SEC filing: VeriSign security breach in 2010 was limited, execs say

Attackers successfully penetrated the network defenses of network infrastructure vendor VeriSign Inc. several times in 2010, potentially obtaining data from a “small portion” of the company's computers and servers.

We have investigated and don't believe these attacks breached the servers that support our Domain Name System (DNS) network

VeriSign

The company disclosed the info security breach in an October 2011 Securities and Exchange Commission filing and said it believes the scope of the breach was limited.

“In 2010, the corporate faced several successful attacks against its corporate network during which access was gained to information on a small part of our computers and servers. Information stored at the compromised corporate systems was exfiltrated,” VeriSign said within the SEC filing. “We have investigated and don't believe these attacks breached the servers that support our Domain Name System (DNS) network.”

If attackers gained access to servers supporting the DNS network, they can, for starters, potentially redirect Internet traffic to malicious domains or intercept email messages.

A VeriSign spokesperson didn't reply to a request for additional info concerning the breach. The VeriSign security breach disclosure was reported today by Reuters. Public companies are required under SEC rules to reveal to shareholders how the stock may be negatively affected. VeriSign explained the 2010 breach of its systems as a part of that disclosure process. It followed new guidelines issued by the SEC clarifying breach disclosure.

VeriSign said it's blind to any stolen data getting used in subsequent attacks. Attackers have been targeting certificate authorities (CAs) to aim to create fraudulent digital certificates. On the time of the breach, VeriSign still had its SSL and authentication business. VeriSign sold its authentication unit to Symantec Corp. in August 2010.  A Symantec spokesperson told Reuters that there's no indication that the breach was involving the purchase.

The company said it deployed additional security controls to thwart additional attacks. VeriSign said the attacks weren't reported to the company's management until September 2011. Ken Silva, who was VeriSign's chief technology officer for 3 years until November 2010, told Reuters that he didn't find out about the intrusion. The corporate has implemented new reporting procedures to escalate breach disclosure during the organization. 

While the importance of the VeriSign intrusion remains unclear, it is a reflection of what's happening within the entire industry, said Anup K. Ghosh, a noted security expert and founder and chief scientist at secure browser maker Invincea. The safety industry, Ghosh said, is failing at architecting systems and technologies which could prevent breaches.

“They clearly have intellectual property and certificates that will be of interest to nation state types and other cybercriminals,” Ghosh said of VeriSign. “There are nation state adversaries like China and Eastern Europe going after corporate data, hacktivists and cybercriminals attacking to make cash; corporations are under threat from all three of those actors and our security systems are currently failing.”

Dig Deeper

• People that read this also read...