A total of 531 digital certificates were issued for domains that included google.com, the CIA, and Israel's Mossad,The list of domains and the fact that 99 percent of the users are in Iran suggest that the objective of the hackers was to intercept private communications in Iran, Fox-IT said.Google said on Aug. 29 that it received reports of "attempted SSL man-in-the-middle (MITM) attacks" against Google users, whereby someone tried to get between them and encrypted Google services. The people affected were primarily located in Iran.The attacker used a fraudulent SSL certificate issued by DigiNotar which has since revoked it, Google said in a blog post.Trend Micro, another security firm, said on Monday that domain validation.diginotar.nl was mostly loaded by Dutch and Iranian Internet users until Aug. 30. Domain name validation.diginotar.nl is used by Internet browsers to check the authenticity of SSL certificates that are issued by DigiNotar.DigiNotar is a small Dutch certification authority with customers mainly in the Netherlands. "We, therefore, expect this domain name to be mostly requested by Dutch Internet users and perhaps a handful of users from other countries but certainly not by a lot of Iranians," Trend Micro's senior threat researcher, Feike Hacquebord, said in a blog post.From analysis of Trend Micro Smart Protection Network data, the company found that a significant part of Internet users who loaded the SSL certificate verification URL (uniform resource locator) of DigiNotar were from Iran on Aug. 28, but by Aug. 30 most traffic from Iran disappeared, and on Sept. 2 about all of the Iranian traffic was gone.It became public in the evening of Aug. 29 that a rogue *.google.com certificate was presented to a number of Internet users in Iran, according to the Fox-IT report. The false certificate had been issued by DigiNotar and was revoked that same evening.
The security firm was contacted the next day and asked to investigate the breach and report its findings before the end of the week.Fox-IT's report indicates that the initial compromise at DigiNotar may have occurred on June 17. DigiNotar noticed the incident on June 19 in its daily audit procedure but doesn't appear to have done anything about it. The company could not be immediately reached for comment.The first rogue certificate *.google.com, was issued on July 10. All the other rogue certificates were issued between July 10 and July 20.The hack implies that the current network setup and procedures at DigiNotar are not sufficiently secure to prevent this kind of attack, Fox-IT said. The most critical servers, for example, contain malicious software that can normally be detected by anti-virus software. The separation of critical components was not functioning or was not in place, it added.
