7 ms·

VeriSign hit by hackers

115 points by megamark16 15y ago

larrys 15y ago
As an aside, registrar interactions with Verisign have several security layers involved to prevent someone from accessing and changing domain dns (we deal with this as a registrar). Of course those methods are only as secure as the particular registrar defenses are. As are the nameservers used in any particular domain.
nkassis 15y ago
This article doesn't have much details on what the actually attack involved. Anyone have actual details. I would assume that VeriSign has a very segregated network and a breach somewhere would have a hard time propagating to their more important things like their CA signing server and .com stuff.
- marshray 15y ago
  The (reported) fact that they were hacked repeatedly in 2010 and the CTO at that time (claims he) didn't learn of it until Reuters called him for a comment doesn't exactly paint a reassuring picture. I bet Symantec is a little irritated that they bought the VeriSign^TM CA business in 2010. Are they going to want their money back? If they can't prove there was no compromise of the private keys, will Symantec reissue the 30 year VeriSign root certs? EDIT: The SEC filing is here (keyword "breach") https://investor.verisign.com/secfiling.cfm?filingID=1193125-11-285850&CIK=1014473 https://investor.verisign.com/secfiling.cfm?filingID=1193125... Interesting how the filing mentions the threat to their DNS business. Perhaps the potential risk to the root CA is no longer considered relevant since they've sold it?
  - deleted 15y ago
    [deleted]
  - lawnchair_larry 15y ago
    I bet Symantec is a little irritated that they bought the VeriSign^TM CA business in 2010. Are they going to want their money back? Whatever security problems Verisign has had, Symantec's are far worse.
andrewheins 15y ago
"Oh my God," said Stewart Baker, former assistant secretary of the Department of Homeland Security and before that the top lawyer at the National Security Agency. "That could allow people to imitate almost any company on the Net." Does anyone else feel this line is more suited to a Hollywood movie than a Reuters release?
- Terretta 15y ago
  I found it refreshing -- an official didn't try to downplay the issue. The reporter likely included the comment verbatim for that very reason, as in, "OMG, this is super serial."
  - deleted 15y ago
    [deleted]
- joshuahedlund 15y ago
  No but I re-read that sentence three times because of how poorly it was written. I don't think I've ever read a news article where a quoted person's description bridged two facts with the phrase "and before that".
  - oconnore 15y ago
    <Exclamation>, said <identity and credentials>. "<Explanation>". I don't see anything wrong with that.
    - joshuahedlund 15y ago
      Yes, that is standard. This is just redundant and sounds like a run-on: <Exclamation>, said <identity and credentials and before that other credentials>. "<Explanation>".
- bradleyjg 15y ago
  Stewart Baker blogs at http://volokh.com/author/stewart/ http://volokh.com/author/stewart/ . Although I don't always agree with him, he is often quite thought provoking.
hendzen 15y ago
Another day, another APT reported by some company integral to the technological infrastructure of the US (and the world in this case). When will we take real, substantive action on this issue?
- nknight 15y ago
  At this point, VeriSign might as well be an instrumentality of the US government. The answer to your question is "When we take substantive action on the brokenness of the US political system".
- marshray 15y ago
  When will we take real, substantive action on this issue? Got any new ideas? (seriously)
  - hendzen 15y ago
    Perhaps some kind of cyber-warfare non-proliferation treaty akin to START. Nation states agree to not launch APTs against eachother, and pledge to prosecute any of their citizens that launch such attacks independently.
    - marshray 15y ago
      What would you do when there are still targeted attacks launched via compromised systems from random unrelated countries used as proxies?
    - nknight 15y ago
      I have to say I find that pretty laughable. First of all, START isn't even about non-proliferation. Has nothing to do with it. It's a series of agreements between two superpowers that served mostly as a diplomatic tool to de-escalate Cold War tensions and provide political cover for military budget reductions. It's been wildly successful in that regard. The actual Nuclear Non-Proliferation Treaty is entirely about non-proliferation, a pre-emptive attempt to keep the capability of nuclear warfare out of the hands of most nations. It has absolutely nothing to do with preventing nuclear warfare between those nations already possessing them. We haven't had nuclear war because so far, nobody who either actually wants to end the world, or is stupid enough to think he can "win" a nuclear war, has been in control of nuclear weapons. Not because of some piece of paper saying "I promise I won't kill you". Hilter had one of those with Stalin, how'd that work out? "Cyber warfare" doesn't have the problems of nuclear warfare. It's unlikely to end the world, it's relatively cheap, the tools are widely available, and unlike physical warfare which destroys economies, it's actually about the economy. It's about getting a leg up on the competition. It's about money, period. The world some non-technical people live in where "cyber warfare" is all about winning actual wars is a world of fantasy. In human history, only one thing has reliably stopped wars, and that is the tying together of nations' economies so closely that war between them becomes economically impossible. This just doesn't work in "cyber warfare".
