Interview with ComodoHacker

I had an e-mail exchange with the ComodoHacker. The original was one e-mail request, followed by an e-mail response. I've interleaved the two, but otherwise I haven't edited the questions/answers. Original statements from him are posts at http://pastebin.com/u/ComodoHacker. Note that I've verified the private key matches the public key, so this is the hacker (beyond a reasonable doubt).

---

Do you still have the original certificates (with the private keys)? I think that's the one thing that would convince the stupids, although what you've posted so far convinces me.

a) I already posted mozilla certificate: http://pastebin.com/X8znzPWH

Editor's note: this contains the "private" key, which only the hacker could have known, or somebody else with private access to Comodo's servers. I've verified it.


Are you a college student? Do you study in Iran or abroad? Have you traveled abroad? Do you study computers and cryptography as your primary subject? Or part time?

b) Yes, I'm student. I'm in Iran and I never traveled abroad. I study software engineering, but my main interest is cryptography and most of my time (around 15 hours a day) spent on cryptography and cryptanalysis.

Are you connected with your government? Or with some other organization like
the Basij? In much the same way that you might believe everyone in America works
for the CIA, we make the assumption that every hacker in Iran was trained by your
government.

c) I don't have any relation with Basij or gov. I don't say that all hackers are connected to CIA, I just say to people who I really think they are, see: http://cryptome.org/0003/tor-spy.htm

Where did you learn about cryptography and hacking. Are there books in Persian? English books? Or are you self-taught, learning from the Internet?

d) I'm self taught, books in Persian and English, but mostly papers in internet, short papers from experts like Bruce Schneier, RSA people (Ron, Adi and Leonard) and specially David Wagner. I learned programming in Qbasic when I was 9, I started learning cryptography when I was 13

I also started hacking too early, I think I was 12-13, I started in age of IIS 4 exploits, like jill.exe, jack.exe, IIS Unicode exploits, stuff like:
HTTP request to IIS with:
/scripts/..%5c..%5c..%5c..%5cwinnt/system32/cmd.exe

to execute cmd

Then I learned web application hacks, SQL injections, remote file include, local file include, etc. etc. etc.

I'm also expert in windows binary analysis, like malware analysis, discovering vulnerabilities in binaries, exploiting vulnerabilities, heap overflows, stack overflows, double free, vtable overwrite, etc.

I discover vulnerabilities in softwares or re-write stable proof of concept code for published exploits.

What are your politics? Obviously, you oppose the green-movement. In America,
all we saw was the protests from the green-movement point of view. Our press
never reported the opposite point of view.

e) Green movement is nothing in Iran, just some young gangs with stones and woods in hand attacks people and stores and break glasses and burns garbages some often, if they had any ideology or anything to talk about, they were already said it. They just makes problem for normal people, their heads are connected to western gov. and intelligence services, so absolutely I hate them. They are my target, I already decrypted most of protocols they use to encrypt their data (thing that already all try to do), I won't let anyone inside Iran to disturb Iranian people, I say to them again, you have no privacy in internet, be careful.

How did the hack start? How did you break into that first machine? SQL injection? Guess a password? How did you get "trustdll.dll"?

f) SQL injection, then privilage escalation, got SYSTEM shell, remote desktop, investigation and I discovered trustdll.dll :)

Editor's note: "SQL injection" is the most common attack on the Internet today. In his pastebin posts, the hacker describes what he did with the 'remote desktop' and decompiling 'trustdll.dll'