Comodo root canal call as more hacks confirmed

Comodo chief technology officer Robin Alden has admitted that two other SSL registration authorities (RAs) that resold its web certificates were compromised by the “Comodo hacker”.

“Two further RA accounts have since been compromised and had RA privileges withdrawn,” Alden wrote on Mozilla’s Bugzilla mailing list on Wednesday. 

“No further mis-issued certificates have resulted from those compromises,” he said. 

Last week Comodo, a privileged Certificate Authority (CA), warned customers that an attacker had issued nine false SSL certificates after hacking its Italian reseller, InstantSSL.it.

The fraudulent certificates could allow an attacker to launch a man-in-the-middle attack where a fake website would be verified as authentic. 

Alden’s admission came after the “Comodo hacker” revealed that he had hacked three of Comodo’s resellers [Line 20], not just InstantSSL.  

“I owned 3 of them, not only Italian one, but I interested more in Italian brach because they had too many codes, works, domains, (globaltrust, cybertech, instantssl, etc.) so I thought they are more tied with Comodo,” the hacker claimed earlier.

Alden said that Comodo had not considered the possibility of this type of targeted attack.

“We were dealing with the threat model that the RA could be underperforming with, or trying to avoid doing, their validation duty (neither of which were the case for this RA),” he said. 

“What we had not done was adequately consider the new (to us) threat model of the RA being the subject of a targeted attack and entirely compromised.”

The hacker has claimed to be an Iranian programmer seeking revenge for the Stuxnet malware, widely reported to have damaged Iran’s nuclear enrichment equipment.

On Tuesday, the hacker revealed the private key for Mozilla's "add on" certificate, which only the attacker or the authority could have held, according to Netcraft security researcher Paul Mutton.

Alden said Comodo would roll out two factor tokens to authenticate its RAs in the coming weeks and in the meantime would review all of their validation processes. 

But its effort to tighten control over reseller processes are too little too late, according to a Dutch SSL certificate reseller.

“It's definitely time that Mozilla, Microsoft and others take responsibility and pull the root from the browsers,” Paul van Brouwershaven, chief technology officer for Dutch web host, Networking4all, told iTNews in an email. 

A root certificate identifies a primary CA and is often assumed to be trustworthy since it holds the highest authority. Mozilla’s list of Root CAs can be found here.

“Comodo had several opportunities to show that they are willing to change. In the past years they have showed over and over again that they are not willing to take the responsibility that a CA should have,” said van Brouwershaven. 

The main problem with Comodo -- the third largest SSL certification authority behind Verisign and Go Daddy, according to UK security firm Netcraft -- was that it failed to validate its reseller’s procedures for issuing certificates on its behalf. 

"Networking4all was able to become a Comodo RA many years ago, we never had training and we never got checked," said van Brouwershaven, adding that it could have issued "every certificate we would like."

Van Brouwershaven pointed to Comodo reseller Certstar, which in 2008 mis-issued a SSL certificate for the ‘mozilla.com’ domain.

"They where able to do this because the validation procedure from Comodo lacks. You can't trust 'hundreds' of RAs,” he said.

Van Brouwershaven also criticised Comodo’s sluggish response to a fellow Dutch reseller that had intentionally "mis-issued" certificates for a website that gave access to Dutch government agencies and the country’s major banks. 

“Only after I had notified Comodo the certificates got revoked but still nothing changed,” he said. 

Mozilla too has raised the possibility of un-trusting all of Comodo’s roots amongst several other options it wants considered for security over the coming five years.