Article provided by EIU
A hacking attack exposes deeper flaws in the internet’s security infrastructure
From The Economist, September 9 2011
For all its vaunted decentralisation, the internet is a top-down affair when it comes to security. Users are told whom to trust by digital certificates, which allow a website to display a padlock symbol and put the "s" in the https:// prefix to web addresses. These certificates are issued to websites by several hundred companies that pride themselves on their security and reputation for probity. A list of such certificate authorities is built into web-browser software. If a site displays a certificate issued by a proper authority, the browser will load the page with no objection. It should all work fine in theory. But in practice the guardians of internet security seem badly to need guarding themselves.
On September 7th one of the world’s biggest certificate authorities, Globalsign, temporarily stopped issuing them following new claims by an assailant under the name "Comodohacker". Claiming to be acting alone, he has already broken into a Dutch issuer, DigiNotar, hijacking its system and issuing hundreds of bogus certificates for domains including Facebook, Twitter and Google, as well as for American, British, Israeli and other government agencies.
These dodgy documents could allow mischief-makers to impersonate supposedly secure websites. Many security analysts fret that the fake certificates have been used to snoop on Iranian users of Gmail, Google’s e-mail service.
The Dutch government relied on DigiNotar to authenticate many of its websites. Its interior minister, Piet Hein Donner, said that sites for the country’s social-security, police and tax authorities might be compromised. He urged citizens who wanted to be on the safe side to use pen and paper in dealings with the state.
Security pundits have long been ringing alarm bells about the possibility of such an attack--the digital equivalent of burglars breaking into a locksmith’s shop. A new report on DigiNotar is scathing about its security. Many feel this imbroglio, plus an apparently related one in March involving an Italian authority affiliated with Comodo, a big American issuer, shows that the system urgently needs an overhaul. "Comodohacker" claims also to have cracked security at three other (so far unnamed) issuers.
One proposal is to create new digital notaries that would perform regular scans of all secure servers on the internet. Rather than relying on a built-in list of certificate issuers, as at present, browsers would instead match the certificates that a site presented to those in the notaries’ repository. Google is testing a similar idea called Certificate Catalog. The company hopes to include it in its Chrome browser, which even in its existing form would have spotted the fake certificate issued for Google by DigiNotar.
Others are less sanguine. Bruce Schneier, an internet-security expert, doubts that any such fix will work. The problem, he says, is not technological--it is about incentives. Those who have stakes in the existing system, be they certificate authorities, browser-makers, or governments, have no interest in mending it. Many users are willing to forgo security for the sake of convenience, even ignoring warnings on their browsers about expired or unrecognised certificates. Mr Schneier likens discussing the relative merits of the proposed fixes to discussing what colour to paint tanks while in the middle of a battle.
The broader problem, says Seth Schoen of the Electronic Frontier Foundation, an advocacy group, is that the people most at risk from prying governments in Africa, the Middle East and Asia all too often use antiquated equipment and substandard software that is more vulnerable to hacking. Few Iranians, for example, use Chrome. It became available to web users there only in January, after America eased trade sanctions against the Islamic republic.