fragsworth 15y ago
I don't understand why we trust lone authentication services. They are single points of failure. SSL Certificates should be validated by a collection of independent certificate authorities. If not all of the authorities agree on the certificate, that's a sign there is hacking going on - or a sign that not all of the services have synchronized the certificate. If we do it this way, a hacker who wants to try to imitate a site can't get away with compromising just one certificate authority. They'd have to compromise all of them, which (if there are enough) would be nearly impossible.
- EGreg 15y ago
  Well, how do you distribute trust? Do you have a quorum or something? Consider this ... what if I wanted to introduce doubt that X is really verified, and thereby hurt their business. How can you avoid me doing stuff like that? Besides harsh laws of course.
  - nknight 15y ago
    > Well, how do you distribute trust? Do you have a quorum or something? Basically, yes. > Consider this ... what if I wanted to introduce doubt that X is really verified, and thereby hurt their business. How can you avoid me doing stuff like that? Besides harsh laws of course. By not trusting you. Right now, what happens is the browser and/or OS vendor determines a set of certificate authorities to declare "trusted", and all certificates they issue are simply assumed to be valid. Instead, we could require, say, three signatures, each from different authorities, to invoke the normal "this is a secure connection to a properly-identified website" behavior. But each of those authorities was still determined by the vendor to be trustworthy. It's still going to be the likes of e.g. VeriSign, Comodo, StartSSL, etc.. It's not going to be you.
    - EGreg 15y ago
      But what if Verisign really doesn't like Bank of America, can they cast doubt on their websites now?
pittsburgh 15y ago
The reuters article provides no details about the security breach, so I did some digging. The most I could find was VeriSign's original SEC filing at http://www.sec.gov/Archives/edgar/data/1014473/000119312511285850/d219781d10q.htm http://www.sec.gov/Archives/edgar/data/1014473/0001193125112... From the filing: We experienced security breaches in the corporate network in 2010 which were not sufficiently reported to Management. In 2010, the Company faced several successful attacks against its corporate network in which access was gained to information on a small portion of our computers and servers. We have investigated and do not believe these attacks breached the servers that support our Domain Name System (“DNS”) network. Information stored on the compromised corporate systems was exfiltrated. The Company’s information security group was aware of the attacks shortly after the time of their occurrence and the group implemented remedial measures designed to mitigate the attacks and to detect and thwart similar additional attacks. However, given the nature of such attacks, we cannot assure that our remedial actions will be sufficient to thwart future attacks or prevent the future loss of information. In addition, although the Company is unaware of any situation in which possibly exfiltrated information has been used, we are unable to assure that such information was not or could not be used in the future. The occurrences of the attacks were not sufficiently reported to the Company’s management at the time they occurred for the purpose of assessing any disclosure requirements. Management was informed of the incident in September 2011 and, following the review, the Company’s management concluded that our disclosure controls and procedures are effective. However, the Company has implemented reporting line and escalation organization changes, procedures and processes to strengthen the Company’s disclosure controls and procedures in this area. See Item 4 “Controls and Procedures” in Part I of this report. It's interesting to note that the SEC issued guidelines on the reporting of security breaches on October 13th, 2011 ( http://www.sec.gov/divisions/corpfin/guidance/cfguidance-topic2.htm http://www.sec.gov/divisions/corpfin/guidance/cfguidance-top... ) and VeriSign's SEC filing was released about two weeks later on October 28th, 2011. It could be the case that the security breach wasn't actually a major one, but because the SEC guidelines were so new they thought it prudent to mention even a minor security breach. From this filing, there's no way to know the severity of the breach, which is why I think it's unfair for reuters to make this seem like a bigger deal than it might actually be. (They mention the RSA security breach which was a huge deal, and they suggest the attack was done by a "nation-state".) It reads like an article written by Nancy Grace. Of course it could be the case that this was a major attack carried out by China, but it could also be a mundane attack on a public web server that wouldn't have made the news if not for the timing of the recent SEC guidelines. There's just no way to know from the information available.
Cyndre 15y ago
Am I the only that wonders if Symantec is the right company to be in control of verisign??? To me it seems that there would be a little bit of a conflict of interest around owning an antivirus company and the tool that tells you a site is who they say they are. I know this sounds a little crazy, but think about it before you downvote me.

