An internet user with proven ties to the DigiNotar hack claims he stole email, customer data and other sensitive data from two competing web authentication authority that will be released publicly soon.
In a statement posted Thursday , an individual calling himself Comodohacker expanded on claims that he breached the security of Israel-based certificate authority StartCom and its competitor GlobalSign, which is headquartered in the US. “I have ALL emails, database backups, customer data” for StartCom, he wrote, and went on to say he had access to “the entire server,” database backups and system configuration of GlobalSign. GlobalSign has already stopped issuing certificates while it investigates.
Thursday's claims came shortly after Comodohacker offered the first conclusive proof he had insider knowledge of the security breach of Netherlands-based DigiNotar that minted more than 500 counterfeit certificates for Google.com and dozens of other websites. The unknown individual, who claims to be a 21-year-old Iranian who is sympathetic to his country's government, posted a file that was signed with the private key of the fraudulent Google certificate, proving he had close with the people who perpetrated the hack.
Comodohacker previously confirmed his involvement in a hack on a reseller of the Comodo certificate authority that also forged counterfeit credentials for sensitive websites.
In Thursday's post, he went on to provide details into the breach on DigiNotar, claiming its HSM, or hardware security module, ran on the OpenBSD operating system and had only a single port open that was protected with RSA SecurID and SafeSign Token management systems. It's unclear if that description matches the systems used by DigiNotar.
In June StartSSL suffered a security breach in which attackers attempted to mint fraudulent certificates for several sensitive websites but were ultimately unsuccessful. It was at least the fifth time an entity that issues SSL, or secure sockets layer, certificates had been targeted. In all, four of Comodo's resellers have suffered security breaches in the past six months.
There's no proof Comodohacker was behind the June attack on StartSSL, but in a post published Tuesday and a second post that followed the day , he claimed he managed to gain control of the hardware security module StartSSL uses to issue certificates but was thwarted at the last minute because the company relied on manual verification.
In the same post, Comodohacker disputed claims Microsoft made Monday that fraudulently issued certificates for domains including *.microsoft.com and *.windowsupdate.com could be used to hijack Microsoft's security update system.
"I'm able to issue windows update," he wrote. "Microsoft's statement Windows Update and that I can't issue such update is totally false!"
Microsoft declined to .
“This is totally a state- attack on the PK infrastructure so you have to take it seriously,” he told The Register . “You have to immediately turn everything into emergency mode, whatever that is in your company.”
In addition to temporarily ceasing certificate issuance during its investigation, GlobalSign has hired Dutch security firm Fox IT to assist in the probe. It's unclear what steps StartCom has taken in response to the claims. Representatives from both companies didn't respond to emails seeking for this post. ®
This article was updated to add details a attack on StartCom, and fraudulent certificates issued for Microsoft domains.
7 in 10 enterprises expected to abandon vendor-built agentic AI by 2028
Build it, bill it, bin it as forward-deployed engineering leaves customers dependent on outside expertise
Apple makes the AirPods 5 slightly less hostile to repair
Replaceable earbud batteries lift iFixit score from zero to a dizzying two out of ten
Huawei Cloud Rolls Out Enterprise AI Products Across the Board, Building an Open Agentic Cloud
PARTNER CONTENT: Huawei Cloud strengthens the silicon bedrock on the cloud
Drunk Van Halen fan called Microsoft support and demanded to speak to Gates
A broken Java applet had one FrontPage user ready for an Eruption
AWS needs to embrace its place as the Depot of AI infrastructure
What's wrong with being a great wholesaler?
