch Government and VASCO/Diginotar.
- Confusion 15y ago
  They already operate a CA: look for 'Staat der Nederlanden' in your browser's root certificate list.
- mpk 15y ago
  My guess is yes, they do. If you read a bit deeper into their announcements you'll notice that this is not just 'the government taking over'. The breach post-mortem was handled by a private sector security company (Fox IT) and the SSL cert management was moved to another private sector firm (Getronics). Judging by the announcements this was overseen by the Ministry of Security and Justice, which has its own well-funded divisions of security specialists. The Dutch government sees digital infrastructure as crucial and invests a lot of time and money into it. Components such as PKI government, etc are initiated by the government but then sourced to the private sector (a fairly common practice). This allows the government to revoke contracts or otherwise intervene if the contractor is in breach of something (bad management, bad governance, failure to comply with security standards, failing audits, etc). I'm guessing that this is also the legal basis for taking over operations from DigiNotar at such short notice. Also, the Dutch government is a world-class player in the eavesdropping, interception, wiretapping and traffic monitoring game. That implies at least a basic in-house competency in network and crypto matters.
akie 15y ago
Well, that's about as competent a response as you can realistically expect in a situation like this. Kudos to the Dutch Government?
- rickmb 15y ago
  Let's not start cheering just yet. Initially, the government failed to acknowledge the seriousness of the issue, even though browser manufactures revoked trust in the CA. In fact, they successfully pressured Mozilla into accepting Dutch government certificates as trustworthy anyway. It also kept all public services depending on Diginotar certificates operational, basically telling the public "well, you can't trust them, but feel free to use them anyway".
  - joelhaasnoot 15y ago
    They started with this, but ended differently: Friday September 2nd they had a news conference and basically said "for now, it's insecure". DigiD, which is what most consumers will see, had a message saying it couldn't be trusted, till the certificates were replaced sometime saturday or sunday. The timing is a little suspicious though: can imagine they didn't want to do that till the weekend, when not as many business cared, or journalists were around to cover all the details.
  - yuhong 15y ago
    From http://news.ycombinator.com/item?id=2962964 http://news.ycombinator.com/item?id=2962964: "EDIT: Oh, and there's a good reason why the DigiNotar PKIOverheid is now also rejected. The Government cert business was supposed to be on a seperate network, on computers (or data?) stored in a safe. However, there were links between the normal network and the secondary (government) network."
- joelhaasnoot 15y ago
  Actually, it looks like they're pressuring Microsoft to release a Windows Update patch for this in a staggered way, so that authorities and companies have time to update certificates... Sounds like bad practice to me. EDIT: Oh, and there's a good reason why the DigiNotar PKIOverheid is now also rejected. The Government cert business was supposed to be on a seperate network, on computers (or data?) stored in a safe. However, there were links between the normal network and the secondary (government) network.
rhizome 15y ago
Have there been any stories on VASCO yet, or the people involved in either company?
- joelhaasnoot 15y ago
  There's now an article here http://www.nu.nl/internet/2607758/diginotar-negeerde-misbruik-en-was-slecht-beveiligd.html http://www.nu.nl/internet/2607758/diginotar-negeerde-misbrui... which details the FoxIT (a Dutch security firm) report on the situation. Looks like sysadmin passwords were brute forced to obtain elevated access, and that keys were stored in a seperate database (going against the written procedures and rules)
guildchatter 15y ago
http://www.net-security.org/secworld.php?id=11565 http://www.net-security.org/secworld.php?id=11565 It looks like many other bad SSL certs were issued.

61 points by franze 15y ago

More specifically, they have taken over operational management of the DigiNotar servers : "On 3 September, the Dutch government has taken over operational management of the DigiNotar systems that are used for certificates." http://www.govcert.nl/binaries/live/govcert/hst%3Acontent/english/service-provision/knowledge-and-publications/factsheets/factsheet-fraudulently-issued-security-certificate-discovered/factsheet-fraudulently-issued-security-certificate-discovered/govcert%3AdocumentResource/govcert%3Aresource http://www.govcert.nl/binaries/live/govcert/hst%3Acontent/en...

michiel3 15y ago

And they denounced trust in all certificates that are issued by DigiNotar and currently migrating to new CAs (Getronics). The digital identity portal DigiD for government services is already migrated to Getronics CA.

