Slashdot Mirror
Comodo Says Two More RAs Compromised
Trailrunner7 writes "Officials at Comodo have acknowledged that an additional two registration authorities affiliated with the company have been compromised in the wake of the high-profile attack on the company that was disclosed last week. Addressing a list of concerns about Comodo's practices raised by customers and browser vendors in the wake of the attack, Alden said that the company is now in the process of rolling out a new two-factor authentication system for its RAs. Comodo also is installing other security measures as a result of the attack."
Store the certificates in DNS, and access them with DNSSEC.
http://blog.fupps.com/2011/02/16/ssl-certificate-validation-and-dnssec/
I have deleted all the CA from Comodo. I think it must be the end of his certification authority bussines. I want more responsible of that: -Ernest Young give them the WebTrust certification. Or the auditor or the certification is useless...
Damia
I mean, few systems can avoid being compromised by a person with "experience of 1,000 hackers"
http://it.slashdot.org/story/11/03/28/2159202/Lone-Iranian-Claims-Credit-For-Comodo-Hack
So is "rolling out a new two factor authentication system" code for "our last two-factor authentication system consisted of 'something you know', your username, and 'something you know, your password; because, despite the fact that we are a fucking CA we just can't be bothered"?
Other than inertia, is there any reason to give these guys a second chance, rather than just drop them from the default trusted CAs list and let the company sell itself for scrap? Generating SSL certs is technologically trivial, anybody can do it at home with commonly available free software. Essentially, the only purpose of a CA is to be competent and trustworthy about who they generate certs for. CAs aren't really software or technology companies, they are much closer to the position of escrow services or trust companies. Generating certs is just the minor 'paperwork'. Generating only the right certs for only the right people is the job. If they can't do that, they are worse than useless.
Let's just hope they're not rolling out RSA Tokens :)
I have now removed Comodo as a trusted CA on my systems, and have advised colleagues of the three known occasions on which they have failed to act as a responsible CA. The game is up.
The Mozilla inclusion policy for maintaining CAs in the default list states that:
I hope that Mozilla now review the inclusion of Comodo's cert.
I used to get my SSL certs through Verisign or Thawte, who were quite expensive and required a truckload of paperwork to prove your identity to them when being issued a SSL certificate. This was years ago, so they may be more lax these days for all I know. I jumped to Comodo several years back because they were cheaper and had a lot less paperwork hassle. Generally I could get SSL certs more quickly through them than I could through Verisign or Thawte. I then managed enough SSL certs to get in to OpenSRS and I could issue SSL certs immediately with no paperwork whatsoever. I believe the small print in OpenSRS shifts the burden to you, not Comodo, to prove the identity of the organization requesting the SSL certificate. All my clients were local businesses and were easy enough for me to verify. Long story short, is that there are numerous ways around the identity verification schemes when obtaining SSL certificates. Perhaps with these recent SSL incidents the registration authorities and SSL issuers will start going back to the old days of putting people through the meatgrinder when trying to obtain SSL certificates. It may be inconvenient, but I think we've gotten to the point where the scales are tipped way too far in convenience's factor to the detriment of security and verification.
Well, apparently Comodo systems are so secure that they are hacker proof.
The whole CA system is fundamentally broken, your browser trusts a huge list of CAs and further those CAs have the power to delegate their authority (either through signing a cert that delegates authority or by allowing those people to request certificates with little to know further checking). The result is a huge number of people who have the power to sign certificates that your browser will treat as evidence that a web site is who they say they are. Further the CAs don't really have much interest in security beyond doing the minimum nessacery to keep themselves in the browsers root certificate lists.
When you have a large number of people and/or entities with such a power there is a significanct chance that some of them will be corrupt, open to coersion, lax about security or some combination of those attributes.
Commodo claimed that there were no further mis-issued certificates as a result of this but I'd be very wary of such a claim.
note: i'm known as plugwash most places but i screwd up registering that here somehow in the past and now can't register
SecurID wasnt compromised, RSA was. Apparently the breach had no effect on the security of the dongles, according to RSA (and I havent seen any report to the contrary).
The system of "certificate authority" on which SSL security ostensibly relies, has deteriorate to an essentially meaningless state.
This system is based primarily on trust. Trust requires at least a basic level of knowledge or understanding (this is a crucial difference between "trust" and "faith" :) ).
If you have not taken a look at your browser's "trusted certificate authority list" - now may be the time. I am a Firefox user, and I know that the list in Firefox contains numerous organizations with trustworthy names like "QuoVadis Limited", "TÜRKTRUST Elektronik Sertifika Hizmet Salaycs" and "XRamp Global Certification Authority". Do you know any of these companies? Do you personally have any reason to trust in their judgment, honesty or integrity?
For each company Firefox web site holds a document by some accounting firm (like the KPMG which has proven itself untrustworthy and unreliable even in matters of finance where they presumably have a clue) that purports to audit intentions and pracitces of said company wrt. issuance of said certificates. To put it simply that's worth as much as their audit of Lehman Brothers.
Bottom line - your browser essentially allows a random selection of highest bidders or politically connected entities to define what web sites are, in turn, to be trusted. It's pointless and there is little reason to believe that anything that say, sign or claim has any value whatsoever beyond the level of background noise.
Treat SSL the way you treat SSH - save specific certificates for sites, and watch for unexpected changes. Regardless of what the certificate or the "green location bar" say, don't trust them further than you can throw them.
They are hopeless and should be dropped from the trust lists in browsers. Watching them go out of business will be a useful remainder to the remaining ones that they should work a little not just take the money.
The UI let's me delete "Built-in tokens", but if I then leave and re-enter the list, there they are again!
I looked in my certificate bag in FF, and I got all kinds of Comodos there. What does that mean exactly to me, my personal data, and my small biz? thx!!!
