Verisign admitted it was hacked repeatedly last year but could not identify what data may have been stolen. It doesn’t believe the Domain Name System servers were hacked, but it cannot say for sure. Symantec bought its certificate business in 2010, and says that there was no evidence that the system was affected. Verisign came clean in an SEC filing, saying that its security team failed to advise management about the attacks until 2011, despite taking action to address the hacks.
Symantec’s VeriSign remains one of the largest providers of Secure Sockets Layer certificates in the world. Web browsers look for these certificates when connecting users to secure sites, beginning with “https”. These sites include most banking sites and certificates are also used for some email and other communications portals.
If the SSL infrastructure were compromised, an attacker could create a Google certificate or a Bank of America certificate that would be trusted by any browser in the world, according to an analyst in the MSNBC article. Symantec’s spokeperson reiterated, “there is no indication that the 2010 corporate network security breach mentioned by VeriSign Inc was related to the acquired SSL product production systems.”
Of course the company claims that they were attacked by “the most sophisticated form of attacks,” including some that are “virtually impossible to anticipate and defend against.” There’s no evidence that I am aware of to prove or refute that claim.
MadMark's Blog 