Taking a look at this (now rather old) article about the generated rogue DigiNotar certificates, it states the following:
...Such is the case with that small company in the Netherlands, DigiNotar. Reports from various sites indicate that hackers compromised the firm’s servers and generated rogue certificates. With a rogue certificate in place, a hacker can make your system think it’s using a legitimate, trusted certificate from well-known companies such as Google and Yahoo. The hacker can then intercept your Internet connection with the site you intended to use and redirect you to a fake site, where you are tricked into entering personal information such as your user name and password. Your computer still thinks it’s connected to a trusted site...
This is what I don't get: Instead of hacking CA's servers, wouldn't it be easier for a hacker to deploy a trojan which installs its own certificate in the 'trusted root certification authorities' store on the users computer (and then use some kind of DNS hack to redirect the users browser to a server from the hacker) and that way basicly accomplishing the same goal?
I mean, it's pretty easy to deploy a certificate in the root 'trusted root certification authorities' via a batch script, and with this in place, the browser won't raise any flags because the hackers rogue certificate is 'trusted'.
Why go through all the trouble of hacking the Certificate Authority? What am I missing here?