More Forged Digital Certificates Detected

(August 31, 2011)

The people responsible for a forged Google digital certificate may also have forged as many as 200 other certificates from high profile Internet entities including Mozilla and Yahoo. DigiNotar, a Dutch certificate authority, experienced a security breach in July 2011.  Updated versions of the Firefox and Chrome browsers have been released to disable or delete entries for DigiNotar.

http://www.wired.com/threatlevel/2011/08/diginotar-breach/

http://www.h-online.com/security/news/item/Updated-Chrome-and-Firefox-for-fraudulent-Google-certificate-available-1333898.html

Linux Kernel Servers Compromised

(August 31, 2011)

The Linux Kernel Organization has said that several of their servers became infected with malware that obtained root access. The malware also modified files and harvested users' passwords and transactions. The malware infected the system on or before August 12 but was not detected until August 29. Administrators believe that Linux source code remained unaffected by the malware infection. Law enforcement authorities have been notified and all site users have been made to change their passwords and SSH keys.

New Computer Worm Spreading via RDP

(August 28)

A new computer worm dubbed Morto is infecting Windows computer systems via the Remote Desktop Protocol (RDP) and exploiting weak system passwords.  To be vulnerable the target system needs to have the RDP service enabled and the Windows administrator account configured to use a weak password such as "123", "letmein" or "password".   Once infected the computer becomes part of a botnet.  The SANS Internet Storm Center has noticed a large spike in the amount of RDP scan traffic.  Microsoft has released details about the worm with a severity level rated as severe, its highest alert level.

http://www.theregister.co.uk/2011/08/28/morto_worm_spreading/

http://www.scmagazineus.com/morto-worm-spreading-via-remote-desktop-connections/article/210803/

http://www.networkworld.com/news/2011/082911-new-windows-worm-spreads-by-250194.html

http://www.microsoft.com/security/portal/Threat/Encyclopedia/Entry.aspx?Name=Worm%3aWin32%2fMorto.A

Fraudulent Google Web Certificate Discovered

(August 29)

Researchers have discovered a counterfeit web certificate for *.Google.com has been available on the Internet for a number of weeks.The forged certificate was issued on July 10 by DigiNotar, a certificate authority based in the Netherlands and could provide attackers with the encryption keys needed to impersonate Google services that use SSL such as Gmail.  The forgery was first detected by a user in Iran leading to concerns that the forged certificate is being used to intercept emails of dissidents.  Google and Mozilla have issued updates to the Chrome and Firefox browsers to block all certificates issued by DigiNotar.

http://www.theregister.co.uk/2011/08/29/fraudulent_google_ssl_certificate/

http://www.computerworld.com/s/article/9219569/Hackers_acquire_Google_certificate_could_hijack_Gmail_accounts