I think therefore I can't be ~TTNH
http://en.wikipedia.org/wiki/SecurID#March_2011_system_compromise
In a March 21 email to customers, RSA essentially admitted that the information stolen from their internal network would allow an attacker to compromise a SecurID-protected system without having physical possession of the token:
"7. Have my SecurID token records been taken?
For the security of our customers, we are not releasing any additional information about what was taken. It is more important to understand all the critical components of the RSA SecurID solution.
To compromise any RSA SecurID deployment, the attacker needs to possess multiple pieces of information about the token, the customer, the individual users and their PINs. Some of this information is never held by RSA and is controlled only by the customer. In order to mount a successful attack, someone would need to have possession of all this information."
Barring a fatal weakness in the cryptographic implementation of the tokencode generation algorithm (which is unlikely, since it involves the simple and direct application of the extensively scrutinized AES-128 block cipher), the only circumstance under which an attacker could mount a successful attack having only information about (but not physical possession of) the token, is if the token seed records had been leaked. This is very strong evidence that the token seed records have in fact been stolen.
Poster is known malware writer and troll who is advocating slowing your machine to a crawl with a 15Mb HOSTS file which will ONLY stop static ad banners.
Much better solution is to simply blacklist the Comodo certs if you aren't on Windows, and if you are on Windows you should have already been given the cert blacklist update, checkable by going MMC...add snap in...certifications and looking under untrusted certificates. Funnily enough if one is using the Comodo browser Comodo Dragon this is also not a problem, as the extremely short TTL they use on certs had these certs dead just a couple of hours after the hack and before the attacker could use them.
ACs don't waste your time replying, your posts are never seen by me.
There is nothing wrong with the fact that many people can sign certificates. What is wrong is that there's no easy way to mark that up and control it and there are no ways to have multiple independent signing bodies. E.g. for financial transactions I would only want to trust a bank signed by an extended verification certificate from at least two registries + the government regulatory body of the country where the bank is registered. When I'm browsing slashdot I would probably be happy just to have a self signed certificate and get warned if it changed. What is needed is essentially a web of trust like PGP with a pre-loaded set of trusted bodies which varies according to the configuration of the user. There is no reason for a Chinese user to trust an American bank or the other way round.
With sufficiently clever defaults this could add quite a bit of security without any interaction or thinking from the user. They probably have to learn more about the colours of the address bar or something however.
=~ s,(.*),<sarcasm>$1</sarcasm>,g if any_point_you_wish();
Hope it's the RAs from my freshman and junior years in college. Those guys were both dicks.
--
"Outlook not so good." That magic 8-ball knows everything! I'll ask about Exchange Server next.
Unfortunately, OCSP has been defeated with the character 3.
So they're rolling out a *new* two factor authentication system? That implies that there was an old one.... Was it RSA? Could the two events be linked?
However much you decide to trust the CAs your browser comes with, you can add some checks to the SSL validation process.
1. Check that others are seeing the same cert that you are.
2. Check that the cert for a site has been consistently what you're getting now.
Tools for this: Perspectives and Certificate Patrol.
Example details from Perspectives check of an HTTPS site
Brief blog entry on Certificate Patrol
Errrr... did you forget your medication or something?
Therefore, by the (faulty) logic you're using, you're just a cow with a keyboard - osu-neko (2604)
I don't need a degree in psychology to see you have issues.
You post (and respond to my post with) an incoherent and rambling post that looks like a "stream of consciousness" posting from a consciousness that isn't very coherent. That's a warning sign for trouble if ever I saw one. Especially the use of bold and capitals.
If you want people to actually read your post and take it serious, stop using weird interpunction, bold, and capitalization. Try to write a few coherent sentences with a start, an end, and an actual point.
For instance, you could have replied to me like this: "Hey, you're not a licensed psychiatrist so leave your comments somewhere else, 'kay?". That's short, concise and to the point. Your post... is not.
Therefore, by the (faulty) logic you're using, you're just a cow with a keyboard - osu-neko (2604)
Get some help Petey and once again correlation != causation, and you have to show your work because I'm not the one making outrageous claims If someone claims they can stretch their dick into a giant slingshot and shoot themselves to Scotland it is not the readers job to prove them wrong but the posters job to back that up with real proof, not an anecdote that says "well my cousin Joey saw me do it last Halloween!".
I have also shown repeatedly that at the absolute reported minimum number of new pieces of malweare and infections, which you are free to pick whichever reputable website you like Securina, MSFT's malware reports, AVG, which ever, that at an absolute minimum we are talking about 1.2 million sites PER DAY with that number changing by 15,000+ PER HOUR which means even if you typed at 1 IP address PER SECOND, and never slept, and had a perfect list (which doesn't exist) you would be 14 days behind by the very first day with that number growing linearly every single day, making Petey farther and farther behind.
But if you weren't completely batshit insane Petey I wouldn't have to explain this, because this is why everyone makes fun of you. It is so obvious it is like someone arguing gravity is actually invisible pants gnomes trying to steal your underwear. It is the classic "default allow" which has NEVER EVER worked. Because if a piece of malware isn't in magical HOPES file Petey you are royally fucked, and yet again I have shown that it is simply a roll of the dice whether you get creamed or not, simply because you will always be behind. So it is all on you Petey and your magical HOPES woobie now. You made the extravagant claims, back them up with the math. If you can't? Well then you are full of shit, case closed. Notice how ALL YOU CAN DO PETEY is throw insults and trollbomb? Why is that? I'll tell you why, because math doesn't lie and you just can't show the math You just can't, it would be like trying to mathematically prove you are not an idiot. It just can't be done.
ACs don't waste your time replying, your posts are never seen by me.