Iranian hacker claims credit for Comodo attacks

A post on the popular website Pastebin sheds new light on the recent Comodo SSL certificate attacks. A 21 year old Iranian hacker who goes by the name of ComodoHacker, claims full responsibility for the hacks which saw certificates from popular websites created and forged.

Comodo admitted that on March 15, 2011 a Registration Authority (RA) in southern Europe was compromised and fraudulent certificates were created. The hacker some how gained access to an administrative username and password which they then used to create themselves their own username and password to create SSL certificates for URL's such as gmail.com, live.com and Skype. The New Jersey company came to the conclusion that the circumstantial evidence suggested the attack originated in Iran, and focused on the communication infrastructure, not the financial infrastructure as a typical cyber-criminal might. The company also thought the attacks were likely to be state-driven, however this recent news disputes the claim.

"I hacked Comodo from InstantSSL.it, their CEO's e-mail address mfpenco@mfpenco.com, their Comodo username/password was: user: gtadmin password: [trimmed], their DB name was: globaltrust and instantsslcms" says the document. ComodoHacker then explained more about how he managed to carry out the attack, "InstantSSL.it which was doing it's job under control of Comodo, I wrote a code for signing my CSRs using POST request to those APIs, I learned their APIs so FAST and their TrustDLL.DLL was too old and was not working properly, it doesn't send all needed parameters, it wasn't enough for signing a CSR."

We contacted Comodo but they declined to comment.

Report a problem with article
Previous Story

Windows 8 now showing up on Microsoft Connect?

Next Story

Panasonic and XPAND 3D announce new M-3DI 3D glasses standard

9 Comments

Commenting is disabled on this article.

Auditor said,
I am using Comodo but with their such a lax kind of security policy, I better find something else.

No necessarily their policy. It was a reseller, which all the cert companies use. Perhaps poor vendor management, but it could have happened to any of the big boys.