Iranian hackers obtain fraudulent HTTPS certificates: How close to a Web security meltdown did we get? | Electronic Frontier Foundation
https://www.eff.org/deeplinks/2011/03/iranian-hackers-obtain-fraudulent-https
improperly issued certs, which were for extremely high-value domains including google.com, login.yahoo.com and addons.mozilla.org (this last domain could be used to trojan any system that was installing a new Firefox extension, though updates to previously installed extensions have a second layer of protection from XPI signatures). One cert was for “global trustee” — not a domain name. That was probably a malicious CA certificate that could be used to flawlessly impersonate any domain on the Web.
Comodo also said that the attack came primarily from Iranian IP addresses, and that one of the fraudulent login.yahoo.com certs was briefly deployed on a webserver in Iran.1
