14 DAY TRIAL // After in September 2011 they temporarily shut down their certificate issuance services, GlobalSign released a report with their conclusions on the events that took place after they’ve learned that ComodoHacker breached their systems.
On the positive side of things, they state that no rogue certificates were issued and no customer data was exposed as a result of the incident.
The evidence indicates that no root certificate keys and associated Hardware Security Modules (HSM), Issuing Authorities and associated HSMs, and Registration Authority (RA) services were compromised.
The certificate authority’s (CA’s) infrastructure was also left undamaged by the cybercriminal operation.
The company reports that only a peripheral web server on which the public website was hosted was compromised, but fortunately, the server was not part of the certificate issuance infrastructure.
They claim that only HTML pages, publicly available PDF documents and the key and certificates assigned to globalsign.com were exposed to the hacker, but both the key and the certificate were revoked.
Customers were impacted only between September 6 and 15 when the issuance was temporarily halted. During that period, third party security solutions providers such as Fox-IT and Cyber Security Japan were contacted for the purpose of analyzing and reinforcing the breached infrastructure.
GlobalSign continues to collaborate with authorities while they gather more evidence on ComodoHacker and the other actors involved.
“As one of the longest operating Certification Authorities, the worldwide GlobalSign team is aware of the impact to customers and partners of halting Certificate issuance for any period of time,” reads the response from the organization’s executive team.
“The executive team apologizes sincerely for the inconvenience caused when undertaking such an important decision. However the organization stands by the decision and maintain that the ultimate duty of care for GlobalSign, like all responsible CAs, is to avoid issuance of rogue Certificates.”