What is DigiNotar, SSL, Security Breach, and how does it affect you? What did get hacked? Now what?
Introduction
You may have heard about tech news reporting some Dutch security firm got hacked and in response, many web browsers are getting updated to fix this breach. You may have wondered, how can something in Netherlands affect your browser?
What actually happened is a Dutch company, called DigiNotar, who is a "certificate authority", got hacked, and many fraudulent certificates have been issued. These fraudulent certificates can allow the holders to impersonate well-known websites and thus intercept traffic, even though the user thought the traffic is encrypted. In other words, it is a method of eavesdropping and potentially much worse. And this affects everybody because the certificates are used by everybody, even if you don't recognize it.
How did it happen, how does it affect you, and what can you do about it?
How a Browser Communicates Securely
A web browser normally sends and receives data without any security or encryption. It is not worth the effort, as most text is innocuous. However, when it comes to important things like passwords, credit card numbers, purchases, and so on, security is required, as the browser needs to talk to the server without any chance of someone intercepting the data. Thus is born Secure Socket Layer, or SSL.
You may recognize SSL by a "lock and key" symbol displayed by the browser next to the URL or in the status bar.
The way SSL works is as follows:
- Browser to server: Prove who you really are, show me your ID certificate
- Server responds: here's my ID certificate, check it yourself
- Browser checks the ID certificate against its "white list", stop if not acceptable
- Browser to server: I accept your certificate, prepare to start encryption on my mark
- Server responds: ready when you are
- Browser then starts communicating securely to the server
How the data is encrypted is not that important. SSL use a 128-bit encryption.
This requires the certificates to be trusted. If you can't trust the certificates, then the whole system collapses. Much like airport security checking individual IDs, if you can't rust the ID, then nobody will be able to fly.
Where do these certificates come from?
These SSL certificates are issued by "certificate authorities" which are companies who now only issue SSL certificates, but also help browsers verify certificates. The process is as follows:
- Browser to server: Prove who you say you are, show me your certificate
- Server: here you go, here's my certificate
- Browser: hmmm... I don't recognize this certificate, it's not in my white list
- Browser: this certificate says I can go to this specific certificate authority to verify it. I do recognize this certificate authority to be valid.
- Browser to certificate authority server: I got this certificate here says it's issued by you. Is it real?
- Certificate authority server: Yeah, it's real
- Browser: okay, I'll add this certificate to my 'white list'
- Browser to server: your ID is confirmed, prepare to start secure channel comm...
Each browser is configured to accept only specific "certificate authorities" in the world. After all, you can't just let anybody claiming to be one. This is encrypted and a part of the browser itself.
Why a Certificate Authority Hack is VERY bad
DigiNotar, a dutch certificate authority, was hacked, apparently by one or more Iranian hackers, and its server was breached, and unknown number of certificates were issued fraudulently to big names, like Google.com and so on. With such fraudulent certificates, and access to the right hardware, holder of such certificate can intercept and decrypt secure traffic that the user thought to be secure. This is how it would work:
- Browser to server: I want to communicate securely, show me your ID
- Fake server responds: here's my ID (fake)
- Browser: I don't recognize this ID, but the certificate authority seems valid...
- Browser to certificate authority server: Did you issue this ID?
- Certificate authority server: looks valid to me
- Browser goes back to the "fake" server: okay, start secure comm when you're ready...
Now you probably ask, WHY would ANYBODY communicate with a fake server? The answer is... when they don't realize it's fake, and real traffic was diverted. This is due to the way browser, and the Internet in general, works.
How DNS works, and how you can be hacked without knowing
Most people don't know what goes behind the scenes when a browser does its stuff, thus most people don't realize the possibilities of compromise. When you type in an URL, the following actually happens:
- Browser takes the "domain name" (i.e. Google.com), and sends the name to "Domain Name Service" (DNS) server.
- The DNS server responds: This domain name is at IP address xxx.xxx.xxx.xxx (actual number does not matter)
- Browser then sends traffic to that IP address, NOT THE NAME.
The DNS server is usually ran by the your internet service provider (ISP), who copies it from THEIR provider, and so on until the traffic goes to the "root" DNS server. However, It is possible for someone to install a FAKE DNS server, and redirect the traffic meant for Google.com to some other IP address. Existing DNS server can also be hacked to redirect traffic.
Thus, someone trying to access Gmail securely can then be tricked:
- User to browser: go to Gmail.com
- Browser to DNS server: give me IP address of Gmail.com
- DNS server spat back some OTHER IP address, NOT of Gmail.com
- Browser goes to this pseudo-gmail server: show me your ID certificate
- Pseudo-gmail server: here you go (shows fake ID)
- Browser: I don't recognize this ID, but the certificate authority seems valid, let's check
- Browser to certificate authority: did you issue this ID?
- Certificate authority: looks valid to me
- Browser to pseudo-gmail server: okay, you look authentic enough. Prepare to start secure communications
- Pseudo-gmail server gets the traffic, logs it, then forwards it to the REAL gmail.com... or it can pop up a fake error page, do "please try again", and send the user to the real gmail.com, AFTER having logged their username and password.
The user would have never noticed a thing!
This is known in the security circle is "Man-In-The-Middle" (MITM) attack, where the hacker managed to get in the middle of the traffic chain and pretend to be the endpoint.
