VNC Server Discovered in Comodo Gear

Just when you thought it was safe to dive back into the Comodo waters, Google researcher Tavis Ormandy has surfaced with more trouble.

Publicly disclosed yesterday on the Google Project Zero site, Ormandy said that a tech support application called GeekBuddy installed with Comodo Internet Security also drags along with it a VNC server that is enabled by default.

Ormandy said it’s relatively simple to pull the password out of the Windows Registry.

VNC servers are remote access applications generally dropped onto desktop images giving admins the ability to reach out over the Internet to resolve support issues. The server shares a computer’s desktop with the admin and allows support people—and attackers who gain access—to manipulate settings, see files and perform the same actions as the computer’s owner.

“This is an obvious and ridiculous local privilege escalation, which apparently Comodo believe they have resolved by generating a password instead of leaving it blank,” Ormandy wrote. “That is not the case, as the password is simply the first 8 characters of SHA1(Disk.Caption+Disk.Signature+Disk.SerialNumber+Disk.TotalTracks). I imagine Comodo thought nobody would bother checking how they generated the password, because this clearly doesn’t prevent the attack they claim it solved. Not to mention that this is also a sandbox escape that even works against Comodo and Chromodo sandboxes, not to mention Chrome, Protected Mode, and other sandboxes.”

Comodo pushed a hotfix to most Comodo Internet Security installations on Feb. 10, adding that it estimates about 90 percent of users are updated.

The GeekBuddy discovery was actually posted to the Project Zero queue on Jan. 19, two days before Ormandy revealed in the same forum a serious issue with the Chromodo browser, also installed by default with Comodo’s security product. Both issues were subject to Project Zero’s 90-day disclosure deadline.

The Chromodo browser is built upon Google’s Chromium code base and Ormandy said it disabled the Same Origin Policy, a foundational browser security provision that restricts the ability of documents or scripts hosted on a site to interact with content from other origins based on URI scheme, hostname, port number and more.

In addition to disabling the Same Origin Policy, Ormandy said Chromodo hijacks DNS settings, and replaces all shortcuts with Chromodo links.

by    February 19, 2016 , 7:58 am
Full article:

Leave a Reply

Please log in using one of these methods to post your comment:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out / Change )

Twitter picture

You are commenting using your Twitter account. Log Out / Change )

Facebook photo

You are commenting using your Facebook account. Log Out / Change )

Google+ photo

You are commenting using your Google+ account. Log Out / Change )

Connecting to %s