A researcher from Google Project Zero discovered a serious security issue with the technical support tools supplied with Comodo software products. Tavis Ormandy found that Comodo Antivirus, Comodo Firewall, and Comodo Internet Security all included a bundled VNC server with either no password protection, or a very weak password.
GeekBuddy is a remote desktop tool used by support staff to troubleshoot customer problems, but it also serves as a backdoor that allows for near-unrestricted access to users' computers. The tool installs with full admin rights, meaning that an attacker could very easily gain complete control of a remote computer.
Older versions of GeekBuddy were installed with no password set, making it possible for anyone to remotely connect to a computer using nothing more than its IP address and a port number. This issue was addressed, but Ormandy found that the password used in subsequent versions is so easily cracked that it offers virtually no protection. He says:
The password is simply the first 8 characters of SHA1 (Disk.Caption+Disk.Signature+Disk.SerialNumber+Disk.TotalTracks)
Having been in communication with Comodo over the issue, Ormandy decided to go public:
Comodo Internet Security installs a VNC server with predictable password by default. https://****/HQXVeKgMLT ¯_(ツ)_/¯
— Tavis Ormandy (@taviso) February 18, 2016
Comodo has now addressed the problem -- so make sure your software is up to date -- and Softpedia reports that the company has responded to the revelations:
Comodo has come out to clarify that only its support staff can connect to GeekBuddy, through special company relay servers, meaning remote attackers could not employ this flaw. On the other hand, malware that is already present on the system could use it to escalate its privileges and gain more intrusive capabilities.
Photo credit: Biz Idea Production / Shutterstock
Continue reading...