Closed Bug 1134989 Opened 6 years ago Closed 5 years ago

Hotfix to mark Komodia root certificates as untrusted in NSS once the relevant software has been removed

Categories

(NSS :: CA Certificates Code, task)

task
Not set
critical

Tracking

(firefox36 wontfix, firefox37 wontfix, firefox38 wontfix, firefox39 wontfix, firefox40 affected, firefox41 affected, firefox42 affected, firefox43 affected, firefox-esr31 wontfix, firefox-esr38 affected)

RESOLVED WONTFIX
Tracking Status
firefox36 --- wontfix
firefox37 --- wontfix
firefox38 --- wontfix
firefox39 --- wontfix
firefox40 --- affected
firefox41 --- affected
firefox42 --- affected
firefox43 --- affected
firefox-esr31 --- wontfix
firefox-esr38 --- affected

People

(Reporter: cesarb, Assigned: mgoodwin)

References

()

Details

(Keywords: csectype-other, sec-other)

As discussed in bug 1134506, the Superfish MITM proxy root certificate should be treated as untrusted. "slipstream / raylee" (https://twitter.com/TheWack0lian) found several other MITM proxies, which like Superfish use the Komodia SDK, that have hardcoded root certificates.

Since they are hardcoded, their private key has been compromised, and they should also be treated as untrusted.

The list of currently known hardcoded private keys can be found at https://gist.github.com/Wack0/17c56b77a90073be81d3.
Depends on: 1134506
http://marcrogers.org/2015/02/19/will-the-madness-never-end-komodia-ssl-certificates-are-everywhere/

It's even worse than anyone could have thought. Mozilla needs to kill this fast.
Man in the middle attack - marking as critical
Severity: major → critical
Status: UNCONFIRMED → NEW
Ever confirmed: true
See Also: → 1136710
Summary: Mark Komodia root certificates as untrusted in NSS → Hotfix to mark Komodia root certificates as untrusted in NSS once the relevant software has been removed
This should just be an adaptation of bug 1136150 to block additional certificates when the corresponding software has been removed.  I believe Mark has a list of certs, but we are still waiting on information about how to check whether the software is present.
Assignee: nobody → mgoodwin
Al, is this something that will need uplift to 37 and 38? 
Or is that unnecessary because of how hotfixes work? Thanks.
Flags: needinfo?(abillings)
We would take this in NSS and then rev the NSS version, AFAIK. 

This is really Richard Barnes' call though for when and how to handle it.
Flags: needinfo?(abillings) → needinfo?(rlb)
OK, based on talking with Richard on irc, we probably don't need to track this for now. As I understand it, if a computer is already infected, we can't use this hotfix because it breaks https for them. It doesn't help anyone who isn't infected stay uninfected. 

But if people have removed whatever it is that has compromised their machine, and we can detect it, then maybe we can apply a hotfix. So maybe we need help from Telemetry. 

Please feel free re-nominate this for tracking if it seems like relman needs to be involved or we make this a priority.
At this point, I don't think we're going to take any action on this.
Status: ASSIGNED → RESOLVED
Closed: 5 years ago
Flags: needinfo?(rlb)
Resolution: --- → WONTFIX
You need to log in before you can comment on or make changes to this bug.