Comodo hacker reveals Mozilla private key

Powered by SC Magazine
 

Only Comodo or hacker know this detail.

The self-proclaimed Iranian Comodo hacker has published the private RSA encryption key for Mozilla’s addons domain, which a British security firm confirmed could only have been known by the hacker or Comodo. 

For some real dumbs ... WHO STILL thinks I'm not the hacker, here is mozilla addon's certificate, check it's serial with one published on all the internet,” the hacker said in the latest of a flurry of posts on Pastebin. 

The private RSA key corresponded to the publicly available fake SSL certificate for addons.mozilla.org, according to Paul Mutton, security researcher at Bristish security firm, Netcraft.

“Only Comodo, the affiliate, or the hacker could have known this secret key,” said Mutton on Tuesday

Mozilla's addon domain was one of nine that were exposed to the fraudulently issued certificates.

The latest detail may settle ongoing doubts over the authenticity of the Comodo hacker’s claims. 

The Comodo hacker's release of a sample of DLL source code from the compromised server that was used to generate the fraudulant certificates fell short of concrete evidence.

“Comodo publishes the API that RAs [Registration Authority] used to integrate with its systems, so anybody could produce a similar DLL,” wrote Ars Technica’s Peter Wright. However he added that the DLL code was “pretty compelling” evidence that the person, at the very least, had some involvement in the hack.

The publication of RSA private key has produced a new threat, according to Netcraft's Mutton. 

"The publication of the private key introduces a widespread risk of man-in-the-middle attacks against Mozilla Add-ons users,” he said, adding that most browser users should be protected if they were using an updated version. 

The hacker's most recent Pastebin post sheds more light on exactly how he breached Comodo's certificate authority system, including a custom made keylogger. 

"After breach in insantssl.it, as you know default IIS configuration doesn't let you to do so much thing, getting SYSTEM (highest level in windows OS, like root in *nix) shell from that server with all updates installed and AVG Anti-Virus wasn't easy."

"After that I even installed keylogger on their server and I was monitoring administrators who logged in, keylogger was mine which bypasses all AV and Firewalls (including Kaspersky heuristic engine to Comodo Internet Security). So do not try to make it look simple."

Copyright © iTnews.com.au . All rights reserved.


Comodo hacker reveals Mozilla private key
 
 
 
Top Stories
Coalition's NBN cost-benefit study finds in favour of MTM
FTTP costs too much, would take too long.
 
Who'd have picked a BlackBerry for the Internet of Things?
[Blog] BlackBerry has a more secure future in the physical world.
 
Will Nutanix be outflanked before reaching IPO?
VMware muscles in on storage startup in hyper-converged infrastructure.
 
 
Sign up to receive iTnews email bulletins
   FOLLOW US...
Latest Comments
Polls
Which is the most prevalent cyber attack method your organisation faces?




   |   View results
Phishing and social engineering
  70%
 
Advanced persistent threats
  3%
 
Unpatched or unsupported software vulnerabilities
  11%
 
Denial of service attacks
  6%
 
Insider threats
  10%
TOTAL VOTES: 649

Vote