Slashdot Mirror
Verisign Admits Company Was Hacked In 2010, Not Sure What Was Stolen
mask.of.sanity writes "Verisign admitted it was hacked repeatedly last year and cannot pin down what data was stolen. It says it doesn't believe the Domain Name System servers were hacked but it cannot rule it out. Symantec, which bought its certificate business in 2010, says also that there was no evidence that system was affected. Verisign further admitted in an SEC filing that its security team failed to tell management about the attacks until 2011, despite moving to address the hacks."
"It's too soon to say."
Like the subject says: Who is "Versign"? /first post please?!?!?!
Am I supposed to care about their hack? I don't trust Symantec or Verisign.
Leaving aside probable bad judgment on the security team's part in not informing management, doesn't a company like Verisign have standardized/mandatory issue tracking policies in place so it wouldn't even be a question of judgment on a team's part to inform management? Management should have a system in place to make sure they know what's going on security-wise in a business whose entire selling point is security.
10 PRINT CHR$(205.5+RND(1)); : GOTO 10
The letter "i", apparently.
So RSA, Symantec and Verisign have all been hacked. Who's next? Kaspersky? Fortinet? Check Point?
If it takes this long to get the article on slashdot, can't you at least edit it so it's correct?
No way! This is so 20th century! In Star Trek: Enterprise, the Suliban were able to detect that the stolen data disks hadn't been duplicated. Clearly, it's high time to finally develop a method that would allow us to detect that we're not the only ones who have some piece of information.
Ezekiel 23:20
I'm actually impressed that they're admitting that they don't know. It seems wildly implausible that most statements about what was stolen during any given network hack are actually definitive.
Forgot the FTFY, or whatever the hell the acronym is.
When Fascism comes to America, it will call itself Anti-Fascism, and tell you to give up your guns.
No, that happened when Symantec bought their certificate business.
From Verisign to Yieldsign
A feeling of having made the same mistake before: Deja Foobar
Trust is a weakness.
"Verisign further admitted in an SEC filing that its security team failed to tell management about the attacks until 2011"
Bullllllshit
Symantec, which bought its certificate business in 2010, "its" refers to Verisign, not Symantec. Is there a more proper term for this (I know it's not a dangling participle)?
Where is the bands of online zealots complaining that it took them so long to announce it like they did with sony when they waited A WEEK. Where is the governments saying they should have reported it sooner? Where are the thousands who blamed sony personally for getting?
Why is it no one lays siege to a company getting hacked except sony?
Yes they run a very important part of the internet.
Yes are they filled to the brim with IT knowledge.
However, when this event occurred it was I that rebuilt their constellation of DNS and TLD servers. Bull$hit they didn't know it happened. I used to work for Ken Silva.
Bunch of liars.
There is no "i" in VerSign.
Well, I mean sure, there's the other one, but there's no first "I".
I mean, yes, technically that second one becomes the first one, but.. Look, there just isn't.
I pretty much have to assume the worst: All their certificates were compromised and all their data was acquired. If they can't demonstrate these things didn't happen, they need to revoke and re-issue all their certificates, and re-sign those of their customers.
In 2009 Heartland Payment systems admitted to being hacked (150m+ credit card numbers swiped) and told the world at the exact moment the world was watching Oblama get inaugurated so nobody would notice...
TJX allows itself to be compromised for years...
Verisign - the keeper of the keys gets hacked and finally admits it...
Gee Uncle Roy! My moral compass is starting to swivel away from any notion to ever do the right thing again.
Verisign got hacked and didn't disclose it, so since they are hiding it, according to the new FBI flyer, then obviously, they are supporting terrorism.
I demand this company gets sent to Gitmo.
if you don't, then you are a terrorist also.
Be seeing you...
...is that the writer of the article doesn't have the slightest goddamned clue what he's talking about.
No, boy wonder. The DNS servers are not really the issue here. The issue is the PKI infrastructure which Verisign issues, and in particular the fact that Verisign is one of the few CAs that can issue Extended Verification (EV) certs. That a writer from a security-centric publication would not realize that Verisign is a major CA...or, in light of the events of the past 6 months what can happen when a CA gets hacked...is really fucking scary to me. He's supposed to be informing other people.
For your security, this post has been encrypted with ROT-13, twice.
If the root PKI private keys were lifted from the site then whoever had them could create valid ssl certificates for any DNS hostname that every browser and ssl stack in the world would view as real. If the same users were able to put themselves in the correct place in the network or be able to do a successful DNS poisoning attack, they would then be able to undetectably capture all data protected by the SSL public key infrastructure. So pretty much all internet data would be suspect.
I assume that this did not happen, as these super hackers would have access to huge swaths of the accounts and sensitive user information for for every e-commerce site in the world. You know your bank accounts and paypal and apple ids and credit card info. Those tax returns you do online, ssl vpns, ipsec vpns secured with x509 certificates, corporate mail, stock brokerage accounts. They would be able to relay mail undetectably thru every mail server that permits relay with authentication. Nothing major. I personally would put my money in a sock in my bedroom, but nothing major.
I would suggest you take a pair of socks and divide your money evenly between them so that you don't lose more than half your net worth.
I know I got about 50 socks in my sock drawer right now, but very very few matching pairs for some reason!
I only look human.
My mother is a halfling and my dad is an ogre, so that makes me an Ogreling
... that our entire security infrastructure for the internet is in the hands of such honest, open and competent individuals.
I run: Windows, OS X, Linux, FreeBSD. Just because you have a hammer, doesn't mean everything is a nail.
I thought we learnt this from the *AA against the world debate. Stealing is taking something away from the owner denying him the use of it. Nothing was taken away from Verisign. Somethings may have been shared, which may or may not take some future business away from Verisign, since people can now get their own trusted SSL certs. Copyright wasn't meant to be eternal, they have had their time limited monopoly on those keys. Society will profit as prices for EV certs will now go through the floor. Verisign can always do live performances or merchandize or something.
I work for Symantec and wanted to clarify that Verisign, Inc. was compromised, not the Trust Services (SSL, User Authentication (VIP, PKI, FDS) and other production systems acquired by Symantec. Symantec was NOT compromised by the corporate network security breach mentioned in the Verisign, Inc. quarterly filing. Here is the Verisign, Inc. statement on the 2010 security breach - vrsn.cc/AwJBFb
I work for Symantec and just wanted to clarify that the Trust Services (SSL, User Authentication (VIP, PKI, FDS) and other production systems acquired by Symantec were NOT compromised by the corporate network security breach mentioned in the Verisign, Inc. quarterly filing.