America is planning more AI datacenters than its chip supply can fill
Satellite imagery shows construction accelerating, but advanced packaging could cap 2027 deployment in the low 20s of gigawatts
Astronomer watches Starlink satellites sinking to build a ‘planetary barometer’
Astronomer watches Starlink satellites sinking to build a ‘planetary barometer’
EXCLUSIVE Microsoft tells nonprofits their deleted M365 data isn't coming back
Microsoft tells nonprofits their deleted M365 data isn't coming back
ShinyHunters claims FBI hack: 'This is NOT financially motivated'
ShinyHunters claims FBI hack: 'This is NOT financially motivated'
Google ending ChromeOS support two years early
Google ending ChromeOS support two years early
AI models keep posting screenshots showing sensitive data from inside tech companies
AI models keep posting screenshots showing sensitive data from inside tech companies
DoJ: Uncle Sam bought forensics software from same Russian operation supplying FSB
DoJ: Uncle Sam bought forensics software from same Russian operation supplying FSB
Add one more AI worry to the nightmare scenario: self-replicating prompt injections It's a worm attack, AI-style
Add one more AI worry to the nightmare scenario: self-replicating prompt injections
It's a worm attack, AI-style
Zuckerberg touts enterprise AI push because Meta would never do anything to damage your reputation New business unit to be led by former MongoDB CEO 'CJ' Desai
Zuckerberg touts enterprise AI push because Meta would never do anything to damage your reputation
New business unit to be led by former MongoDB CEO 'CJ' Desai
AMD's 192 GB Gorgon Halo prices might leave you petrified Regular pricing starts at $6,799 - all that memory doesn't come cheap
AMD's 192 GB Gorgon Halo prices might leave you petrified
Regular pricing starts at $6,799 - all that memory doesn't come cheap
Schneider gives datacenter switchgear the software-defined treatment Equinix pilot promises faster deployment and over-the-air upgrades without downtime, provided the code behaves itself
Schneider gives datacenter switchgear the software-defined treatment
Equinix pilot promises faster deployment and over-the-air upgrades without downtime, provided the code behaves itself
Investors are pricing in a 32.6% AI productivity boost for software engineers Economists turn stock movements into an estimate of anticipated gains – while warning that markets can get carried away
Investors are pricing in a 32.6% AI productivity boost for software engineers
Economists turn stock movements into an estimate of anticipated gains – while warning that markets can get carried away
Security Russians are posing as Signal support to launch phishing attacks PLUS: US takes down Iranian propaganda sites; Marketing company asks 'Why Do We Have Your Information?' And more!
Russians are posing as Signal support to launch phishing attacks
PLUS: US takes down Iranian propaganda sites; Marketing company asks 'Why Do We Have Your Information?' And more!
Security Microsoft patches failed to fix on-prem SharePoint, which is now under zero-day attack PLUS: China upgrades smartphone surveillance tools; Ring eases anti-snooping stance; and more
Microsoft patches failed to fix on-prem SharePoint, which is now under zero-day attack
PLUS: China upgrades smartphone surveillance tools; Ring eases anti-snooping stance; and more
Black Hat and DEF CON DEF CON Franklin project enlists hackers to harden critical infrastructure Voting village reports have been so successful, says Jeff Moss, that the whole of DEF CON will now be included
Black Hat and DEF CON
DEF CON Franklin project enlists hackers to harden critical infrastructure
Voting village reports have been so successful, says Jeff Moss, that the whole of DEF CON will now be included
Security EQT buys majority in Swiss cybersecurity biz Acronis Went at equivalent of $3.5B+ valuation for entire firm, though portion sold not specified
EQT buys majority in Swiss cybersecurity biz Acronis
Went at equivalent of $3.5B+ valuation for entire firm, though portion sold not specified
Malware Month Ten years since the first corp ransomware, Mikko Hyppönen sees no end in sight On the plus side, infosec's a good bet for a long, stable career
Ten years since the first corp ransomware, Mikko Hyppönen sees no end in sight
On the plus side, infosec's a good bet for a long, stable career
KDE turns 30 and someone's brought an AI-native desktop proposal Akademy talk imagines Plasma assembling itself around a personal model of each user
KDE turns 30 and someone's brought an AI-native desktop proposal
Akademy talk imagines Plasma assembling itself around a personal model of each user
Shopify extends lifeline to Tailwind as vibe coding erodes web dev platform's bottom line Acquisition gives open source CSS framework 'a stable long-term '
Shopify extends lifeline to Tailwind as vibe coding erodes web dev platform's bottom line
Acquisition gives open source CSS framework 'a stable long-term '
Switzerland tests a FOSS escape route from Microsoft 365 Swiss Army sticks a knife in American cloud apps with its own FOSS push
Switzerland tests a FOSS escape route from Microsoft 365
Swiss Army sticks a knife in American cloud apps with its own FOSS push
Feel peak Windows was 7? You might like Kumander Linux Debian and Xfce – solid, sensible choices – with a pretty skin
Feel peak Windows was 7? You might like Kumander Linux
Debian and Xfce – solid, sensible choices – with a pretty skin
Canonical shuttering some of its legacy chat channels The Ubuntu Pastebin went in June, IRC gets demoted
Canonical shuttering some of its legacy chat channels
The Ubuntu Pastebin went in June, IRC gets demoted
Audacity audio-editing app no longer looks like it's from the early 2000s The FOSS tool for audio editing has a fresh coat of paint, and new features to boot
Audacity audio-editing app no longer looks like it's from the early 2000s
The FOSS tool for audio editing has a fresh coat of paint, and new features to boot
The full story
This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.
