Hot on the heels of RSA suffering an attack of unknown origin and resulting in a loss of unknown data with an unknown impact, news that a certificate authority, Comodo Inc, issued nine fraudulent certificates which browser vendors and OS vendors have had to issue a patch for, highlights the fragility of the security systems that protect your data in transit across the Internet. In Comodo’s case, neither the root CA nor any of their systems were compromised, according to their own incident report. Rather, one of their customers, a registration authority, was compromised. It appears the compromise was quickly caught and Comodo started working with vendors to get a fix in place. It’s time to once again question who we trust and why we trust them.
Network Computing