2

Apart from the infamous Superfish/Lenovo case this year, are there any other known cases of a malicious root certificate being installed on a target machine to allow transparent MITM attacks, whether by a foreign government, intelligence service, employer or Russian hacker ?

  • Are you asking for only previously unknown examples of a rare phenomena? – ztk Aug 11 '15 at 18:11
  • "whether by a foreign government": you are assuming that the foreign government root CA's are not already installed by default in user's certificate stores... – WhiteWinterWolf Aug 12 '15 at 9:24
4

The same software library that Superfish uses is present in other products beside those found in Lenovo products last year: http://www.tripwire.com/state-of-security/latest-security-news/researchers-reveal-evidence-of-other-superfish-style-attacks-in-the-wild/

Then there are the 2011 Comodo and DigiNotar breaches, which may be the most famous, early root certificate compromises as they were commercial Certificate Authority vendors. Their root certificates were already trusted by most, if not all, browsers at the time. The breaches included the issuance of false certificates impersonating Google, Yahoo, and others.

(https://nakedsecurity.sophos.com/2011/03/24/fraudulent-certificates-issued-by-comodo-is-it-time-to-rethink-who-we-trust/)

(http://arstechnica.com/security/2011/09/comodo-hacker-i-hacked-diginotar-too-other-cas-breached/)

  • Nice answer, thanks! Any other examples involving some of the APTs discovered in the last few years (Regin, Duqu, Stuxnet, etc)? – John Blatz Aug 19 '15 at 17:24

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.