115 points by megamark16 15y ago

As an aside, registrar interactions with Verisign have several security layers involved to prevent someone from accessing and changing domain dns (we deal with this as a registrar). Of course those methods are only as secure as the particular registrar defenses are. As are the nameservers used in any particular domain.

nkassis 15y ago

This article doesn't have much details on what the actually attack involved. Anyone have actual details. I would assume that VeriSign has a very segregated network and a breach somewhere would have a hard time propagating to their more important things like their CA signing server and .com stuff.

marshray 15y ago
The (reported) fact that they were hacked repeatedly in 2010 and the CTO at that time (claims he) didn't learn of it until Reuters called him for a comment doesn't exactly paint a reassuring picture. I bet Symantec is a little irritated that they bought the VeriSign^TM CA business in 2010. Are they going to want their money back? If they can't prove there was no compromise of the private keys, will Symantec reissue the 30 year VeriSign root certs? EDIT: The SEC filing is here (keyword "breach") https://investor.verisign.com/secfiling.cfm?filingID=1193125-11-285850&CIK=1014473 https://investor.verisign.com/secfiling.cfm?filingID=1193125... Interesting how the filing mentions the threat to their DNS business. Perhaps the potential risk to the root CA is no longer considered relevant since they've sold it?
- deleted 15y ago
  [deleted]
- lawnchair_larry 15y ago
  I bet Symantec is a little irritated that they bought the VeriSign^TM CA business in 2010. Are they going to want their money back? Whatever security problems Verisign has had, Symantec's are far worse.

andrewheins 15y ago

"Oh my God," said Stewart Baker, former assistant secretary of the Department of Homeland Security and before that the top lawyer at the National Security Agency. "That could allow people to imitate almost any company on the Net." Does anyone else feel this line is more suited to a Hollywood movie than a Reuters release?

Terretta 15y ago
I found it refreshing -- an official didn't try to downplay the issue. The reporter likely included the comment verbatim for that very reason, as in, "OMG, this is super serial."
- deleted 15y ago
  [deleted]
joshuahedlund 15y ago
No but I re-read that sentence three times because of how poorly it was written. I don't think I've ever read a news article where a quoted person's description bridged two facts with the phrase "and before that".
- oconnore 15y ago
  <Exclamation>, said <identity and credentials>. "<Explanation>". I don't see anything wrong with that.
  - joshuahedlund 15y ago
    Yes, that is standard. This is just redundant and sounds like a run-on: <Exclamation>, said <identity and credentials and before that other credentials>. "<Explanation>".
bradleyjg 15y ago
Stewart Baker blogs at http://volokh.com/author/stewart/ http://volokh.com/author/stewart/ . Although I don't always agree with him, he is often quite thought provoking.

hendzen 15y ago

Another day, another APT reported by some company integral to the technological infrastructure of the US (and the world in this case). When will we take real, substantive action on this issue?

nknight 15y ago
At this point, VeriSign might as well be an instrumentality of the US government. The answer to your question is "When we take substantive action on the brokenness of the US political system".
marshray 15y ago
When will we take real, substantive action on this issue? Got any new ideas? (seriously)
- hendzen 15y ago
  Perhaps some kind of cyber-warfare non-proliferation treaty akin to START. Nation states agree to not launch APTs against eachother, and pledge to prosecute any of their citizens that launch such attacks independently.
  - marshray 15y ago
    What would you do when there are still targeted attacks launched via compromised systems from random unrelated countries used as proxies?
  - nknight 15y ago
    I have to say I find that pretty laughable. First of all, START isn't even about non-proliferation. Has nothing to do with it. It's a series of agreements between two superpowers that served mostly as a diplomatic tool to de-escalate Cold War tensions and provide political cover for military budget reductions. It's been wildly successful in that regard. The actual Nuclear Non-Proliferation Treaty is entirely about non-proliferation, a pre-emptive attempt to keep the capability of nuclear warfare out of the hands of most nations. It has absolutely nothing to do with preventing nuclear warfare between those nations already possessing them. We haven't had nuclear war because so far, nobody who either actually wants to end the world, or is stupid enough to think he can "win" a nuclear war, has been in control of nuclear weapons. Not because of some piece of paper saying "I promise I won't kill you". Hilter had one of those with Stalin, how'd that work out? "Cyber warfare" doesn't have the problems of nuclear warfare. It's unlikely to end the world, it's relatively cheap, the tools are widely available, and unlike physical warfare which destroys economies, it's actually about the economy. It's about getting a leg up on the competition. It's about money, period. The world some non-technical people live in where "cyber warfare" is all about winning actual wars is a world of fantasy. In human history, only one thing has reliably stopped wars, and that is the tying together of nations' economies so closely that war between them becomes economically impossible. This just doesn't work in "cyber warfare".

