Verisign Admits Company Was Hacked In 2010, Not Sure What Was Stolen

mask.of.sanity writes "Verisign admitted it was hacked repeatedly last year and cannot pin down what data was stolen. It says it doesn't believe the Domain Name System servers were hacked but it cannot rule it out. Symantec, which bought its certificate business in 2010, says also that there was no evidence that system was affected. Verisign further admitted in an SEC filing that its security team failed to tell management about the attacks until 2011, despite moving to address the hacks."

Comments

"Not sure what was stolen"

[Anonymous Coward]

"It's too soon to say."

Re:"Not sure what was stolen"

[Reasonable Facsimile]

http://qkme.me/35vpka

Am I Supposed to Care?

[kyrio]

Am I supposed to care about their hack? I don't trust Symantec or Verisign.

Re:Am I Supposed to Care?

[muon-catalyzed]

Verisign is still the most important internet authority, they sell most of those SSL certificates that enable internet business. Also they manage .COM and .NET domain system. It has always been feared that if they get hacked the internet economy might collapse. Even now it is perhaps better just to play it down and figure out how to lower their influence..

Re:Am I Supposed to Care?

[janeuner]

[citation needed]

This is like requesting citation for the assertion that most traffic tickets are written by police.

If you don't know how to check the certificate chains that authenticate Regions, US Bank, Discover, TurboTax, E-Trade, etc, then Slashdot really isn't for you.

Re:Am I Supposed to Care?

[icebraining]

Verisign alone might not, but Symantec (which now owns the "trust" business of Verisign), has 41.72% of the market, according to Netcraft: http://www.symantec.com/about/news/release/article.jsp?prid=20110526_01

weird

[Trepidity]

Leaving aside probable bad judgment on the security team's part in not informing management, doesn't a company like Verisign have standardized/mandatory issue tracking policies in place so it wouldn't even be a question of judgment on a team's part to inform management? Management should have a system in place to make sure they know what's going on security-wise in a business whose entire selling point is security.

Re:weird

[sycodon]

"Verisign further admitted in an SEC filing that its security team informed management about the attacks immediately while at the same time moving to address the hacks, but that management ignored it because they didn't understand the implications until the lawyers took away their drinks and shrimp cocktails and made them understand"

Re:weird

[PraiseBob]

I think the result is that the people in charge of the security team, and the top management need to be fired. Security is their core business, and lack of communication about something so integral to their business indicates that the top management are such monstrous assholes that they've created a seriously dysfunctional corporate culture where communication doesn't happen.

The security team had a huge failure. Management had an outright catastrophe. Management needs to be replaced entirely, which may well have happened already with Symantec buying them.

What was stolen?

[Kickasso]

The letter "i", apparently.

Re:What was stolen?

[Sockatume]

And twelve months, if we're to believe it was 2010 last year.

2010 or last year?

[Racemaniac]

If it takes this long to get the article on slashdot, can't you at least edit it so it's correct?

Re:2010 or last year?

[ackthpt]

If it takes this long to get the article on slashdot, can't you at least edit it so it's correct?

It was last year, last year, but this year it's last year's last year.

Hope that's clear enough now.

Re:2010 or last year?

[eternaldoctorwho]

Doctor, is that you?

Re:Who's next?

[sakdoctor]

The self-appointed gate keeper, and purveyors of security are always the first to get hacked.

Uncertainty is refreshing

[s.o.terica]

I'm actually impressed that they're admitting that they don't know. It seems wildly implausible that most statements about what was stolen during any given network hack are actually definitive.

Re:Uncertainty is refreshing

[tqk]

I'm actually impressed that they're admitting that they don't know.

I'm impressed they're admitting they've never heard of logservers. You know, those servers that're damned near inaccessible and do nothing but accept log event reports from all the other servers on their network?

Either that, or their backup regime sucks.

Re:Uncertainty is refreshing

[dgatwood]

If I had an unknown intrusion at a CA, first thing I'd be doing is generating a new root key, getting that into all the Web browsers, then revoking and generating new keys in the hierarchy.

