Iran could be behind cyber attack against Mossad, CIA

AP -- The Iranian government could be behind a mass cyber attack that hit some 300,000 Iranian internet users and the websites of intelligence agencies including Israel's Mossad and the CIA, a study released by a panel of experts suggested on Tuesday.

On Monday, the Dutch government said that attackers who hacked into a Dutch Web security firm have issued hundreds of fraudulent security certificates for intelligence agency Web sites, as well as for Internet giants like Google, Microsoft and Twitter, the Dutch.

Experts said they suspected the hacker — or hackers — operated with the cooperation of the Iranian government, perhaps in attempts to spy on dissidents.

The latest versions of browsers including Microsoft’s Internet Explorer, Google’s Chrome and Mozilla’s Firefox are now rejecting certificates issued by the firm that was hacked, DigiNotar.

However, the magnitude and possible source of the hack was further revealed on Tuesday, when a study by Fox-It showed that more than 300,000 Iranian users were compromised in the attack.

The Fox-It report indicated that the hackers left behind a Persian signature embedded in the hacking code, similar to the one found in the Comodo hack earlier this year.

Ot van Daalen, director of the Bits of Freedom internet human rights group, said that the hack put Iranian dissidents at risk, telling Radio Netherlands Worldwide that there was a "real fear that Iranian authorities used the false certificates to bug users, and one cannot rule out the possibility that they would continue to do so with more certificates."

"It's horrible to say so, but it's entirely possible that the hack risked lives in Iran," van Daalen said.

In a statement on Monday, the Dutch Justice Ministry published a list of the fraudulent certificates that greatly expands the scope of the July hacking attack that DigiNotar acknowledged only last week. The list also includes certificates that were sent to sites operated by Yahoo, Facebook, Microsoft, Skype, AOL, the Tor Project, WordPress, and by intelligence agencies like Israel’s Mossad and Britain’s MI6.

DigiNotar is one of many companies that sell the security certificates widely used to authenticate Web sites and guarantee that communications between a user’s browser and a site are secure.

In theory, a fraudulent certificate can be used to trick a user into visiting a fake version of a Web site, or used to monitor communications with the real sites without users noticing.

But in order to pass off a fake certificate, a hacker must be able to steer his target’s Internet traffic through a server that he controls. That is something only an Internet service provider, or a government that commands one, can easily do.

Technology experts cite a number of reasons to believe the attack is connected to Iran. Notably, several of the certificates contain nationalist slogans in Farsi, the language spoken by most Iranians.

“This, in combination with messages the hacker left behind on DigiNotar’s Web site, definitely suggests that Iran was involved,” said Ot van Daalen, director of Bits of Freedom, an online civil liberties group.

So far, only a handful of users in Iran is known to have been affected.

The attack on DigiNotar closely resembles one in March of the United States security firm Comodo Inc., which was also attributed to an Iranian.

Although no users in the Netherlands are known to have been victimized directly, the breach has caused a major headache for the Dutch government, which relied on DigiNotar to authenticate most of its Web sites.

In a news conference on Saturday, the Dutch justice minister, Piet Hein Donner, said the safety of Web sites — including the country’s social security agency, police and tax authorities — could no longer be guaranteed.

He advised users who wanted to be certain of secure communication with the government to use pen and paper.

The Dutch government took over management of DigiNotar, a subsidiary of Vasco Inc., which is based in Chicago, but kept the Web sites operating as it scrambled to find replacement security providers.