1134989 - Hotfix to mark Komodia root certificates as untrusted in NSS once the relevant software has been removed

Status: RESOLVED WONTFIX

(NSS :: CA Certificates Code, task)

Description

[Cesar Eduardo Barros]

As discussed in bug 1134506, the Superfish MITM proxy root certificate should be treated as untrusted. "slipstream / raylee" (https://twitter.com/TheWack0lian) found several other MITM proxies, which like Superfish use the Komodia SDK, that have hardcoded root certificates.

Since they are hardcoded, their private key has been compromised, and they should also be treated as untrusted.

The list of currently known hardcoded private keys can be found at https://gist.github.com/Wack0/17c56b77a90073be81d3.

Comment 1

[NVD]

http://marcrogers.org/2015/02/19/will-the-madness-never-end-komodia-ssl-certificates-are-everywhere/

It's even worse than anyone could have thought. Mozilla needs to kill this fast.

Comment 2

[Virtual_ManPL [:Virtual] 🇵🇱 - (please needinfo? me - so I will see your comment/reply/question/etc.)]

Man in the middle attack - marking as critical

Comment 3

[Richard Barnes [:rbarnes]]

This should just be an adaptation of bug 1136150 to block additional certificates when the corresponding software has been removed.  I believe Mark has a list of certs, but we are still waiting on information about how to check whether the software is present.

Comment 4

[Liz Henry (:lizzard) (relman/hg->git project)]

Al, is this something that will need uplift to 37 and 38? 
Or is that unnecessary because of how hotfixes work? Thanks.

Comment 5

[Al Billings [:abillings - ex-MoCo]]

We would take this in NSS and then rev the NSS version, AFAIK. 

This is really Richard Barnes' call though for when and how to handle it.

Comment 6

[Liz Henry (:lizzard) (relman/hg->git project)]

OK, based on talking with Richard on irc, we probably don't need to track this for now. As I understand it, if a computer is already infected, we can't use this hotfix because it breaks https for them. It doesn't help anyone who isn't infected stay uninfected. 

But if people have removed whatever it is that has compromised their machine, and we can detect it, then maybe we can apply a hotfix. So maybe we need help from Telemetry. 

Please feel free re-nominate this for tracking if it seems like relman needs to be involved or we make this a priority.

Comment 7

[Richard Barnes [:rbarnes]]

At this point, I don't think we're going to take any action on this.