Researchers from the Netherlands, Switzerland and the U.S. say they have found a way to copy the digital identity and authority assigned to VeriSign's RapidSSL, security credentials to help users identify legitimate Web sites.

According to The Washington Post, using a network of 200 PlayStation 3 gaming consoles, the researchers were able to reproduce a virtual clone of the digital signature RapidSSL uses to sign SSL certificates by exploiting a hole in MD5, a cryptographic method used to sign digital certificates.

Once an attacker has taken control of a large network, users trying to visit a specific e-commerce or banking Web site could be redirected to a counterfeit version of the site without their knowledge, where passwords, credit card numbers and other sensitive information could be stolen.

The researchers, who demonstrated a proof-of-concept at the 25th annual Chaos Communication Congress, suggested that companies switch from MD5 to the more secure hash SHA-1. VeriSign took the suggestion to heart and began doubling its efforts to phase out MD5, reports The Tech Herald.

Computerworld notes that besides VeriSign, the researchers list TC TrustCenter AG, EMC Corp.'s RSA unit and Thawte Inc. as other companies that use MD5 to generate their digital certificates.