One year after DigiNotar breach, Fox-IT details extent of compromise

The hacker gained admin access to all critical DigiNotar certificate authority systems despite network segmentation, investigators say

The 2011 security breach at Dutch certificate authority (CA) DigiNotar resulted in an extensive compromise and was facilitated in part by shortcomings in the company's network segmentation and firewall configuration, according to Fox-IT, the security company contracted by the Dutch government to investigate the incident.

"The DigiNotar network was divided into 24 different internal network segments," Fox-IT said in its final investigation report, published earlier this week by the Dutch Ministry of Interior and Kingdom Relations. "An internal and external Demilitarized Zone (DMZ) separated most segments of the internal network from the Internet. The zones were not strictly described or enforced and the firewall contained many rules that specified exceptions for network traffic between the various segments."

The DigiNotar security breach occurred in July 2011 and resulted in a hacker using the company's certificate authority (CA) infrastructure to issue hundreds of rogue digital certificates for high-profile domains, including one for that was later used in a mass surveillance attack against Internet users in Iran. After the incident became public, browser and operating system developers revoked their trust in the certificates and the company filed for bankruptcy.

The breach was significant because it raised questions about the security and trustworthiness of the public key infrastructure (PKI) in its current form, which led to various technical proposals that promise to reduce the impact of certificate authority compromises and prevent the use of rogue digital certificates. There are currently hundreds of certificate authorities trusted by default in Web browsers and operating systems, and all of them can issue valid digital certificates for any domain on the Internet.

The attacker's original points of entry into the DigiNotar network were two Web servers that hosted public websites running on outdated and vulnerable versions of DotNetNuke, a Web content management system. These Web servers were located in the company's external Demilitarized Zone.

The intruder then leveraged the existent firewall rules to access and compromise servers from different network segments -- first from a segment called Office-net and then from a segment called Secure-net, which housed the certificate authority servers used for digital certificate issuing.

"Specialized tools were recovered on systems in these segments, which were used to create tunnels that allowed the intruder to make an Internet connection to DigiNotar's systems that were not directly connected to the Internet," Fox-IT said. "The intruder was able to tunnel Remote Desktop Protocol connections in this way, which provided a graphical user interface on the compromised systems, including the compromised CA servers."

DigiNotar operated multiple subordinate certificate authorities (sub CAs) and used them to issue digital certificates for different purposes, including certificates for the Dutch government's IT operations.

Fox-IT reiterated the conclusion expressed in its interim report released in September 2011: that all of DigiNotar's CA servers had been compromised. This was the result of the fact that all servers were on the same Windows domain and the attacker managed to obtain the domain administrator credentials, possibly through "brute force" methods because the password was not very strong, the company said in the interim report.

"The investigation by Fox-IT showed that all eight servers that managed Certificate Authorities had been compromised by the intruder," Fox-IT said in its final report released Monday. "The log files were generally stored on the same servers that had been compromised and evidence was found that they had been tampered with."

Because some of the logs had been deleted the company couldn't determine which of the compromised CA servers were actually used to issue rogue certificates. However, some evidence suggests that more rogue certificates than previously believed were issued by the hacker.

"Serial numbers for certificates that did not match the official records of DigiNotar were recovered on multiple CA servers, including the Qualified-CA server which was used to issue both accredited qualified and government certificates, indicating that these servers may have been used to issue additional and currently unknown rogue certificates," the company said.

Having access to a CA server wouldn't have been sufficient for the hacker to issue digital certificates, because this process required an operator to insert a smartcard in order to activate the corresponding private key, which was stored in a hardware security module.

"The unauthorized actions that might have taken place could not have included the issuing of rogue certificates if the corresponding private key had not been active during the intrusion period," Fox-IT said. "No records could be provided by DigiNotar regarding if and when smartcards were used to activate private keys, except that the smartcard for the Certificate Authorities managed on the CCV-CA server, which is used to issue certificates used for electronic payment in the retail business, had reportedly been in a vault for the entire intrusion period."

However, the company found evidence that Certificate Revocation Lists (CRL) -- lists of revoked digital certificates -- were automatically issued by some CA servers during the intrusion period. These lists need to be signed, which suggests that the private keys were active and the attacker had the opportunity to abuse them.

All information discovered during the investigation about the attacker, like the IP addresses he used -- some of them corresponding to proxy servers -- were handed over to the Dutch police. The evidence suggests that the hacker was located in Iran and a signature left in a text file points to him being the same attacker who compromised the Comodo certificate authority in March 2011.

Even though there are still some unanswered questions about the steps taken by the hacker once inside the DigiNotar network, some lessons can be learned from this incident, Fox-IT said.

First, it's important to complement prevention measures with detection measures, the company said. "Detection can prevent that critical parts of the infrastructure can be targeted, even in the case of a breach of a specific segment."

Separating the tasks performed by the IT staff is also important. For example, system administrators should not be in charge of setting up and maintaining firewalls or other security components of the infrastructure because they may be inclined to provide a pleasant working environment for users that would conflict with the task of limiting interaction between network segments, Fox-IT said.

Other recommendations enumerated by the company in its report include: separating vital systems as much as possible from untrusted network segments or the Internet; updating all software products on all systems as often as possible; limiting the amount of services that run on systems used for critical processes; hardening all systems by changing the default settings; performing regular penetration tests with different teams; and making sure that systems or networks are monitored and the appropriate employees are notified of any anomalies.

Join the PC World newsletter!

Error: Please check your email address.

Tags intrusionFox-ITsecurityAccess control and authenticationForensicsDigiNotarpki

Our Back to Business guide highlights the best products for you to boost your productivity at home, on the road, at the office, or in the classroom.

Keep up with the latest tech news, reviews and previews by subscribing to the Good Gear Guide newsletter.

Lucian Constantin

IDG News Service
Show Comments

Most Popular Reviews

Latest News Articles


PCW Evaluation Team

Azadeh Williams

HP OfficeJet Pro 8730

A smarter way to print for busy small business owners, combining speedy printing with scanning and copying, making it easier to produce high quality documents and images at a touch of a button.

Andrew Grant

HP OfficeJet Pro 8730

I've had a multifunction printer in the office going on 10 years now. It was a neat bit of kit back in the day -- print, copy, scan, fax -- when printing over WiFi felt a bit like magic. It’s seen better days though and an upgrade’s well overdue. This HP OfficeJet Pro 8730 looks like it ticks all the same boxes: print, copy, scan, and fax. (Really? Does anyone fax anything any more? I guess it's good to know the facility’s there, just in case.) Printing over WiFi is more-or- less standard these days.

Ed Dawson

HP OfficeJet Pro 8730

As a freelance writer who is always on the go, I like my technology to be both efficient and effective so I can do my job well. The HP OfficeJet Pro 8730 Inkjet Printer ticks all the boxes in terms of form factor, performance and user interface.

Michael Hargreaves

Windows 10 for Business / Dell XPS 13

I’d happily recommend this touchscreen laptop and Windows 10 as a great way to get serious work done at a desk or on the road.

Aysha Strobbe

Windows 10 / HP Spectre x360

Ultimately, I think the Windows 10 environment is excellent for me as it caters for so many different uses. The inclusion of the Xbox app is also great for when you need some downtime too!

Mark Escubio

Windows 10 / Lenovo Yoga 910

For me, the Xbox Play Anywhere is a great new feature as it allows you to play your current Xbox games with higher resolutions and better graphics without forking out extra cash for another copy. Although available titles are still scarce, but I’m sure it will grow in time.

Featured Content

Latest Jobs

Don’t have an account? Sign up here

Don't have an account? Sign up now

Forgot password?