How Was the Hack Discovered?
On August 28, 2011, an Iranian user was surprised to see a warning pop up when he tried to go to GMail. Chrome has detected that someone is claiming to be Google.com (which is in the US), but the SSL certificate came from DigiNotar, which is in Europe, and that was enough to raise a warning. He posted the possible breach on Google Help, and it was quickly confirmed by Google (within 24 hours?) as a MITM attack aimed specifically at Google and Gmail.
How did Chrome detect the hack? Google's Chrome / Chromium browser has a security feature since June 2011, that detects certificate abuse through "certificate pinning". It does this by adding logic that denotes which certificate authority has the responsibility for certain locations. For example, a European certificate authority should not be able to issue certificates for domains in Africa or Americas, and vice versa.
Microsoft issued a patch and security update on August 29th to deal with this problem. Mozilla issued a security patch on August 30, 2011 to seal off this breach (and blacklisted most of DigiNotar's certificates). On September 6th, Mozilla issued another update that blacklisted ALL of DigiNotar's certificates, essentially ending DigiNotar's "certificate authority" status.
Who Was Affected? Who Did it?
Who would go to such trouble to hack DNS servers AND certificate authority servers just to get passwords and so on? The major suspects would be... the Iranian government. Google itself warned ALL Iranian users of such a breach, really. In fact, this breach supposedly happened in July 2011, and was not discovered until AUGUST 29, 2011, when Dutch authorities ordered DigiNotar to revoke various certificates it judged to be fraudulent. This was then discovered by some Iranian users, and the news quickly spread from there. Dutch government had used DigiNotar certificates in many of its government websites and as a result is severely embarrassed by this security breach. it had publicly stated that security of its government websites and linked databases can no longer be trusted. It had taken over the company and brought in experts to determine how bad the situation is.
Google believe the hack currently only affected about 300000 users of Gmail, mostly from Iran. Traceroute logs posted by Iranian users show extra suspicious hops within Iran when accessing Google related domains, but not with other domains.
Dutch authorities then revealed that audit of DigiNotar's servers shows that HUNDREDS of certificates were issued fraudulently by the hacker for domain names that included the CIA, Mossad (Israeli intelligence agency), government websites, as well as who's who on the Internet, and some certificates have been completely lost. They don't really know what is the extent of this breach, in other words, other than it is completely devastating. In fact, Dutch government also revealed that the breach may have happened in June 2011, but the Dutch government was NOT immediately informed. This made ALL DigiNotar certificates untrustworthy. Over 55000 certificates from DigiNotar were used in Netherlands alone, many by government sites. DigiNotar certificates were also used as PersonalID, and that is now also untrustworthy.
The same hacker that got DigiNotar is believe to be the same hacker that attacked Comodo, another certificate authority, in the US, in early 2011. He now goes by the hackername "Comodohacker". That breach was limited and only a few certificates were issued fraudulently, and quickly revoked. Still, it set a dangerous precedent. And he claimed he can do much much more.
In the wake of this widespread "panic" after the DigiNotar breach was exposed, mistakes and misinformation quickly spread. Symantec, a computer security firm, had to dispel several rumors when the Dutch government accidentally claimed that another Certificate authority, Thawte, had been breached.
What Can You Do?
What should you do if you may be affected?
First, update your browser AND Internet related software ASAP. Apple have released update for OS X that patches this vulnerability, and all major browser makers have updated their browsers as well. Update ASAP.
Second, change ALL your passwords, ASAP, AFTER you update the browser.
Third, clear cookies and log out of EVERY online session, then log back in using the new password.
Fourth, READ every warning that came from your browser.
Conclusion
The DigiNotar "mess" is widespread and affects far more people than most expect. By attacking something in the background, this hack is rather insidious and raises doubt on the entire SSL protocol and how it secures what we do on the net.
While so far only effects are seen in and around Iran, there's no telling what sort of damage a more concerted attack can do. Some security experts have proposed various additions to SSL, such as DNS security (verify DNS) as well as Convergence which "crowd-sources" the certificate by comparing each other's certificate with each other, to spot differences, and thus, the "odd man out", if there is a man-in-the-middle attack. Unfortunately, such methods so far are rather untested.
Still, security experts are working on it, and I hope you have learned a bit about it.
A Bit More About Tech
- Cortex vs Hummingbird, OMAP, Snapdragon, Tegra... All about Mobile ARM CPU Processor Chip Names (and
ARM cpu family now powers most of the modern smartphones. What are the major licensees of ARM CPUs, what are the differences, and what developments can be expected in the near future? Find out there. - Do Smartphones such as iPhones and Android Phones Get Viruses? Absolutely!
iPhone and Android phones have viruses? Yes they do. Learn how they can affect you and how to deal with them.
Related
Mitihani House Location and How to Replace Lost Kcse and Kcpe Certificates
Intercepting HTTPS Traffic Using the Squid Proxy Service in pfSense
StrawMan Are You A Person Or Collateral? Does Your Social Security Card Prove You Are Property? Why Capital Letters?
The Simplest Filtering Method to Exclude Traffic from Your Internal Computers in Google Analytics, No IP Address Lookup!
Different Types of Network Attacks And Security Threats and Counter Measures
