Slashdot Mirror
Another Dutch CA Hacked
An anonymous reader writes "After the fiasco involving DigiNotar, another Dutch CA (Gemnet, a daughter of KPN-Telecom) has been hacked and databases were accessed, webwereld.nl reports (Dutch original). The hack was possible because the website was managed using PHP-MyAdmin, and this application allowed database access without a password. The site has been shut down and security checks were ordered."
So a CA, holder of the keys for SSL certs, had an externally facing db admin module with no password... Just wow...
At what point does this become "criminal negligence"?
And you'd expect there would be some sort of periodic audit process in place for anyone that manages a root certificate? hippa-style something or other? Or will they just set up any idiots with a CA that have good credit?
I work for the Department of Redundancy Department.
this application allowed database access without a password
Nope, it doesn't.. not unless configured by a really clueless person, or (this being Holland) by someone who really couldn't give a f**k while being mis-managed by someone determined to spend as little as possible, or hopefully less.
(disclaimer; I'm a sysadmin who runs, amongst many other things, a MySQL server + PHPmyadmin for my company in the Netherlands, I do it properly but that's only because I care, nobody has ever checked..)
"Oops, I always forget the purpose of competition is to divide people into winners and losers." - Hobbes
Why blame the tool? It's like blaming the web browser that the people used to access PHPMyAdmin to access the unsecured database. It's the dits who didn't secure the database that are to blame. Put a password on it and PHPMyAdmin won't be able to get in. Unless there's an exploit I'm not aware of, of course.
"The hack was possible because the website was managed using PHP-MyAdmin, and this application allowed database access without a password."
I honestly don't know what to say. I mean, doing something like this on an internal network would be bone-headed enough, but doing it on an external-facing box? Under conditions where you would think security is paramount? I mean, you have to actually install and set up PHP MyAdmin - that shit isn't on by default.
But, the fault lies elsewhere as well. After all, who the fuck was supposed to be doing the compliance audits, pen-testing, network security, firewall security? You always hire a reputable outside person/company to do those things.
I honestly think the corp got what it deserved at this point... though the victim customers certainly don't deserve what they're about to get (a scramble for new certs, integrity checking, etc).
Quo usque tandem abutere, Nimbus, patientia nostra?
So, any CA can create a cert for any site (or even EVERY site via *.* -- WHO THOUGHT THIS WAS A GOOD IDEA?!). This means EVERY SINGLE CA must remain 100% secure all the time in order for us to be able to trust the CA system.
Now, this was pointed out from the beginning. "There is not a single point of failure -- No! There are MANY points of failure, any of which means a complete breakdown!"
A web of trust is the only real competing system, and still here we are, not even trying that out on a large scale. Say what you will, but know that all trust tree hierarchies are doomed to fail.
Come at me CA apologists. All your certs aren't belong to you.
The hack was possible because the website was managed using PHP-MyAdmin, and this application allowed database access without a password.
That's a bit misleading. From what I gather the hack was possible because the database was configured to allow access without a password. Considering that, whether or not PHPMyAdmin is appropriate is a tiny matter by comparison. The summary makes it sound like PHPMyAdmin is to blame.
In response to the news, Gemnet's parent company KPN, has revoked a thousand certificates. Dutch original
Once I though that CA where serious business, with the biggest of them hosted in bunkers with complete security for the keys.
Now I know it's just as secure as everything else on the net: as Lulzsec demonstrated this year, no security whatsoever.
Now I'm just waiting to learn that nuclear missiles launch consoles are web applications with a "secure" javascript password check to protect them.
And replace it with... what?
CAs are a lot like democracy. They both suck, but they tend to suck less than all other forms that have been tried up to now.
Quo usque tandem abutere, Nimbus, patientia nostra?
And here I thought the Dutch would have the national pride not to make their network security like Swiss Cheese.
So the first question I expected t.f.a. to answer:
What is the subject name of this Ca so I can remove it from my list of "trusted" Cas?
I'm kinda getting an Uplink vibe here, with all these "X was hacked" "Another X was hacked, the government is taking it very seriously" on and on and on.
Sent from my CR-48
The keys are there to protect my communications. And yet I am not the one who is choosing who to use as the vendor for my trust. I am given a list of 3rd parties that I have never heard of instead.
There should not be 1000+ organizations in charge of the security of my communications. I should choose a vendor I trust, and then that vendor should decide if the website I am trying to reach is legitimate. The system is broken by design.
For Verisign to get hacked.
If builders built buildings the way programmers wrote programs, then the first woodpecker would destroy civilization.
These stories about Dutch CA's are really clogging up the system.
https://www.eff.org/https-everywhere
Not sure if it would've helped in this situation, as it seems the DB itself had no password, but since I don't run phpMyAdmin, I use a fail2ban jail which bans any IP trying to access phpMyAdmin since they're obviously up to no good.
Shameless plug:
Jails for phpMyAdmin, ssh as root, and, bad robots:
https://www.maow.net/fail2ban
And, it's using a self-signed certificate ... seems like the only CA I can trust is myself, and I don't really like the look of that shifty character in the mirror either.
According to KPN, the hacked website was not part of the CA's issuing system. Assuming they're being wholly truthful, this article is pure sensationalism: A company has a non-critical website that's hacked: whooptie.
Of course it's bad PR: it doesn't inspire confidence in their other security matters. However, its just as likely that they're concentrating on their actual business (managing certificates), and the site was an afterthought. In any case (maybe I'm just cynical) it doesn't surprise me that a very low traffic, low volume site is negligently secured.
Totally misleading headline.
FFS, if you're depending on phpMyAdmin for your database security, you're doing it wrong. If phpMyAdmin, out of the box, can access your MySQL server, it means you haven't given a password to the root user on MySQL. Which means anyone that can connect to your MySQL server at all has full access.
Unless setup in a very specific way, all phpMyAdmin does is pass along your authentication information to MySQL.
It's better to vote for what you want and not get it than to vote for what you don't want and get it.
- E. Debs
Someone please mod parent up.
TFA describes a complete failure not only of the company's security setup, but of its specific architecture and design. Even if you have to use phpMyAdmin that frickin' badly? Unless you're a web hosting provider running the damned thing in a sandbox, you deny visibility to it from the outside network for starters. Then there's still the matter of the default password-less state of the DB.
I mean, damn... what high school kid did they get to set this thing up? It's not 2001 anymore, where brain farts like that could be ignored, and the worst you had to worry about is some script kiddie defacing your company home page.
Quo usque tandem abutere, Nimbus, patientia nostra?
"But what's really scary, is that the evidence F-Secure found suggests that DigiNotar was hacked at least two years ago."
I don't agree that having one's ass hanging in the wind — thinking your SSL connections are secure while they're not — for two years is a system that "works".
It's astonishing in the current landscape where most everyone appears to be concerned and casting about for solutions to see someone thinking the CA system is fine. The foundation of the CA system involves giving each of hundreds of race-to-the-bottom entities complete authority over your SSL security. Even if "race-to-the-bottom" weren't their nature, you'd still have a bell curve of performance, and the tail on the left side is your maximal security. (You are here.) The system is inherently flawed.