3 ms·
The timeline looks awesome: June 4th, 2016 – Emailed security@comodo.com and reached out on Twitter to @Comodo_SSL. ... July 25th, 2016 – Robin from Como
by 0xmohit 10y ago
The timeline looks awesome:
June 4th, 2016 – Emailed security@comodo.com and reached out on Twitter to @Comodo_SSL.
...
July 25th, 2016 – Robin from Comodo confirms a fix has be put in place.
50+ days! Funny that the entity in question is the biggest CA.
That said, one should never click on links and buttons in emails. It's more comforting to be able to copy a link instead.
- agrajag 10y agoThe part that makes this a real exploit is that the administrator of the target domain would only have to open the e-mail with a client that displays images in order to be exploited.
- cbr 10y agoAnd that's true even if the client, like gmail, proxies the images: https://gmail.googleblog.com/2013/12/images-now-showing.html https://gmail.googleblog.com/2013/12/images-now-showing.html
- mikeash 10y agoI wouldn't even copy links. Too many unicode shenanigans and other URL display problems out there. I made an exception for sites I was going to immediately use 1Password's autofill with, trusting its URL validation to save me from fakes. I hadn't considered that merely loading a malicious URL could cause trouble. I think I'll have to reconsider my policy on that.
- tedmiston 10y agoI don't even open links from emails anymore, just login to the company's dashboard and find it instead. :/
- wahern 10y agoThat's how I handle phone calls, too. For example, if I get a call from a bank then as soon as they begin asking for personal information I inform them that I'll have to call them back. I do this even if I was _expecting_ a call from them. I've never had a representative balk at this, but many times they'll give me a number and extension to call. But that would defeat the whole purpose. I tell them that I need a published number that I can independently confirm. Usually they just say it's fine to go ahead and use the number on their website. None of this is foolproof. My confirmation of a phone number is usually rather cursory--a quick Google search comparing results with what I find on the company's website. But infosec crimes are becoming increasingly common and I'd rather not be the low-hanging fruit.
- Buge 10y agoI heard of an attack that causes even calling back to fail. Because with some phone providers, when you hang up, it doesn't actually hang up. So you dial the new number thinking you are making a new call, but you are actually on the same call and they just play ringing sound effects for you, and have a new person "answer".
- tedmiston 10y agoCan you provide more details? I haven't heard of this one and hope to educate myself better if it really is possible.
- toast0 10y agoThis is a potential concern with traditional analog POTS. There isn't an explicit signal to end the call on the analog side. Some switches take longer than others to detect when your phone goes on-hook and end the call. If yours takes a long time, then on the plus side, you can hang up one phone, walk to the other side of your house and pick up the other to continue a call, but on the minus side, an attacker could play a dial tone at you and trick you. This can happen with connections between switches too, potentially; but modern (like 1980s modern) out of band signaling techniques on trunks generally prevents this type of thing.
- 0xmohit 10y agoShortened URLs or extremely long ones are scary.
- deleted 10y ago[deleted]
- Artemis2 10y agoMicrosoft took almost a year to fix a bug I reported. A year after my initial disclosure, they finally issued an emergency patch for Exchange and gave me a bounty.