Comodo hacker reveals Mozilla private key

Powered by SC Magazine
 

Only Comodo or hacker know this detail.

The self-proclaimed Iranian Comodo hacker has published the private RSA encryption key for Mozilla’s addons domain, which a British security firm confirmed could only have been known by the hacker or Comodo. 

For some real dumbs ... WHO STILL thinks I'm not the hacker, here is mozilla addon's certificate, check it's serial with one published on all the internet,” the hacker said in the latest of a flurry of posts on Pastebin. 

The private RSA key corresponded to the publicly available fake SSL certificate for addons.mozilla.org, according to Paul Mutton, security researcher at Bristish security firm, Netcraft.

“Only Comodo, the affiliate, or the hacker could have known this secret key,” said Mutton on Tuesday

Mozilla's addon domain was one of nine that were exposed to the fraudulently issued certificates.

The latest detail may settle ongoing doubts over the authenticity of the Comodo hacker’s claims. 

The Comodo hacker's release of a sample of DLL source code from the compromised server that was used to generate the fraudulant certificates fell short of concrete evidence.

“Comodo publishes the API that RAs [Registration Authority] used to integrate with its systems, so anybody could produce a similar DLL,” wrote Ars Technica’s Peter Wright. However he added that the DLL code was “pretty compelling” evidence that the person, at the very least, had some involvement in the hack.

The publication of RSA private key has produced a new threat, according to Netcraft's Mutton. 

"The publication of the private key introduces a widespread risk of man-in-the-middle attacks against Mozilla Add-ons users,” he said, adding that most browser users should be protected if they were using an updated version. 

The hacker's most recent Pastebin post sheds more light on exactly how he breached Comodo's certificate authority system, including a custom made keylogger. 

"After breach in insantssl.it, as you know default IIS configuration doesn't let you to do so much thing, getting SYSTEM (highest level in windows OS, like root in *nix) shell from that server with all updates installed and AVG Anti-Virus wasn't easy."

"After that I even installed keylogger on their server and I was monitoring administrators who logged in, keylogger was mine which bypasses all AV and Firewalls (including Kaspersky heuristic engine to Comodo Internet Security). So do not try to make it look simple."

Copyright © iTnews.com.au . All rights reserved.


Comodo hacker reveals Mozilla private key
 
 
 
Top Stories
Slow progress in Turnbullistan
[Blog post] How has the NBN moved ahead since regime change?
 
Hacks and frauds can't dampen Bitcoin buzz
[Blog post] Enthusiasts meet in Melbourne.
 
Qantas checks in with cloud computing
Impressed with results of public cloud bake-off.
 
 
Sign up to receive iTnews email bulletins
   FOLLOW US...
Latest Comments
Polls
What is delaying adoption of public cloud in your organisation?







   |   View results
Lock-in concerns
  22%
 
Application integration concerns
  3%
 
Security and compliance concerns
  31%
 
Unreliable network infrastructure
  9%
 
Data sovereignty concerns
  24%
 
Lack of stakeholder support
  4%
 
Protecting on-premise IT jobs
  4%
 
Difficulty transitioning CapEx budget into OpEx
  3%
TOTAL VOTES: 508

Vote