Security Experts:

Connect with us

Hi, what are you looking for?


Network Security

KPN Halts SSL Certificate Business to Investigate Possible Breach

A Netherlands company has stopped issuing SSL certificates due to concerns about the possible breach of a Website used to buy certificates.

A Netherlands company has stopped issuing SSL certificates due to concerns about the possible breach of a Website used to buy certificates.

Officials at telecommunications company KPN (formerly Getronics) said in a statement that though existing certificates remain valid, the company has temporarily halted the issuing of new certificates pending an investigation into the possible compromise. In a recent audit it was revealed the server of the Website may have been prepped four years ago by an attacker for use in a distributed denial of service attack (DDos).

Although there is no evidence bogus certificates were produced, the company cannot rule it out, the company said. The investigation into the situation is ongoing.

The situation at KPN is another in a series of incidents in 2011 that have brought the security of certificate authorities (CAs) into the spotlight. With a fraudulent certificate in tow, an attacker can potentially make it appear Web surfers are visiting a legitimate site even if they are actually visiting a malicious one. On Nov. 3, Microsoft and Mozilla announced they were revoking trust in certificates issued by Malaysian CA Digicert after it was discovered its certificates used weak 512-bit keys and were missing certain certificate extensions. Digicert has no relation to DigiCert Inc., based in Utah.

In March, an attacker hit a Comodo affiliate registration authority and stole the username and password for a trusted Comodo partner. As a result of the compromise, the attacker was able to create a new user account that generated nine fraudulent certificates for several popular Websites, including Google, Yahoo and Microsoft’s Hotmail.

Five months later, certificate authority DigiNotar admitted it had been hacked earlier in the year. In the ensuing fallout, browser vendors revoked hundreds of bogus SSL certificates that were issued by DigiNotar. The situation ultimately forced the company to declare bankruptcy in September.

Written By

Click to comment

Expert Insights

Related Content


Websites of German airports, administration bodies and banks were hit by DDoS attacks attributed to Russian hacker group Killnet

Network Security

NSA publishes guidance to help system administrators identify and mitigate cyber risks associated with transitioning to IPv6.

Identity & Access

Hackers rarely hack in anymore. They log in using stolen, weak, default, or otherwise compromised credentials. That’s why it’s so critical to break the...

Cybersecurity Funding

Forward Networks, a company that provides network security and reliability solutions, has raised $50 million from several investors.

Network Security

Cisco patched a high-severity SQL injection vulnerability in Unified Communications Manager (CM) and Unified Communications Manager Session Management Edition (CM SME).

Cybersecurity Funding

Network security provider Corsa Security last week announced that it has raised $10 million from Roadmap Capital. To date, the company has raised $50...

Application Security

Electric car maker Tesla is using the annual Pwn2Own hacker contest to incentivize security researchers to showcase complex exploit chains that can lead to...

Network Security

Attack surface management is nothing short of a complete methodology for providing effective cybersecurity. It doesn’t seek to protect everything, but concentrates on areas...