Comodo hacker reveals Mozilla private key

Powered by SC Magazine
 

Only Comodo or hacker know this detail.

The self-proclaimed Iranian Comodo hacker has published the private RSA encryption key for Mozilla’s addons domain, which a British security firm confirmed could only have been known by the hacker or Comodo. 

For some real dumbs ... WHO STILL thinks I'm not the hacker, here is mozilla addon's certificate, check it's serial with one published on all the internet,” the hacker said in the latest of a flurry of posts on Pastebin. 

The private RSA key corresponded to the publicly available fake SSL certificate for addons.mozilla.org, according to Paul Mutton, security researcher at Bristish security firm, Netcraft.

“Only Comodo, the affiliate, or the hacker could have known this secret key,” said Mutton on Tuesday

Mozilla's addon domain was one of nine that were exposed to the fraudulently issued certificates.

The latest detail may settle ongoing doubts over the authenticity of the Comodo hacker’s claims. 

The Comodo hacker's release of a sample of DLL source code from the compromised server that was used to generate the fraudulant certificates fell short of concrete evidence.

“Comodo publishes the API that RAs [Registration Authority] used to integrate with its systems, so anybody could produce a similar DLL,” wrote Ars Technica’s Peter Wright. However he added that the DLL code was “pretty compelling” evidence that the person, at the very least, had some involvement in the hack.

The publication of RSA private key has produced a new threat, according to Netcraft's Mutton. 

"The publication of the private key introduces a widespread risk of man-in-the-middle attacks against Mozilla Add-ons users,” he said, adding that most browser users should be protected if they were using an updated version. 

The hacker's most recent Pastebin post sheds more light on exactly how he breached Comodo's certificate authority system, including a custom made keylogger. 

"After breach in insantssl.it, as you know default IIS configuration doesn't let you to do so much thing, getting SYSTEM (highest level in windows OS, like root in *nix) shell from that server with all updates installed and AVG Anti-Virus wasn't easy."

"After that I even installed keylogger on their server and I was monitoring administrators who logged in, keylogger was mine which bypasses all AV and Firewalls (including Kaspersky heuristic engine to Comodo Internet Security). So do not try to make it look simple."

Copyright © iTnews.com.au . All rights reserved.


Comodo hacker reveals Mozilla private key
 
 
 
Top Stories
Westpac committed to core banking plan
[Blog post] Now with leadership.
 
The True Cost of BYOD - 2014 survey
Twelve months on from our first study, is BYOD a better proposition?
 
Photos: Unboxing the Magnus supercomputer
Pawsey's biggest beast slots into place.
 
 
Sign up to receive iTnews email bulletins
   FOLLOW US...
Latest Comments
Polls
What is delaying adoption of public cloud in your organisation?







   |   View results
Lock-in concerns
  29%
 
Application integration concerns
  3%
 
Security and compliance concerns
  27%
 
Unreliable network infrastructure
  9%
 
Data sovereignty concerns
  22%
 
Lack of stakeholder support
  3%
 
Protecting on-premise IT jobs
  4%
 
Difficulty transitioning CapEx budget into OpEx
  3%
TOTAL VOTES: 1141

Vote