Federal authorities concerned about attacks on certification providers
The Reporting and Analysis Center for Information Assurance Melani is concerned about attacks on certification service providers that offer IT tools for e-banking, for example. Such cyberattacks could have serious consequences.
As Melani writes in a newsletter on Tuesday, two attacks last year on the certification providers Comodo and Digi Notar, which are recognized as trustworthy, have caused great concern among experts. The attackers succeeded in issuing false SSL/TLS (Security Sockets Layer/Transport Layer Security) server certificates. Such certificates are used in e-banking, among other things, to establish a secure connection between the customer's computer and the bank's server.
If the perpetrators succeed in redirecting an e-banking user to a server controlled by them without being noticed, they can send the victim such a certificate. The victim's browser accepts the certificate as genuine. The perpetrators can then control the transmitted data and decrypt it.
Such attacks could also be used to enforce state surveillance on the internet. Certificates in Iran were probably also used in this way to monitor the communication of opposition figures on Facebook and Twitter, the Melani experts write.
As there are only a few solutions for preventing such attacks, the experts advocate making the attacks as difficult and complex as possible. To this end, they propose a series of technically complex strategies. (SDA)
