End of the road for DigiNotar as bankruptcy declared

DigiNotar, the Dutch certificate authority which hackers compromised and used to generate hundreds of bogus web security certificates, has filed for bankruptcy.
The announcement that DigiNotar has filed for voluntary bankruptcy was made today by its US parent company VASCO Data Security International.
And, quite frankly, there aren't many who will be mourning its loss.

VASCO's CEO, T. Kendall Hunt, seemed keen to disassociate the parent firm from the security problems seen at its subsidiary:

"We would like to remind our customers and investors that the incident at DigiNotar has no impact on VASCO's core authentication technology. The technological infrastructures of VASCO and DigiNotar remain completely separated, meaning that there is no risk for infection of VASCO's strong authentication business."

Cliff Bown, Vasco's chief financial officer, said the losses associated with DigiNotar "were expected to be significant."
It's unlikely that many people are going to shed many tears over the demise of DigiNotar. The firm lost all trust when when it was discovered that it had known that it had suffered a security breach weeks before coming clean about the problem.
But it does serve as a chilling reminder of just how fatal a hack can be for an organisation, especially if the way your corporation decides to respond to it is woefully insufficient.
The fraudulent certificates were issued in the name of major web properties such as Facebook, Twitter, Microsoft and Google; and even in the name of intelligence agencies such as the Mossad and the CIA).
For more background on the DigiNotar security scandal, make sure to take the time to listen to a recent Sophos podcast which discussed the issue featuring Sophos experts Chester Wisniewski and Mike Wood:
You can also download the podcast directly in MP3 format: Sophos Security Chet Chat 72

Flaw in OS X Lion allows unauthorized password changes

A researcher at the Defense in Depth blog has discovered a flaw in Apple's recently released operating system, OS X 10.7 (Lion), which allows passwords to be changed without knowledge of the logged in user's password.
The flaw appears related to Apple's move towards a local directory service which has permissions set in an insecure manner.
An attacker who has access to a logged in Mac (locally, over VNC/RDC, SSH, etc) is able to change the currently logged in user's password without knowing the existing password as would normally be required:

testmac:~ TestUser$ dscl localhost -passwd /Search/Users/TestUser
New Password:
Historically (in Snow Leopard) you would have needed to enter your existing password first to verify that you in fact are the account holder:

testmac:~ TestUser$ passwd
Changing password for TestUser.
Old Password: -OldPass-
New Password: -NewPass-
Retype New Password: -NewPass-

Not only can a logged in user change their password without knowledge of the existing password, but you can read any other users password hash and make attempts at brute forcing it.
Defense in Depth showed how you can parse the hash from openly readable directory information and recover both the hash and the salt used to encrypt the password.
This is another great reason to be sure you have secured your Mac properly until Apple makes a fix available. Taking the following steps will help ensure you are protected:

1. Use a secure password to prevent brute force attacks against your account using stolen hashes.
2. Enable the screensaver and set it to prompt you for your password.
3. Disable automatic logon.
4. Never leave your Mac logged in and unattended. Use a "Hot Corner" or the Keychain lock to lock your screen.

Keychain preferences windows on OS X 10.7 allows for status bar icon for locking.
For more tips on securing your Mac check out our three part series on top tips for Mac OS X security.
This is particularly dangerous if you are using Apple's new FileVault 2 disk encryption. If your Mac were left unlocked and someone changed your password you would no longer be able to boot your computer and potentially would lose access to all of your data.
Cnet had reported that you can also change other users passwords, but I was unable to replicate their findings.
Hopefully Apple will release an update soon, I was able to confirm with testers of OS X 10.7.2 that the flaw still exists in test builds.

Microsoft reissues update for Win XP/2003 for DigiNotar certificate revocation

Microsoft had to reissue an update for users of Windows XP and Windows 2003 today related to the compromise of certificate authority DigiNotar.
It was not related to further hacking though, it appears to be a quality assurance SNAFU at the software giant.
Microsoft has updated the known issues in security advisory 2607712 to refer to an updated advisory 2616766.
KB article 2616766 points out that the update shipped last week to remove the known compromised certificates from the trusted certificate list omitted the certificates known to have been in use in the wild.
Somehow Microsoft's Patch Tuesday update only removed additional certificates issued to DigiNotar by GTE and Entrust, but did not remove the original root certificates used to intercept communications in Iran.
Users of Windows XP and 2003 with automatic updating enabled will receive the updated patch automatically, but administrators who manually deploy patches using WSUS may be required to push update 2616676 a second time.
Even worse the update requires users of XP and 2003 to reboot after applying the fixed update. Users of Windows 7, Vista, 2008 and 2008 R2 are unaffected.

SSL certificate debacle includes CIA, MI6, Mossad and Tor

Last week I wrote about the compromise of digital certificate authority DigiNotar. While the idea of over 250 false certificates being issued was scary, the number has grown to 531, including what could be intermediate signing certificates.
This is really bad news. As DigiNotar is a "root" certificate, they can assign authority to intermediaries to sign and validate certificates on their behalf.
It appears the attackers signed 186 certificates that could have been intermediate certificates. These certificates masqueraded as well-known certificate authorities like Thawte, Verisign, Comodo and Equifax.
The expanded list of domains for which fraudulent certificates were issued includes Facebook, Google, Microsoft, Yahoo!, Tor, Skype, Mossad, CIA, MI6, LogMeIn, Twitter, Mozilla, AOL and WordPress. A complete list can be downloaded from the Tor website.
The attackers also issued themselves certificates for *.*.com and *.*.org. I am not sure if a multi-wildcard certificate like this is valid, but if so it could allow them to impersonate anything.
According to the blog post on the Tor project's website, they also left a message in Farsi. Loosely translated, it reads "great cracker, I will crack all encryption, i hate/break your head."
This incident makes me feel more justified than ever in my distrust of the certificate system. While Mozilla, Google and others have been quick to permanently remove DigiNotar as a trusted authority, in this case it is too little, too late.
Currently computer users of IE and Safari on Windows 7/Vista/2008/2008R2, or Chrome and Firefox on any platform, are protected against exploitation as long as they are fully patched.
Mac OS X users using the latest Chrome and Firefox (6.0.2) versions are fine, but Safari and OS X itself have not been patched. There are instructions on doing so on the ps | Enable blog, although it is non-trivial.
More concerning is that mobile users are being left in the dark. There have been no updates, and no manual removal method for Android or iPhone/iPad/iPod Touch users who haven't jailbroken/rooted their devices.
Tap, tap, tap... Hello, Apple? Are you there? Your competitors (Microsoft, Google, Mozilla) are protecting their customers promptly and openly. I know you don't like to talk about security, but now would be a great time to show you care.