In a newsgroup posting by Robin Alden, CTO of Comodo, it has been confirmed that two further SSL Registration Authority (RA) accounts have been compromised since the original attack against GlobalTrust. Alden wrote: “Two further RA accounts have since been compromised and had RA privileges withdrawn. No further mis-issued certificates have resulted from those compromises.”

It is not yet known which other RAs were compromised, or to what degree. In his latest Pastebin message, the Iranian ComodoHacker appears to claim responsibility for these other attacks:

“From listed resellers of Comodo, I owned 3 of them, not only Italian one, but I interested more in Italian brach because they had too many codes, works, domains, (globaltrust, cybertech, instantssl, etc.) so I thought they are more tied with Comodo.”

According to an earlier message from ComodoHacker, the Italian attack was carried out by exploiting an SQL injection vulnerability on InstantSSL.it. The attacker subsequently escalated his privileges and caused the fraudulent certificates to be issued. The ComodoHacker unarguably proved his involvement in this attack by publishing a private key which corresponded to the fraudulently issued certificate for addons.mozilla.org. This private key has since been removed.

Both GlobalTrust.it and InstantSSL.it were shut down after the attack, but are now back online, offering a range of SSL certificates for sale.