GlobalSign discovers "isolated" web server compromise

Share this article:
Portsmouth, N.H.-based certificate authority (CA) GlobalSign has discovered that the web server hosting its site was compromised by hackers, the company announced late Friday.

“The breached web server has always been isolated from all other infrastructure and is used only to serve the www.globalsign.com website,” GlobalSign said in a news release. “At present there is no further evidence of breach other than the isolated www web server.”

The company said it is closely monitoring all activity to its services in light of what it deems an “industry-wide” attack against CAs.

Last week, GlobalSign temporarily suspended its issuing of SSL credentials due to claims from a hacker linked to recent attacks on CAs Comodo and DigiNotar. The so-called Comodohacker claimed responsibility for the recent attack on DigiNotar and said he has access to four other CAs, including GlobalSign.

GlobalSign, however, said last week that its CA root has never been connected to a network.

“Any claim of the Comodohacker to holding a private key does not refer to the GlobalSign offline root CA,” the company said.

GlobalSign began bringing its system components back online Monday. Information gleaned from its investigation is being shared with law enforcement and other CAs.

Share this article:
You must be a registered member of SC Magazine to post a comment.

Sign up to our newsletters

More in News

Android bug allowing SOP bypass a 'privacy disaster,' researcher warns

Android bug allowing SOP bypass a 'privacy disaster,' ...

Google reportedly addressed the issue, but many users likely await the fix from providers or OEMs.

Congressman asks Issa for hearing on CHS breach

The top Democrat on the House Oversight and Government Reform Committee asked for a hearing to investigate the CHS breach.

Google reveals 150 percent jump in gov't requests for user data

Google indicated in its most recent transparency report that it also saw a 15 percent jump in government requests for user data since the end of last year.