And causing millions of IE6 users to no longer be able to access their online banking. For a service of this size, the revocation costs are huge.

Besides, if they designed their systems in even a halfway competent manner, stealing the private key through a hack should be essentially impossible. A properly designed key signing service involves a standalone signing server that runs no services other than the signing service. The signing service accepts incoming connections, reads data in a byte at a time until either an EOF marker is reached or a certain number of bytes have been read, then sends back a signed copy of that data, then closes the connection. There is basically no way that such a service can be hacked (barring incredibly stupid programming) because it has essentially zero attack surface. Therefore, there should be essentially zero possibility of the private key being compromised (theoretical timing attacks on the key notwithstanding).

The worst case scenario is that they signed some things that they shouldn't have. However, even if they did, the CA should have an offline log that cannot feasibly be compromised (on the signing server itself), which means that the bogus keys can be revoked individually instead of revoking the master key that signed them.

Stealing customer data is somewhat more plausible—email addresses, mailing addresses, phone numbers, billing data, etc. Stealing the private key is pretty unlikely unless the CA is incompetent.

Re:Who is "Versign"?

[AnInkle]

Conspiracy! By misspelling their name in the title it won't be searchable later. And if it can't be googled it didn't happen...

Re:Who is "Versign"?

[K. S. Kyosuke]

Like the subject says: Who is "Versign"? /first post please?!?!?!

It's the company formerly known as Verisign that has been hacked and had some characters stolen by hackers, including an 'i' in its name.

Re:Who is "Versign"?

[Hawke]

Verisign runs the top-level domain DNS servers for com, net, edu, cc, name, and a few other smaller ones. If you lookup gmail (ignoring caching), you have to ask Verisign-owned servers where the google DNS servers are, so you can ask those servers what the gmail IP address is. For the security of the internet: it's pretty important.

Until late 2010, Verisign also ran the dominant SSL business. That red circle with the black digitized check at the bottom of your bank's web page? Yeah, that. The SSL business was sold to Symantec, are are trying to slowly rebrand. For the security of the internet, SSL is also kinda important.

Re:Who is "Versign"?

[ackthpt]

Conspiracy! By misspelling their name in the title it won't be searchable later. And if it can't be googled it didn't happen...

Prevents you from contacting them and interrupting their meetings, the ones where they all give each other big raises for "actualizing" and stuff, also allows them to keep their scheduled tee times.

"Grandfather, you are old and senile, we can no longer take care of you. So we are sending you to an executive position at Verisign.

Used to work there when it happened

[Anonymous Coward]

Yes they run a very important part of the internet.

Yes are they filled to the brim with IT knowledge.

However, when this event occurred it was I that rebuilt their constellation of DNS and TLD servers. Bull$hit they didn't know it happened. I used to work for Ken Silva.

Bunch of liars.

If they can't say

[russotto]

I pretty much have to assume the worst: All their certificates were compromised and all their data was acquired. If they can't demonstrate these things didn't happen, they need to revoke and re-issue all their certificates, and re-sign those of their customers.

Re:If they can't say

[Lanboy]

If someone had a copy of the Verisign root public keys, it doesn't matter if the providers get new keys, your browser would trust any certificate created by these keys. So if you connect to a website encrypted by certificates from a different CA, a man in the middle attack presenting a newly minted certificate using the stolen keys would not raise any alarm in any SSL browser that trusts that verisign root certificate. Which essentially means every browser in the world.

Not only would every provider need to get new certificates and intermediates, every end user browser would need to be patched to no longer trust the compromised x509 root keys.

People are still using internet explorer 6.0 . Good luck on that one.

I wonder if this has anything to do with why Verisign was so hot to change their root keys (10/10/2010) , though they stated that this was for the 2048bit keylength that will be manditory 1/1/2014 .

Verisign supports terrorism

[Nyder]

Verisign got hacked and didn't disclose it, so since they are hiding it, according to the new FBI flyer, then obviously, they are supporting terrorism.

I demand this company gets sent to Gitmo.

if you don't, then you are a terrorist also.

Re:Who is "Versign"?

[SmurfButcher Bob]

...'cause they currently use McAfee?