(WEB HOST INDUSTRY REVIEW) -- Open-source organization Mozilla (www.mozilla.org) regrets keeping mum about stolen SSL certificates last week, according to a report Friday by Computerworld. Hackers stole certificates from some of the Internet's largest sites, including Google, Skype, Microsoft, Yahoo and its own add-on website.
Late last year, a database of 44,000 inactive Mozilla usernames and passwords was publicly disclosed by Mozilla.
According to the report, on March 15 attackers used a valid username and password to acquire nine SSL certificates from a Comodo certificate reseller.
The certificates were for Microsoft's Hotmail, Google's GMail, Skype, Yahoo Mail and Mozilla's Firefox add-on site.
Comodo came out with the news of the breach on March 23, but Mozilla was informed sometime between March 15 and March 23, according to the report. None of the browsers went public with the hack until March 22.
Computerworld says Google patched Chrome on March 17, but Mozilla and Microsoft issued updates to Firefox and Windows on March 22 and March 23, respectively.
"In hindsight, while it was made in good faith, this was the wrong decision. We should have informed Web users more quickly about the threat and the potential mitigations as well as their side-effects," Mozilla said in the report.
It was suspected that the Iranian government was involved in the attack and theft, and "speculated that the certificates were stolen to set up fake sites where authorities could identify activists and monitor their email and other digital communications," according to the report.
"By keeping this quiet for eight days, Comodo and others put lives at risk," Jacob Appelbaum, researcher at the University of Washington's Security and Privacy Research Lab said in a statement. "
View the Original article
