Asked by PC World to characterize the DigiNotar attack, Melih Abdulhayoglu, president and chief executive of Comodo, said in an e-mail, "We believe this is state-sponsored."
"It seems that they need these certificates, as we stated in March, they will not stop attacking," he added.
Evidence suggests Iran is the state behind the attacks. An analysis by Trend Micro of the rogue SSL certificates issued by the DigiNotar hackers led that security firm to conclude that the attack was "used to spy on Iranian Internet users on a large scale."
"We found that Internet users in more than 40 different networks of ISPs and universities in Iran were met with rogue SSL certificates issued by DigiNotar," it said in a company blog. "Even worse, we found evidence that some Iranians who used software designed to circumvent traffic censorship and snooping were not protected against the massive man-in-the-middle attack."
A man-in-the-middle attack is one where an attacker intercepts communication between two systems, such as between a PC and user accessing their Gmail account.
Although keeping the names of the four high-profile certificate issuing authorities close to the vest, Comodohacker did mention two others -- GlobalSign and StartCom CA -- he claimed to have breached. When asked about those claims by IDG News, GlobalSign said it was investigating the matter and StartCom said it detected the attack and foiled it before any fraudulent certificates could be issued.
As evidence that he was behind the DigiNotar attack, Comodohacker, who was silent for months before yesterday's Pastebin posting, published the password he used to gain access to DigiNotar’s administrative functions. A preliminary report released yesterday by Fox-It, the security firm hired by DigiNotar to investigate the break-in, noted that in a script used in the attack "fingerprints from the hacker are left on purpose, which were also found in the Comodo breach investigation of March 2011."
In his posting, the hacker said his attack on DigiNotar was in retaliation for Dutch and Serbian actions against Muslims 16 years ago. He also said he intended to hurt the finances of DigiNotar, which is owned by an American company, Vasco. Vasco stock was selling at $13.44 share on July 19 when DigiNotar discovered the breach. Today, it's selling at $6.62 a share. However, over that period the stock market has been in a general decline so the plummet of Vasco's stock may have less to do with the DigiNotar attack than with universal market trends.
Comodo's chief executive warned his competitors that they should protect their infrastructure. "The days of wiretapping phone lines are gone; the days of reading e-mails or Facebook or intercepting Skype communication is here," Abdulhayoglu declared. "The key to reading these communications are held by certification authorities. So that is why they have become the new target for states that have a need for intercepting communication."
Follow freelance technology writer John P. Mello Jr. and Today@PCWorld on Twitter.