A message from Comodo Hacker

> At first I decided to hack RSA algorithm, I did too much investigation on SSL protocol, tried to find an algorithm for factoring integer, analyzed existing algorithms, for now I was not able to do so, at least not yet, but I know it's not impossible and I'll prove it

Huh. He kind of lost all credibility at that point. Breaking RSA isn't something you just decide to do. I'll wait for the day when he announces he's broken it.

mukyu• 15 years ago

I highly doubt that he will be able to do so either.

However, that does not reflect on whether or not he is the one that is behind the attack on Comodo, which has no real indications of being difficult.

Comodo claims that it must have been an organized, planned out attack because they knew which domains to get certificates for. That does not explain why 3 were generated for one domain and one for 'global trustee'. Nor does it take a genius to figure out a set of domains you would want certificates for depending on what you are planning to do (in this case, it seems like attacking large webmail providers).

daeken• 15 years ago

Hasn't everyone woken up some day and said "hey, I'm gonna break RSA today"? I guess that only happens when you have the experience of 1000 hackers...

smhinsey• 15 years ago

You'd think someone with the experience of 1,000 project managers would at least have said "this week." Just for some "uh oh" room...

tptacek• 15 years ago

Or the polynomials of 1,000 numeric field sieves.

lucisferre• 15 years ago

pfft call me when it's over 9000.

ericmsimons• 15 years ago

LOL. Does this guy think he's really going to scare us with lines that could've come from a Michael Bay movie??

Getahobby• 15 years ago

The math in these algorithms is not the vulnerable part of the process. It is almost always the implementation or the implementers that are exploited.

ake111• 15 years ago

I came here to post exactly that.

After reading him state how astonishing his skills are and how he'll tackle the integer factorization problem, I thought to myself, "he must be a 20 years old university student." Then he states his age.

pnathan• 15 years ago

Yes, the posturing did not lend credibility to his statements. Besides that, it seems vaguely plausible.

sebkomianos2• 15 years ago

> I'll wait for the day when he announces he's broken it.

And so will a massive part of the Computer Science/Mathematics/Physics community. Answering the P vs NP question is kind of a big deal. :D

enth2• 15 years ago

No. Integer factorization is not NP-hard (so not NP-complete). (This isn't proven, but it's generally thought to be the case.) So, while doing a polynomial-time integer factorization would be hugely significant (and make all asymmetric encryption in the world useless), it would not prove P=NP.

gabbo• 15 years ago

Am I the only one to expect the guy who compromised a CA and generated a number of very high-value certs to use one of those certs to sign his message?

mcorrientes• 15 years ago

He sounds like a douchebag because he thinks, he is awesome after hacking a CA.

The most stuff is just lame, but I still appreciate the way how he infiltrated the system.

nikcub• 15 years ago

I crossed paths with the guys behind globaltrust.it years ago. I ended up auditing a code project they had written for a co. in the financial services industry that required good security, audit trails, client authentication etc.

After the third remote exploit that I found, my recommendation was that they throw it out and start again, it was a huge jumble of PHP. This hurt their feelings, and a 6 month long argument ensued where they defended their competency.

When I heard 'Italian certificate provider' last week, I thought it could be them, because they went on to launch a certificate project. I am more surprised that Comodo didn't do any due diligence on their resellers. All they had to do was to email my client to ask how their project went, and they would have found out about the clusterfuck.

phlux• 15 years ago

I LOVE the fact that I live in a world that I get to read some hackers manifesto online:

My Rules as I rule to internet, you should know it already...

Although, I do have to agree with his points about Echelon.

EDIT: His command of the English language is irrelevant -- I stand by my comment above, which is the fact that we are even reading stuff like this makes the 16-year-old-cyberpunk-playing self from the '80s quite happy.

thebooktocome• 15 years ago

That's some serious Miyamoto Musashi rhetoric there. The guy's either a grade A rationalist or a massive douchebag. I put odds at 5/95.

kragen3• 15 years ago

Can you elaborate on the "grade A rationalist" remark? Does attempting to compensate for one's cognitive biases generally blind one to how one sounds to others?

clueless• 15 years ago

I think I kind of know, but for the uninitiated, can someone tell us what the potential practical consequences of this hack could have been?

wmf• 15 years ago

If you combined these evil SSL certs with the right BGP hijack, you could read a lot of people's email and such. And since reading mail lets you reset passwords on everything else, he could have basically owned millions of people.

kragen3• 15 years ago

BGP, or DNS, or your DSL modem or cable modem, or an open access point, or the router in an internet cafe, or...

Volscio2• 15 years ago

I thought the most interesting part about this was that he claimed to be a 21yo Iranian who took sole credit, while having a problem with the lack of controversy surrounding the Stuxnet US/Israel project.

jrockway• 15 years ago

So it takes the "skill of 1000 programmers" to write a program to send POST requests to an HTTP API? He must have been writing his client in Java...

Confusion• 15 years ago

I wonder whether that hyperbole of '1000 ...' is due to mistranslating some Iranian idiom. Not that it would make the assertion any better.

mak120• 15 years ago

I come off with the feeling it is actually composed by an Iranian (possibly a team but could be an individual) who is clearly motivated to make "politically correct" (from the POV of the Iranian govt.) speeches. He goes to great lengths to praise his government, ambassador and president while denouncing all dissidents, separatists, Israel and the US. I cannot help feeling he/they have some connection with the government. Possibly the whole teenage cyberpunk rhetoric was deliberate (see repeated "hard for you easy for me" and "I was so fast" and the absurd "I will factor large integers") and little more than a poorly executed smoke screen to divert attention.

dancavallaro11• 15 years ago

Oooh, my favorite part is on line 136, when he claims "RSA 2048 was not able to resist in front of me". That's a pretty, um, "interesting" characterization of the level of sophistication of his attack.

gbrindisi• 15 years ago

Well, it's finally arrived the time to rethink the whole CA system.

A message from Comodo Hacker

Related Stories