Iranian government may be behind hack of Dutch security firm

• A daily summary of global reports on security issues.

A hacker's breach of a Dutch online security firm may have allowed the Iranian government to monitor hundreds of thousands of its citizens' e-mail accounts.

According to a statement from the Dutch government on Monday, a hacker broke into Dutch company DigiNotar, which provides security certificates to authenticate websites as safe for Internet users. The hacker then created hundreds of fraudulent certificates for Google, Yahoo, Facebook, and other major communication sites, as well as for the websites of the CIA, MI6, and Mossad.

With the fake certificates, the hacker could eavesdrop on Internet users' communications with these sites by rerouting their traffic through falsely authorized network paths while appearing to be secure.

According to an audit performed for the government by Dutch company Fox-IT, the fake Google certificate was used 300,000 times between Aug. 4 and Aug. 29, almost all of that usage coming from Iran. Al Jazeera writes that technology experts say the evidence suggests that the hackers were working with the Iranian government.

"The list of domains and the fact that 99 per cent of the users are in Iran suggest that the objective of the hackers is to intercept private communications in Iran," it concluded.

Roel Schouwenberg of Internet security firm Kaspersky said, "a government operation is the most plausible scenario."

An Iranian hacker claimed responsibility Monday for the DigiNotar breach, reports PC World. "Comodohacker" wrote on Pastebin.com that he attacked DigiNotar to punish the Dutch government, apparently for what he sees as its failure to prevent the death of 8,000 Muslims in Srebrenica during the Bosnian War in 1995.

Comodohacker, who describes himself as a 21-year-old Iranian student, had claimed he was behind an attack earlier this year on another certificate authority, Comodo. Mikko Hypponen of security vendor F-Secure says that it appears likely that Comodohacker was behind both attacks.

Technology news site The Register reports that the hack, which investigators are calling Operation Black Tulip, appeared to be a result of "DigiNotar's shocking ineptness in securing its system, compounded with its failure to come clean on its problems in a timely fashion."

1 | 2

Next