fragsworth 15y ago

I don't understand why we trust lone authentication services. They are single points of failure. SSL Certificates should be validated by a collection of independent certificate authorities. If not all of the authorities agree on the certificate, that's a sign there is hacking going on - or a sign that not all of the services have synchronized the certificate. If we do it this way, a hacker who wants to try to imitate a site can't get away with compromising just one certificate authority. They'd have to compromise all of them, which (if there are enough) would be nearly impossible.

EGreg 15y ago
Well, how do you distribute trust? Do you have a quorum or something? Consider this ... what if I wanted to introduce doubt that X is really verified, and thereby hurt their business. How can you avoid me doing stuff like that? Besides harsh laws of course.
- nknight 15y ago
  > Well, how do you distribute trust? Do you have a quorum or something? Basically, yes. > Consider this ... what if I wanted to introduce doubt that X is really verified, and thereby hurt their business. How can you avoid me doing stuff like that? Besides harsh laws of course. By not trusting you. Right now, what happens is the browser and/or OS vendor determines a set of certificate authorities to declare "trusted", and all certificates they issue are simply assumed to be valid. Instead, we could require, say, three signatures, each from different authorities, to invoke the normal "this is a secure connection to a properly-identified website" behavior. But each of those authorities was still determined by the vendor to be trustworthy. It's still going to be the likes of e.g. VeriSign, Comodo, StartSSL, etc.. It's not going to be you.
  - EGreg 15y ago
    But what if Verisign really doesn't like Bank of America, can they cast doubt on their websites now?

pittsburgh 15y ago

The reuters article provides no details about the security breach, so I did some digging. The most I could find was VeriSign's original SEC filing at http://www.sec.gov/Archives/edgar/data/1014473/000119312511285850/d219781d10q.htm http://www.sec.gov/Archives/edgar/data/1014473/0001193125112... From the filing: We experienced security breaches in the corporate network in 2010 which were not sufficiently reported to Management. In 2010, the Company faced several successful attacks against its corporate network in which access was gained to information on a small portion of our computers and servers. We have investigated and do not believe these attacks breached the servers that support our Domain Name System (“DNS”) network. Information stored on the compromised corporate systems was exfiltrated. The Company’s information security group was aware of the attacks shortly after the time of their occurrence and the group implemented remedial measures designed to mitigate the attacks and to detect and thwart similar additional attacks. However, given the nature of such attacks, we cannot assure that our remedial actions will be sufficient to thwart future attacks or prevent the future loss of information. In addition, although the Company is unaware of any situation in which possibly exfiltrated information has been used, we are unable to assure that such information was not or could not be used in the future. The occurrences of the attacks were not sufficiently reported to the Company’s management at the time they occurred for the purpose of assessing any disclosure requirements. Management was informed of the incident in September 2011 and, following the review, the Company’s management concluded that our disclosure controls and procedures are effective. However, the Company has implemented reporting line and escalation organization changes, procedures and processes to strengthen the Company’s disclosure controls and procedures in this area. See Item 4 “Controls and Procedures” in Part I of this report. It's interesting to note that the SEC issued guidelines on the reporting of security breaches on October 13th, 2011 ( http://www.sec.gov/divisions/corpfin/guidance/cfguidance-topic2.htm http://www.sec.gov/divisions/corpfin/guidance/cfguidance-top... ) and VeriSign's SEC filing was released about two weeks later on October 28th, 2011. It could be the case that the security breach wasn't actually a major one, but because the SEC guidelines were so new they thought it prudent to mention even a minor security breach. From this filing, there's no way to know the severity of the breach, which is why I think it's unfair for reuters to make this seem like a bigger deal than it might actually be. (They mention the RSA security breach which was a huge deal, and they suggest the attack was done by a "nation-state".) It reads like an article written by Nancy Grace. Of course it could be the case that this was a major attack carried out by China, but it could also be a mundane attack on a public web server that wouldn't have made the news if not for the timing of the recent SEC guidelines. There's just no way to know from the information available.

Cyndre 15y ago

Am I the only that wonders if Symantec is the right company to be in control of verisign??? To me it seems that there would be a little bit of a conflict of interest around owning an antivirus company and the tool that tells you a site is who they say they are. I know this sounds a little crazy, but think about it before you downvote me.