deleted 15y ago

[deleted]

jrockway 15y ago
Are you sure about this? Github uses DigiCert, which has nothing to do with DigiNotar: http://en.wikipedia.org/wiki/DigiCert http://en.wikipedia.org/wiki/DigiCert * Server certificate: * subject: businessCategory=Private Organization; 1.3.6.1.4.1.311.60.2.1.3=US; 1.3.6.1.4.1.311.60.2.1.2=California; serialNumber=C3268102; C=US; ST=California; L=San Francisco; O=GitHub, Inc.; CN=github.com * start date: 2011-05-27 00:00:00 GMT * expire date: 2013-07-29 12:00:00 GMT * subjectAltName: github.com matched * issuer: C=US; O=DigiCert Inc; OU=www.digicert.com; CN=DigiCert High Assurance EV CA-1 * SSL certificate verify ok.

mkopinsky 15y ago

Does the Dutch government have the expertise necessary to run a CA?

burgerbrain 15y ago
Does it particularly matter? All the browsers have de-trusted them already. Not like they could really do any worse. Under previous management they literally allowed the one thing no CA must ever allow to happen.
- tripzilch 15y ago
  You're conflating the Dutch Government and VASCO/Diginotar.
Confusion 15y ago
They already operate a CA: look for 'Staat der Nederlanden' in your browser's root certificate list.
mpk 15y ago
My guess is yes, they do. If you read a bit deeper into their announcements you'll notice that this is not just 'the government taking over'. The breach post-mortem was handled by a private sector security company (Fox IT) and the SSL cert management was moved to another private sector firm (Getronics). Judging by the announcements this was overseen by the Ministry of Security and Justice, which has its own well-funded divisions of security specialists. The Dutch government sees digital infrastructure as crucial and invests a lot of time and money into it. Components such as PKI government, etc are initiated by the government but then sourced to the private sector (a fairly common practice). This allows the government to revoke contracts or otherwise intervene if the contractor is in breach of something (bad management, bad governance, failure to comply with security standards, failing audits, etc). I'm guessing that this is also the legal basis for taking over operations from DigiNotar at such short notice. Also, the Dutch government is a world-class player in the eavesdropping, interception, wiretapping and traffic monitoring game. That implies at least a basic in-house competency in network and crypto matters.

akie 15y ago

Well, that's about as competent a response as you can realistically expect in a situation like this. Kudos to the Dutch Government?

rickmb 15y ago
Let's not start cheering just yet. Initially, the government failed to acknowledge the seriousness of the issue, even though browser manufactures revoked trust in the CA. In fact, they successfully pressured Mozilla into accepting Dutch government certificates as trustworthy anyway. It also kept all public services depending on Diginotar certificates operational, basically telling the public "well, you can't trust them, but feel free to use them anyway".
- joelhaasnoot 15y ago
  They started with this, but ended differently: Friday September 2nd they had a news conference and basically said "for now, it's insecure". DigiD, which is what most consumers will see, had a message saying it couldn't be trusted, till the certificates were replaced sometime saturday or sunday. The timing is a little suspicious though: can imagine they didn't want to do that till the weekend, when not as many business cared, or journalists were around to cover all the details.
- yuhong 15y ago
  From http://news.ycombinator.com/item?id=2962964 http://news.ycombinator.com/item?id=2962964: "EDIT: Oh, and there's a good reason why the DigiNotar PKIOverheid is now also rejected. The Government cert business was supposed to be on a seperate network, on computers (or data?) stored in a safe. However, there were links between the normal network and the secondary (government) network."
joelhaasnoot 15y ago
Actually, it looks like they're pressuring Microsoft to release a Windows Update patch for this in a staggered way, so that authorities and companies have time to update certificates... Sounds like bad practice to me. EDIT: Oh, and there's a good reason why the DigiNotar PKIOverheid is now also rejected. The Government cert business was supposed to be on a seperate network, on computers (or data?) stored in a safe. However, there were links between the normal network and the secondary (government) network.

rhizome 15y ago

Have there been any stories on VASCO yet, or the people involved in either company?

joelhaasnoot 15y ago
There's now an article here http://www.nu.nl/internet/2607758/diginotar-negeerde-misbruik-en-was-slecht-beveiligd.html http://www.nu.nl/internet/2607758/diginotar-negeerde-misbrui... which details the FoxIT (a Dutch security firm) report on the situation. Looks like sysadmin passwords were brute forced to obtain elevated access, and that keys were stored in a seperate database (going against the written procedures and rules)

guildchatter 15y ago

http://www.net-security.org/secworld.php?id=11565 http://www.net-security.org/secworld.php?id=11565 It looks like many other bad SSL certs were issued.