Comodo / DigiNotar hacker: I hacked other CAs too
The hack of Dutch certificate authority DigiNotar already bore many similarities to the break-in earlier this year that occurred at a reseller for CA Comodo. Bogus certificates were issued for webmail systems, which were in turn used to intercept Web traffic in Iran. Another similiarity has since emerged: the perpetrator of the earlier attacks is claiming responsibility for the DigiNotar break-in.
Calling himself ComodoHacker, the hacker claims that DigiNotar is not the only certificate authority he has broken into. He says that he has broken into GlobalSign, and a further four more CAs that he won't name. He also claimed that at one time he had access to StartCom.
The statement did not provide any specific details about how the hack was performed, offering only a high-level description of some of the things he did: he found passwords, used 0-day exploits, penetrated firewalls, and bypassed the cryptographic hardware that DigiNotar was using to gain remote access to machines. He said that a more detailed explanation would follow, when he had the time, and that it would serve as useful guidance for Anonymous and LulzSec. While lacking in detail, the hacker did include an Administrator-level username and password apparently used on DigiNotar's network. DigiNotar has not confirmed the authenticity of this information.
