Poisoned Pipeline / Incidents / AS315
DigiNotar CA breach produced a wildcard google.com certificate used in Iran
Fox-IT's Operation Black Tulip forensic report (December 2011) established
that attackers held access to DigiNotar's certificate-issuing
infrastructure for over a month, issuing 531 fraudulent certificates for
domains including google.com, skype.com, and WordPress. A wildcard
certificate for *.google.com signed by DigiNotar's intermediate was used
in the wild against users in Iran to intercept Gmail sessions. Google
detected the interception on 29 August 2011 because Chrome's built-in
pinning for Google properties rejected the fraudulent certificate and
reported it. The consequences were total: browser vendors removed every
DigiNotar root from their trust stores within days, and the company went
bankrupt the following September.
Mapped techniques
- T0218 Compromise TLS trust identity
supply-chain DigiNotar issuance infrastructure
A wildcard *.google.com certificate from a trusted CA turned
interception of Gmail sessions in Iran into a connection every
client accepted. This is the reference case for the technique.