Net Security Company VeriSign Suffered Hacks

Incidents took place in 2010, went unreported

Wednesday, February 08, 2012
Net Security Company VeriSign Suffered HacksThe Web infrastructure company VeriSign recently revealed that, in 2010, it suffered a number of security breaches as a result of hacking attacks by cybercriminals who were able to steal undisclosed amounts of data.

VeriSign has a domain name routing system that protects a large number of Web addresses ending in .com, .net or .gov, and recently revealed that these hacking attacks took place in a quarterly filing with the U.S. Securities and Exchange Commission, according to a report from Reuters. The company processes as many as 50 billion queries per day, and stolen data may allow the hackers to create fake sites or intercept emails that could be particularly sensitive, such as those traded by government employees or corporate executives.

The reason for the delay in reporting, according to the quarterly filing, is that while security staff was aware of the attacks soon after they happened, it did not let VeriSign executives know until September 2011, the report said. The filing did not mention any other action being taken by the company in an investigative capacity.

However, VeriSign executives believe that the attacks it suffered did not breach its domain system network, but is also not saying that the attacks categorically did not affect them, the report said. But even if those systems were safe from the attacks, there are other areas of concern. For example, the company controls a large amount of sensitive information about its many customers, and the services it runs to give out domain names would almost certainly have been targeted.

"This breach, along with the [one suffered by Web authentication company RSA last year], puts the authentication mechanisms that are currently being used by businesses at risk," Melissa Hathaway, a former intelligence official who led U.S. President Barack Obama's cybersecurity policy review, told the news agency. "There appears to be a structured process of hunting those who provide authentication services."

VeriSign was, until August 2010, a major supplier of Secure Socket Layer certificates - bits of information sought automatically by Web browser programs when connecting to secure "https" sites, the report said. Experts worry that if those systems were corrupted, hackers could pose their bogus sites as real ones without the browser being able to recognize the difference between legitimate and fraudulent sites.

Ondrej Krehel, chief information security officer for Identity Theft 911, has a blog about hackers and information security.

© CyberScout, LLC. All Rights Reserved.
If you need identity theft assistance, call your provider organization to be put in touch with the CyberScout Resolution Center. More information for individual consumers.