DigiNotar

» see diginotar.nl as it lived, on the wayback machine

~ the goodbye ~

I have never chosen a certificate authority. Neither has anyone else. A few hundred companies ship inside your browser as a list of organizations permitted to vouch for the identity of any website in the world, and you inherit that list from whoever built the browser. In 2011 DigiNotar was on mine, and I had never heard the name.

It was a Dutch company, founded in 1998 by a notary named Dick Batenburg, in Beverwijk north of Amsterdam. The notary part was the pitch. A notary witnesses that a document is what it claims to be, and DigiNotar sold the same service for web servers. It ended up doing that for the Dutch state, issuing the PKIoverheid certificates behind DigiD, which is how Dutch citizens log in to their own government. VASCO Data Security bought the company on 10 January 2011.

Somebody got inside the network, and DigiNotar's own logs put the first evidence of it on 19 June 2011. On 10 July a wildcard certificate for every Google domain was issued that Google had not requested. The company noticed the intrusions over that summer and revoked some of what had been issued. It told nobody.

~ the chronicle ~

~ the certificate that gave it away ~

It came apart on 27 August 2011 because of an Iranian Gmail user with a browser that was paying attention. Chrome shipped with a hardcoded expectation of which authorities were allowed to vouch for Google domains, and DigiNotar was not among them. The user got a warning, did not click through it, and posted it to a Google support forum.

That is the entire detection story. No audit and no regulator. A stranger's browser refused a certificate that every other browser on earth would have accepted in silence, and the person on the other end decided the warning was worth writing down somewhere public.

~ the three weeks ~

Fox-IT went in and produced the report that named the incident Operation Black Tulip. At least 531 fraudulent certificates had been issued. The traffic analysis put around 300,000 Iranian Gmail users behind the forged Google certificate, which means the interception had been live against real people for weeks while nobody outside the building knew it existed.

The browser vendors moved between 29 August and 9 September, pulling DigiNotar's roots one after another. On 3 September the Dutch government took over operational management of the company, because a private firm's collapse now had the state's own login system inside it. On 20 September DigiNotar was declared bankrupt.

~ what a root store actually is ~

There is no ranking inside a browser's trust list. A small Dutch notary's office and a global authority with a billion certificates behind it hold exactly the same power, which is total. Any authority in that list can produce a valid certificate for any domain on the internet, and until 2011 very few people outside the field had absorbed that the security of every site on the web is set by the weakest name on the list.

The repairs came out of this. Certificate Transparency, which forces every issued certificate into a public log where anyone can go looking for the ones that should not be there, is a direct descendant. So is the habit browsers now have of pinning critical domains to specific issuers, which is the thing that caught DigiNotar and which almost nothing else had at the time.

~ what got buried with it ~

DigiNotar is the only certificate authority ever killed outright by a breach. Others have been distrusted and carried on selling something else. This one was bankrupt three months after the intruder got in and three weeks after the first person outside the company noticed.

The distance from here is that nobody in Turkey, or anywhere, chose to trust it, and nobody could have chosen not to. That is still true of the list in your browser today. It has different names on it.

@}-->--

              )
             (_)
            .-'-.
            |   |
            |   |
            |   |
            |   |
          __|   |__   .-.
       .-'  |   |  `-:   :
      :     `---'     :-'
       `-._       _.-'
           '""""""

« previous  ·  random  ·  next »