incident · 1300147200000

Comodo SSL Certificate Authority Breach

An attacker compromised a Comodo Registration Authority and fraudulently issued nine SSL certificates for high-profile domains including Google, Yahoo, Skype, and Mozilla.

What happened

On March 15, 2011, an attacker compromised an Italian Registration Authority (RA) partner of the Comodo CA. Using the RA's account, the attacker caused nine fraudulent certificates to be issued for domains including addons.mozilla.org, login.live.com, mail.google.com, www.google.com, login.yahoo.com, and login.skype.com. The certificates were issued from the UTN-UserFirst-Hardware root.

Technical mechanism

The attacker compromised the RA's server and extracted hard-coded credentials (username and password) used to communicate with Comodo's API. They then used these credentials to submit unauthorized certificate signing requests.

Why it matters

The breach demonstrated fundamental vulnerabilities in the Web PKI trust model, showing how compromising a single subordinate Registration Authority could undermine the security of major internet services.

Impact

While the certificates were quickly revoked, the incident forced major browser vendors (Mozilla, Microsoft, Google) to release emergency updates to hard-code blacklists of the fraudulent certificates.

Response

Comodo detected the anomalous activity, revoked the certificates, and suspended the RA's account. Browser vendors issued out-of-band updates to block the specific serial numbers.

Defensive lessons

  • CAs must strictly audit and secure their Registration Authority partners.
  • Issuing certificates directly from root CAs increases risk; intermediate CAs should be used.
  • The PKI ecosystem requires faster, more reliable revocation checking mechanisms than CRLs and OCSP alone.

Evidence register

  1. Mozilla Security Blog — Comodo Certificate Issue – Follow Up (verified)
  2. Wired — Independent Iranian Hacker Claims Responsibility for Comodo Hack (verified)