GlobalSign says ‘isolated’ webserver was hacked
Web authentication authority GlobalSign, which voluntarily suspended operations last week while it investigated claims its security was breached, said it has uncovered evidence that one of its servers has been compromised.
“The breached web server has always been isolated from all other infrastructure and is used only to serve the www.globalsign.com website,” the authorized issuer of secure sockets layer certificates said in an advisory published this weekend. “At present there is no further evidence of breach other than the isolated www web server. As an additional precaution, we continue to monitor all activity to all services closely.”
The certificate authority went on to say that it’s in the process of bringing its systems back online and expects to begin processing orders on Tuesday.
GlobalSign’s notice that it was hacked comes two weeks after the discovery of a counterfeit SSL credential issued by disgraced certificate authority DigiNotar that was being used to spy on people in Iran as they visited Gmail and possibly other Google properties. Over the following week, an account holder on Pastebin.com published a file signed with the private key of the bogus Google certificate, proving he had close ties to the person or people behind the attack. The person claimed to have access to GlobalSign and three other certificate authorities, but provided no proof.
GlobalSign responded by temporarily suspending its operations while it investigated the claims. It brought in Dutch security auditor Fox-IT to assist. Fox-IT also worked with DigiNotar following its security breach.
With its admission, GlobalSign’s breach becomes at least the seventh time an entity that issues SSL certificates has been hacked this year. Four resellers of Comodo have been compromised, including one that allowed the attackers to mint fraudulent credentials for GMail and six other sensitive addresses. A similar attack hit Israel-based StartSSL, but the attackers didn’t succeed in securing the bogus certificates.
In March, the Pastebin account holder published a private key for the fraudulent Google certificate issued by a Comodo reseller, proving the individual also had close ties to at least one of those hacks.
Last week, Mozilla responded to the DigiNotar attack and its aftermath by requiring all certificate authorities included in the Firefox and Thunderbird programs to perform similar security audits and ensure that their systems use two-factor authentication when issuing certificates. ®
Article source: http://go.theregister.com/feed/www.theregister.co.uk/2011/09/12/globalsign_security_breach/