Comodo - SSL issues

General Topics
1

Continued from ‘Technical’: http://forum.avast.com/index.php?topic=66267.msg617097#msg617097
Feel free to add your opinion.
asyn

Edit: doktornotor’s thread is online again…
https://forums.comodo.com/ssl-certificate/comodo-issues-fraudulent-certificates-incl-mozilla-once-again-t70973.0.html

2

Posted in Wilders: http://www.wilderssecurity.com/showthread.php?p=1847026#post1847026

3

@doc: You thread @comodo has been restored. :wink: (Thanks Bob…!!!)
https://forums.comodo.com/ssl-certificate/comodo-issues-fraudulent-google-microsoft-mozilla-skype-yahoo-certificates-t70990.0.html;msg504253#msg504253

All

My mistake, I’d forgotten that the Forum Policy Violation Board is no longer visible and what I had done was not transparent.

The original topic has been restored, less the offending posts.

Comodo issues fraudulent Google, Microsoft, Mozilla, Skype, Yahoo certificates

Sal: Thanks, I should had thought of that sooner. Smiley

4

this is all new to me, thanks guys ;D

5

Haha… not my account though.

@mods: Would be nice to split the stuff from the original thread and move it here.

6

this added to the (unrelated) RSA affair… wonderful times :smiley:
http://www.scmagazineuk.com/the-impact-of-the-rsa-token-data-breach-is-still-undetermined/article/198935/

edit: I started a thread about it a few days ago, thanks for the feedback there btw guys ::slight_smile:
http://forum.avast.com/index.php?topic=74077.msg614434#msg614434

7

No…?? Did they ban you and leave your account running, or what…??
https://forums.comodo.com/ssl-certificate/comodo-issues-fraudulent-certificates-incl-mozilla-once-again-t70973.0.html

8

See below. (No, I don’t need the account back, haven’t been there for like 2 years).

9

Well, I linked to your thread, but you didn’t even notice. :wink:
http://forum.avast.com/index.php?topic=52252.msg614616#msg614616

10

@Asyn okay :wink:

Hmm guys… I see a major problem here, the “other” doctornotor is saying that FF4 RC2 was justified to block fraulent certificates. Fair enough… but FF has its own certificate store while Chrome is using Windows/IE store… and as far as I’m concerned unless MS sends an update through Windows Update IE8/9 and Chrome are vulnerable. Got to say that the ZDnet article is …hmm… worrying
http://www.zdnet.com/blog/security/microsoft-warns-fraudulent-digital-certificates-issued-for-high-value-websites/8488?tag=nl.e589

ps: lol, funny I updated to RC2 a few days ago and the only thing I found was that Mozilla corrected a last minute bug… but the article didn’t say what… I didn’t really care and should have searched other places…

11

Already out as critical update on WU and WSUS. Also manual d/l via http://support.microsoft.com/kb/2524375 (from XP up to Server 2008 R2)

P.S. IE and Chrome is doing it the right way ™ - bundling its own certificates crap is plain wrong, and nightmare to manage in business environment.

12

yeah I just saw that in the article:

Microsoft has pushed out an update for all supported versions of Windows to help address this issue and notes that no action is required from Windows users with automatic update enabled. The company’s advisory contains instructions on manually applying the update.

edit: KB2524375 (W7/64) already available directly from Windows update.

13

Apparently the morons @ Comodo have not heard about DNSSEC yet either; ugh. ::slight_smile:

:-X ::slight_smile:

14

lol… the guy feels guilty ;D now he’s trying to put the weight on DNS servers shoulders ::slight_smile: same old Melih…

15

Seems, they’re searchin for flimsy excuses. :wink:

16

lol on a side note, I don’t think anything worse could happen to Comodo. Officially they got screwed themselves (stolen credentials of an Comodo ssl cert provider)… now we don’t know and we might never know how it happened…

17

For the ones who do not know what could happen:

These certificates may be used to spoof content, perform phishing attacks, or perform man-in-the-middle attacks against all Web browser users including users of Internet Explorer.
18

Update your Windows!
Or http://www.microsoft.com/technet/security/advisory/2524375.mspx

19

Thanks, Tech.
Everyone, who answered here is aware of the risks. :wink:
Still, if other users should follow this thread, it won’t hurt to offer some basic feedback.

20

It would be a lot nicer to do it directly on the Comodo forum. :0