Verisign deep-hacked. For months.

Mailman List Mirror (Read Only)
1

Oh, my.

http://finance.yahoo.com/news/Key-Internet-operator-rb-2857339070.html

Cheers,
-- jra

2

I love this

VeriSign said its executives "do not believe these attacks breached the
servers that support our Domain Name System network,"

"Oh my God," said Stewart Baker, former assistant secretary of the
Department of Homeland Security and before that the top lawyer at the
National Security Agency. "That could allow people to imitate almost any
company on the Net."

Sounds like another opportunity for <insert congress person> to propose
SOPA-2

Zaid

3

So what part of VRSN got broken into? They do a lot more than just DNS.

4

Indeed, VeriSign owns Illuminet, who are mission-critical for POTS.
Illuminet is also in the business of recording telephone calls, SMS
messages, etc. for law enforcement.

That means that a "breach" at "VeriSign" could be nothing, or it could
give bad guys access to a lot more than any breach or leak reported to
date. Who knows?

5

That part is ambiguous at the moment since Verisign has not released
details. Symantec has bought the SSL part of the business and claim that
the SSL acquired network is not compromised. Sounds like lots of
assumptions being drawn.

Zaid

6

See my new blog entry:

World notices that Verisign said three months ago that they had a
security breach two years ago

http://jl.ly/2012/02/02#vrsnbreach

R's,
John

7

i thought news was only supposed to be at eleven

8

"Illuminet"?

Shea and Wilson would be proud.

Cheers,
-- jr 'and somewhere, an evil geek is dry-washing his hands' a

9

Wasn't this division acquired by TNS ?
http://www.bizjournals.com/washington/stories/2009/05/04/daily5.html

Rubens

10

I am thinking it is related to the Chinese hacking of Gmail accounts in the
fall of 2010. Symantic acquired the SSL business in August 2010. The
hacking could have been in the spring for all we know. Google uses Thwate
as it's CA, but Thwate has "Builtin Object Token: Verisign Class 3 Public
Primary Certificate Authority" as it's root.

Seems to me part of the problem was traced back to browsers not checking
revoked certs via the browser CRLs. Didn't some in the chain have revoked
certs still installed?