8 ms·

Comodo has had their signing keys compromised multiple times. I can probably dig up the old ZeroForce (ZF0) chat logs that show them poking around their forum

Comodo has had their signing keys compromised multiple times. I can probably dig up the old ZeroForce (ZF0) chat logs that show them poking around their forum servers that had copies of the signing certs. I am not even kidding. They had their signing certs sitting on their phpBB forum. That all started from one of their employees taunting some kids on irc. Symantec has signed and provided signing certs for multiple government agencies and proxy vendors, allowing them to sign for anything. That is part of the reason Google is distrusting them. There are many more, but a majority of certs in use today are from one of those two companies. They also have numerous re-sellers with signing certs, so the names won't always be Symantec or Comodo, hence one more need for intermediate certs. TLS today just means the average Joe won't be able to see the specific bits you are transferring. Sorry Joe.

tialaramex 8y ago
Whilst pwning Comodo's web server is presumably fun, the signing _keys_ don't live in a Linux box running phpBB or whatever nonsense that was, they're in a dedicated HSM. The certificates on the other hand are public documents, everybody has a copy of those. Symantec certainly did sell certificates to the US government, and to companies that make breakfast cereal, and indeed to at least one bona fide children's party clown. But those didn't allow them to "sign for anything". I was part of the distrust discussions you're talking about so let's see how close to the facts you were. Here are the real issues closest to what you've described: Issue L: Symantec signed the US government's "Federal Bridge" PKI, which is a PKI for the use of the Federal Government, a vast sprawling mess. Issue P: Symantec issued a subCA to UniCredit (an Italian bank) which was operated incorrectly and without an audit until October 2016 Issue T: The Korean firm "CrossCert" and three other Symantec partner companies were able to issue certificates as Registration Authorities, although Symantec was not effectively overseeing this activity. Non-compliant certificates were issued, mostly for Korean firms, and Symantec says CrossCert did not have any paperwork for these certificates, which Symantec should have known about back when the certs were issued. Issue V: Symantec's "GeoRoot" programme provided subCAs under technical control to five companies to issue their own trusted certificates within certain constraints. These five were: Aetna, Apple, Google, Intel, and Unicredit (but see P above) and the audit paperwork for these subCAs was always reprehensible garbage, an unnamed root program (probably Microsoft, given that Apple and Google are on the list) was pressuring Symantec to fix this, but they had not done so before Symantec got themselves distrusted. Issue Y: The "VeriSign Universal Root Certification Authority" CA has a couple of subCAs that are not themselves constrained to prevent issuance in the Web PKI but are also not sufficiently audited or subject to oversight. Symantec swore these subCAs aren't actually used in the Web PKI, but without a technical constraint that's hard to enforce. Back when Symantec was operating a CA, the two companies together (all of Symantec, including Versign and other brands, plus Comodo) had than 40% of "market share" in the top 10K web sites, and far less in the deeper corners of the web. Most certs are from Let's Encrypt and that's still true today. Because of how modern TLS works, bad guys would need either to use a large quantum computer for each individual session they want to break (problem: those don't exist) or they'd need not only a publicly trusted certificate, but also a live active attack on the session as it happens, which would of course be detectable.
- LinuxBender 8y ago
  Comodo most certainly had copies of everything on their forum servers. They had to be revoked. Yes, some time later they started using HSM's. Too little, too late. They lost a lot of trust after those incidents.
  - tialaramex 8y ago
    The problem with the story "they had to be revoked" is that er, they weren't revoked. Comodo's roots from that era are still in use today. That's because though you've said so twice now, those keys weren't "on their forum servers" and remained in Comodo's hands. I think you're conflating two incidents, one from 2008 when ZF0 broke into a poorly secured web forum on Comodo's systems and one in 2011 where "ComodoHacker" gained access to Comodo's issuance system because they used a single factor password login system, and was able to create a bunch of certificates for themselves using the account credentials they had. You might even be further conflating problems at DigiNotar, which "ComodoHacker" also claimed responsibility for, where Iran was using certs DigiNotar had no record of to MITM its citizens. DigiNotar is gone, the company is defunct, that entire hierarchy was distrusted seven years ago.

tialaramex 8y ago

Whilst pwning Comodo's web server is presumably fun, the signing _keys_ don't live in a Linux box running phpBB or whatever nonsense that was, they're in a dedicated HSM. The certificates on the other hand are public documents, everybody has a copy of those. Symantec certainly did sell certificates to the US government, and to companies that make breakfast cereal, and indeed to at least one bona fide children's party clown. But those didn't allow them to "sign for anything". I was part of the distrust discussions you're talking about so let's see how close to the facts you were. Here are the real issues closest to what you've described: Issue L: Symantec signed the US government's "Federal Bridge" PKI, which is a PKI for the use of the Federal Government, a vast sprawling mess. Issue P: Symantec issued a subCA to UniCredit (an Italian bank) which was operated incorrectly and without an audit until October 2016 Issue T: The Korean firm "CrossCert" and three other Symantec partner companies were able to issue certificates as Registration Authorities, although Symantec was not effectively overseeing this activity. Non-compliant certificates were issued, mostly for Korean firms, and Symantec says CrossCert did not have any paperwork for these certificates, which Symantec should have known about back when the certs were issued. Issue V: Symantec's "GeoRoot" programme provided subCAs under technical control to five companies to issue their own trusted certificates within certain constraints. These five were: Aetna, Apple, Google, Intel, and Unicredit (but see P above) and the audit paperwork for these subCAs was always reprehensible garbage, an unnamed root program (probably Microsoft, given that Apple and Google are on the list) was pressuring Symantec to fix this, but they had not done so before Symantec got themselves distrusted. Issue Y: The "VeriSign Universal Root Certification Authority" CA has a couple of subCAs that are not themselves constrained to prevent issuance in the Web PKI but are also not sufficiently audited or subject to oversight. Symantec swore these subCAs aren't actually used in the Web PKI, but without a technical constraint that's hard to enforce. Back when Symantec was operating a CA, the two companies together (all of Symantec, including Versign and other brands, plus Comodo) had than 40% of "market share" in the top 10K web sites, and far less in the deeper corners of the web. Most certs are from Let's Encrypt and that's still true today. Because of how modern TLS works, bad guys would need either to use a large quantum computer for each individual session they want to break (problem: those don't exist) or they'd need not only a publicly trusted certificate, but also a live active attack on the session as it happens, which would of course be detectable.

LinuxBender 8y ago
Comodo most certainly had copies of everything on their forum servers. They had to be revoked. Yes, some time later they started using HSM's. Too little, too late. They lost a lot of trust after those incidents.
- tialaramex 8y ago
  The problem with the story "they had to be revoked" is that er, they weren't revoked. Comodo's roots from that era are still in use today. That's because though you've said so twice now, those keys weren't "on their forum servers" and remained in Comodo's hands. I think you're conflating two incidents, one from 2008 when ZF0 broke into a poorly secured web forum on Comodo's systems and one in 2011 where "ComodoHacker" gained access to Comodo's issuance system because they used a single factor password login system, and was able to create a bunch of certificates for themselves using the account credentials they had. You might even be further conflating problems at DigiNotar, which "ComodoHacker" also claimed responsibility for, where Iran was using certs DigiNotar had no record of to MITM its citizens. DigiNotar is gone, the company is defunct, that entire hierarchy was distrusted seven years ago.