Hackers steal SSL certificates for CIA, MI6, Mossad

[seemslikeadream]

Hackers steal SSL certificates for CIA, MI6, Mossad
Criminals acquired over 500 DigiNotar digital certificates; Mozilla and Google issue 'death sentence'
By Gregg Keizer
September 4, 2011 05:35 PM ET

Computerworld - The tally of digital certificates stolen from a Dutch company in July has exploded to more than 500, including ones for intelligence services like the CIA, the U.K.'s MI6 and Israel's Mossad, a Mozilla developer said Sunday.

The confirmed count of fraudulently-issued SSL (secure socket layer) certificates now stands at 531, said Gervase Markham, a Mozilla developer who is part of the team that has been working to modify Firefox to blocks all sites signed with the purloined certificates.

Among the affected domains, said Markham, are those for the CIA, MI6, Mossad, Microsoft, Yahoo, Skype, Facebook, Twitter and Microsoft's Windows Update service.

"Now that someone (presumably from Iran) has obtained a legit HTTPS cert for CIA.gov, I wonder if the US gov will pay attention to this mess," Christopher Soghoian, a Washington D.C.-based researcher noted for his work on online privacy, said in a tweet Saturday.

Soghoian was referring to assumptions by many experts that Iranian hackers, perhaps supported by that country's government, were behind the attack. Google has pointed fingers at Iran, saying that attacks using an ill-gotten certificate for google.com had targeted Iranian users.

All the certificates were issued by DigiNotar, a Dutch issuing firm that last week admitted its network had been hacked in July.

The company claimed that it had revoked all the fraudulent certificates, but then realized it had overlooked one that could be used to impersonate any Google service, including Gmail. DigiNotar went public only after users reported their findings to Google.

Criminals or governments could use the stolen certificates to conduct "man-in-the-middle" attacks, tricking users into thinking they were at a legitimate site when in fact their communications were being secretly intercepted.

Google and Mozilla said this weekend that they would permanently block all the digital certificates issued by DigiNotar, including those used by the Dutch government.

Their decisions come less than a week after Google, Mozilla and Microsoft all revoked more than 200 SSL (secure socket layer) certificates for use in their browsers, but left untouched hundreds more, many of which were used by the Dutch government to secure its websites.

"Based on the findings and decision of the Dutch government, as well as conversations with other browser makers, we have decided to reject all of the Certificate Authorities operated by DigiNotar," Heather Adkins, an information security manager for Google, said in a Saturday blog post.

Johnathan Nightingale, director of Firefox engineering, echoed that late on Friday.

"All DigiNotar certificates will be untrusted by Mozilla products," said Nightingale, who also said that the Dutch government had reversed its position of last week -- when it had asked browser makers to exempt its DigiNotar certificates.

[Hugh Manatee Wins]

B.S.

There's an ongoing psyop campaign to portray the military establishment as helplessly cyber-vulnerable to Those Pesky Kidz!

Guaranteed the shenanigans are being done (if they are being done) by spook 'red teams' setting the stage for more internet choking legislation/public hostility by the afore-mentioned military establishment. I'd bet money, if I had any, that 'Anonymous' is just such an operation establishing creds for later use.

[Wombaticus Rex]

Yep, "Cyberwarfare" got the DoD greenlight, I have a few friends in the field and they all know it's going to be big money...the next Pentagon procurement trough. Much like the media-palatable version of 5GW, "Lone Wolf Terror" it's false flag without the need for a flag....or even any evidence. By nature these threats leave no trace and are beyond the understanding of the general public, eliminating the need for explanations altogether.

But, I doubt this is news to anyone on RI, the "cyberwarfare" promo hustle has been going for over 3 years now.

[MinM]

NSA wants to hire hackers
By Stacy Cowley @CNNMoneyTech July 28, 2012: 10:37 AM ET

NSA Director Keith Alexander came to hacker gathering DefCon for the first time to recruit from the show's ranks.

LAS VEGAS (CNNMoney) -- Wearing a t-shirt and jeans, America's top spymaster -- National Security Agency Director Gen. Keith Alexander, also the head of the U.S. Cyber Command -- took the stage Friday at the nation's largest hacker convention to deliver a recruiting pitch.

"In this room, this room right here, is the talent our nation needs to secure cyberspace," Alexander told the standing-room-only audience at DefCon, a grassroots gathering in Las Vegas expected to draw a record 16,000 attendees this year. "We need great talent. We don't pay as high as everybody else, but we're fun to be around."

Alexander's appearance is a milestone for DefCon, a hacker mecca with an often-uneasy relationship with the feds. DefCon is the older, wilder and far less official sibling of BlackHat, a cybersecurity conference that wrapped up Thursday in Las Vegas.

BlackHat draws corporate infosecurity workers in suits. At DefCon, they switch to t-shirts and spend the weekend mingling with cryptographers, script kiddies, security researchers and a liberal smattering of military and law enforcement agents -- both in and out of uniform.

DefCon is famed as an elite hacking showcase. The registration badges alone are a technical feat, featuring a customizable circuit board and cryptographic scavenger-hunt puzzle. A hacker group called Ninja Networks set up a private cellular network to chat on during the show -- a stunt that drew admiring praise from Alexander during his talk.

Those are the kinds of skills the government needs, he said. Playing to his audience, Alexander rattled off a long list of tech-industry stars like Vint Cerf and Dave Aitel who did pioneering work on the federal payroll.

"We're the ones who built this Internet," Alexander said, citing the key role agencies like DARPA (Defense Advanced Research Projects Agency) played in the network's early days. "Now we're the ones who have to keep it secure, and I think you folks can help do that."
Related story: Former FBI cyber cop worries about a digital 9/11

To hammer the point home, the NSA set up a special recruiting site for the show: http://www.nsa.gov/careers/dc20/. It's not your standard government careers page. This one includes the line: "If you have a few, shall we say, indiscretions in your past, don't be alarmed."

The NSA is especially keen to draw in people like those holed up in a conference room just 20 feet away from Alexander's presentation, hunched over laptops and takeout cartons. They're competitors in Defcon's "Capture the Flag" battle, a kind of geek Olympics.

Hacking is usually a glamorless sport, but Defcon plays up the drama for its famed-in-nerd-circles CTF showdowns. In a darkened arena filled with rock music and colored laser lights, 20 competing teams fight for 48 hours to break into each other's servers and steal key information, called "flags," while holding off rival attackers. The winner will be announced Sunday evening during DefCon's closing ceremonies...

http://money.cnn.com/2012/07/27/technology/defcon-nsa/

Big money for Microsoft ‘Blue Hats’
By Agence France-Presse
Saturday, July 28, 2012 19:41 EDT

As hackers from around the world converged on Las Vegas, Microsoft doled out a quarter million dollars in prize money to researchers who found ways to thwart attacks on its software.

The winners of Microsoft’s first Blue Hat prize were unveiled at a hip club at a mobbed party complete with dancers, high-energy DJ, and explosions of shimmering confetti.

A top prize of $200,000 went to doctoral student Vasilis Pappas for an advance in countering “the most popular attack techniques we’re seeing today,” said Microsoft security response center senior director Mike Reavey...

http://www.rawstory.com/rs/2012/07/28/b ... blue-hats/

viewtopic.php?f=8&t=32285