Hotfix to mark Komodia root certificates as untrusted in NSS once the relevant software has been removed

RESOLVED WONTFIX

Status

NSS
CA Certificates Code
--
critical
RESOLVED WONTFIX
2 years ago
2 years ago

People

(Reporter: Cesar Eduardo Barros, Assigned: mgoodwin)

Tracking

({csectype-other, sec-other})

trunk
csectype-other, sec-other

Firefox Tracking Flags

(firefox36 wontfix, firefox37 wontfix, firefox38 wontfix, firefox39 wontfix, firefox40 affected, firefox41 affected, firefox42 affected, firefox43 affected, firefox-esr31 wontfix, firefox-esr38 affected)

Details

(URL)

(Reporter)

Description

2 years ago
As discussed in bug 1134506, the Superfish MITM proxy root certificate should be treated as untrusted. "slipstream / raylee" (https://twitter.com/TheWack0lian) found several other MITM proxies, which like Superfish use the Komodia SDK, that have hardcoded root certificates.

Since they are hardcoded, their private key has been compromised, and they should also be treated as untrusted.

The list of currently known hardcoded private keys can be found at https://gist.github.com/Wack0/17c56b77a90073be81d3.
(Reporter)

Updated

2 years ago
Depends on: 1134506

Comment 1

2 years ago
http://marcrogers.org/2015/02/19/will-the-madness-never-end-komodia-ssl-certificates-are-everywhere/

It's even worse than anyone could have thought. Mozilla needs to kill this fast.
Man in the middle attack - marking as critical
Severity: major → critical
Status: UNCONFIRMED → NEW
Ever confirmed: true
Keywords: csectype-other, sec-high
(Reporter)

Updated

2 years ago
See Also: → bug 1136710
Summary: Mark Komodia root certificates as untrusted in NSS → Hotfix to mark Komodia root certificates as untrusted in NSS once the relevant software has been removed
This should just be an adaptation of bug 1136150 to block additional certificates when the corresponding software has been removed.  I believe Mark has a list of certs, but we are still waiting on information about how to check whether the software is present.
Assignee: nobody → mgoodwin
Status: NEW → ASSIGNED
status-firefox36: --- → wontfix
status-firefox37: --- → affected
status-firefox38: --- → affected
status-firefox39: --- → affected
status-firefox-esr31: --- → affected
tracking-firefox39: --- → +
Al, is this something that will need uplift to 37 and 38? 
Or is that unnecessary because of how hotfixes work? Thanks.
Flags: needinfo?(abillings)
We would take this in NSS and then rev the NSS version, AFAIK. 

This is really Richard Barnes' call though for when and how to handle it.
Flags: needinfo?(abillings) → needinfo?(rlb)
OK, based on talking with Richard on irc, we probably don't need to track this for now. As I understand it, if a computer is already infected, we can't use this hotfix because it breaks https for them. It doesn't help anyone who isn't infected stay uninfected. 

But if people have removed whatever it is that has compromised their machine, and we can detect it, then maybe we can apply a hotfix. So maybe we need help from Telemetry. 

Please feel free re-nominate this for tracking if it seems like relman needs to be involved or we make this a priority.
tracking-firefox39: + → ---
Keywords: sec-high → sec-other
status-firefox37: affected → wontfix
status-firefox38: affected → wontfix
status-firefox39: affected → wontfix
status-firefox40: --- → affected
status-firefox41: --- → affected
status-firefox42: --- → affected
status-firefox43: --- → affected
status-firefox-esr31: affected → wontfix
status-firefox-esr38: --- → affected
At this point, I don't think we're going to take any action on this.
Status: ASSIGNED → RESOLVED
Last Resolved: 2 years ago
Flags: needinfo?(rlb)
Resolution: --- → WONTFIX
You need to log in before you can comment on or make changes to this bug.