Incidents

The bigger issue with the rogue Google SSL cert

Today we saw the discovery of another rogue SSL certificate – this time for *.google.com. The certificate itself was issued five weeks ago. This will allow an attacker to sniff the traffic to virtually all of Google’s services even with HTTPS enabled.

Right now, there’s an unconfirmed report this attack is happening in Iran. Frankly, I’m not sure it’s really relevant.

Given the number of companies that sell government equipment that enables them to inject certificates onto the wire, this is not restricted to any particular part of the world. However, those countries without their own CA will always be forced to take the route of compromising a Certificate Authority.

The bigger issue here is the Certificate Authority that got compromised. DigiNotar is a Dutch company which was acquired by Vasco earlier this year. Vasco – which amongst other things delivers services similar to RSA’s SecurID – is a very big player on the financial market. Meanwhile DigiNotar is especially strong with governments.

So the number one question racing through my mind is: How big is the compromise at DigiNotar? Does this transcend the certificate generation process?
Could Vasco itself be impacted?

It’s absolutely critical we become aware of the implications of this attack as quickly as possible. We don’t need a repeat of how the RSA breach was underplayed. That helped no one.

With DigiNotar being a supplier to the Dutch government I fully expect political questions in the Netherlands.

The bigger issue with the rogue Google SSL cert

Your email address will not be published.

 

Reports

Kimsuky’s GoldDragon cluster and its C2 operations

Kimsuky (also known as Thallium, Black Banshee and Velvet Chollima) is a prolific and active threat actor primarily targeting Korea-related entities. In early 2022, we observed this group was attacking the media and a think-tank in South Korea.

Andariel deploys DTrack and Maui ransomware

Earlier, the CISA published an alert related to a Stairwell report, “Maui Ransomware.” Our data should openly help solidify the attribution of the Maui ransomware incident to the Korean-speaking APT Andariel, also known as Silent Chollima and Stonefly.

Subscribe to our weekly e-mails

The hottest research right in your inbox