Since last week’s Superfish revelation, researchers have unveiled additional adware and security applications that also subvert HTTPS and our system of online trust.

Komodia/Lavasoft

Komodia is an SSL interception module for Windows that is installing a self-signed CA root certificate onto local operating system root stores. Compounding matters, Komodia uses duplicate digital certificates across all end-user machines, which are protected by a weak password that researcher Rob Graham cracked in three hours. According to reports, the password is, you guessed it, “komodia.” With this password, an attacker could use the root certificate’s private key to create websites that look to be protected over HTTPS but instead are fake ones.

Komodia’s use is not limited to Superfish. Reports identify antivirus scanning company, Lavasoft, as well as 14 others using Komodia:

• Nurjax
• Keep My Family Secure
• Qustodio
• Kurupira Webfilter
• CartCrunch Israel LTD
• WiredTools LTD
• Say Media Group LTD
• Over the Rainbow Tech
• System Alerts
• ArcadeGiant
• Objectify Media Inc
• Catalytix Web Services
• OptimizerMonitor
• SecureTeen

PrivDog

Researchers also have identified security concerns with a version of PrivDog, an application which claims to protect your privacy by only displaying advertisements from a trusted source. PrivDog has been very recently promoted by the Comodo Group of companies, which also runs a publicly trusted certificate authority (CA), and the two companies seem to be closely related. PrivDog also installs a self-signed CA root certificate into the local Operating System trust store, but unlike Superfish and Komodia, it does not use the same encryption keys for every end-user machine.

PrivDog’s failure lies in the fact that it does not validate the original trusted certificates that it intercepts and could, thus, force the browser to accept an attacker’s self-signed certificates. Browsers are programmed to trigger error messages that warn users about untrusted certificates and the related security risks, but PrivDog’s configuration bypassed such user protections.

According to PC World, the vulnerable version of PrivDog “will take an attacker’s self-signed certificate and create a copy signed with its own trusted root certificate, forcing the browser to accept it. The user’s traffic would be intercepted and decrypted by the local PrivDog proxy, but PrivDog’s connection to the real site would also be intercepted and decrypted by a hacker.”

What Should You Do?

As mentioned in our blog post last Thursday, certificates from Superfish and other similar applications are difficult to remove, because they use certificates that are issued outside of the standard trust system. When a publicly trusted root certificate is included in the browser’s root store, it can be revoked if it is ever compromised. However, in this case since the certificate was inserted directly into the trust store on the computer, each individual user must remove the root certificate from their store.

Similarly, proactive measures such as certificate pinning in Google Chrome will not alert users in cases like this because these self-signed root certificates are installed in the local root store. Chrome’s pinning doesn’t validate certificates chained to a private anchor.

Filippo Valsorda, maker of a web-based tool to determine if your machine trusts the Superfish certificate, has added Komodia and PrivDog detection.

You can also find instructions for identifying and removing a root certificate from Windows here.

PrivDog announced on Feb. 23 that all users potentially affected by the issue will be automatically updated to a new version.

On February 21, Lavasoft said that the most recent release of its Ad-Aware Web Companion (released on February 18th 2015) does not include the functionality to deploy a root certificate to inspect SSL traffic. Lavasoft also said that, “we are not yet able to confirm with certainty that the compromised component of the Komodia SSL Digestor has been removed. If still present, a new release of Web Companion will be issued promptly on Monday morning.”

As of today, Komodia’s website is offline, with some claiming the cause to be a DDOS attack.

If you think you might have been vulnerable to this MITM attack, you might also consider changing passwords for any sites you may have visited and monitor your accounts for signs of fraud.

Advancing Security

In the last two weeks, we have seen quite a few poor security practices in use, including the installation of self-signed root certificates to imitate real ones, the deployment of one set of poorly protected keys across multiple applications and machines, and failure to properly validate legitimate certificates.

DigiCert is wholly focused on advancing security and online trust and seeking to raise the bar on industry practices. We do this practically by supporting increasingly stringent standards for CA operations and issuance, as well as holding our certificate applicant identity vetting standards to a level much higher than the minimum standards set forth by the CA/Browser Forum. Additionally, we’ve strongly supported implementation of Google’s Certificate Transparency, CA Pinning, and Certificate Authority Authorization technologies.

DigiCert is the go-to provider for many connected communities and industries realizing the need for strong authentication and encryption in the era of the Internet of Things. We pledge our continued focus on doing everything possible to maintain the trust of our customers, as well as that of the security industry at-large.