SIT735 - Comodo Hack: Dotti Fashion Risk Assessment & Mitigation

This report examines the impact of the Comodo certificate hack on Dotti Fashion, a medium-sized company that recently expanded its online presence. The compromise of the Comodo Certification Authority poses significant risks, including the potential compromise of Dotti's registration server, partner accounts, and user traffic redirection to fake sites. The report identifies issues such as the exploitation of the PKI environment, malware diffusion, and the installation of malicious codes. To mitigate these risks, the report proposes solutions such as appointing a security researcher, creating a SHA1 fingerprint map, regular website data backups, monitoring XSS and SQL injections, and implementing a web application firewall. Additional recommendations include enforcing strong passwords, removing the autofill option, dividing the network into manageable zones, revising security policies, educating employees, using VPNs, updating software and patches, utilizing an Intrusion Prevention System (IPS) and Next-Generation Firewall (NGFW), and conducting routine risk analysis and security audits. The report concludes by emphasizing the importance of proactive security measures to protect Dotti Fashion from potential cyber threats.

COMODO
CERTIFICATE
FRAUD HACK
STUDENT NAME
STUDENT NUMBER

ORGANIZATION
• THE CHOSEN ORGANIZATION FOR
THE SCENARIO HERE IS DOTTI
FASHION ORGANIZATION
• MEDIUM SIZED COMPANY AND
HAS RECENTLY GROWN IN
BUSINESS]
• OPENED ITS ONLINE STORE
RECENTLY IN 2012 FOR
COMMERCIAL TRANSACTIONS
• DEALS WITH FASHION ITEMS

CONCERN
• AFTER NEWS BROKE OUT THAT THE
CERTIFICATION AUTHORITY OR CA CALLED
COMODO WAS DUPED BY AN IRANIAN
HACKER IT CAUSED A MAJOR CONCERN IN
THE IT COMMUNITY.
• THE COMMUNITY HAS EVEN URGED
PROMINENT COMPANIES LIKE MOZILLA
AND MICROSOFT TO REMOVE COMODO AS
A PROPER TRUSTABLE ROOT SECURITY
AUTHENTICATOR (PARKINSON, S.F., EMC
CORP, 2014).
• THE DIGITAL CERTIFICATION INTEGRITY OF
THE COMPANY WAS COMPROMISED WHICH
CAN PUT THE COMPANY AT SERIOUS RISK
IF PROPER STEPS ARE NOT TAKEN.

SECURITY RISKS
• THE REGISTRATION SERVER OF THE
MENTIONED COMPANY (DOTTI) CAN
GET COMPROMISED DUE TO THE
CERTIFICATION HACK.
• THE PARTNERS WHICH ARE CURRENTLY
WORKING FOR THE MENTIONED
COMPANY CAN ALSO GET
COMPROMISED AND THEIR
PASSWORDS AND LOGIN DETAILS CAN
BE STOLEN THROUGH THE EXPLOIT.
• THE HACK COULD POTENTIALLY
TRANSFER THE USER TRAFFIC OF THE
COMPANY TO A FAKE SITE AND CAUSE
IRREPARABLE DAMAGE TO ITS
REPUTATION.

CONTINUED…
• DOTTI COULD ALSO GET AFFECTED BY
SEVERAL LAWSUITS DUE TO FAILURE OF
DISCOVERING THE VULNERABILITY AND
REVOKING IT AS SOON AS POSSIBLE.
• THE BASIC SECURITY OF THE SITE WILL
GET COMPROMISED AND USERS WILL
REFUSE TO PERFORM ONLINE
COMMERCIAL TRANSACTIONS FROM
DOTTI’S WEBSITE WHICH WILL AFFECT
THEIR PROFIT MARGIN AS WELL (KHAN ET
AL. 2018).
• HACKERS WILL BE ABLE TO INTERCEPT
THE SENSITIVE DATA THAT GOES
BETWEEN THE SITE AND THE BROWSER
WHICH IS NORMALLY ENCRYPTED

ISSUES
• THE HACKERS CAN USE THE COMODO
CERTIFICATE HACK AS A MEDIUM TO GET INTO
THE PKI ENVIRONMENT. THEY CAN USE THE
HACK TO IMPROVE THE DIFFUSION OF
MALWARES IN THE SERVER OF THE MENTIONED
COMPANY, DOTTI.
• THEY CAN COMPROMISE THE BUILD SERVER OF
THE MENTIONED COMPANY BY SIGNING THE
MALWARE THROUGH OTHER DIGITAL
CERTIFICATES SUCH AS ADOBE ALONG WITH
COMODO TO INCREASE THE CHANCES OF FAIR
VALIDATION OF CODES.
• THEY WILL ALSO HAVE THE CAPABILITY TO
INSTALL INFECTED ISAPI FILTER, PASSWORD
DUMPER AND A NUMBER OF MALICIOUS CODES.
THEY CAN ALSO CREATE NEW TROJANS WITH
THE STOLEN DIGITAL SIGNATURE AND ENHANCE

SOLUTION
• APPOINTING A SECURITY RESEARCHER
WHO WILL HAVE ACCESS TO THE SSL
BLACK LIST THAT HAS A COLLECTION OF
THE DIGITAL CERTIFICATES LIKE
COMODO WHICH ARE USED FOR
MALIGNOUS PURPOSES (DOTTI ONLINE
SHOP 2018).
• CREATE A MAP OF SHA1 FINGERPRINTS
WHICH ARE LINKED TO BOTNET AND
MALWARE ACTIVITIES.
• DOTTI NEEDS TO KEEP A TRACK ON THE
LATEST DIGITAL CERTIFICATE ABUSE
NEWS TO KEEP A TRACK ON INTERNET
SURVEILLANCE AND MALWARE
DISTRIBUTION.

CONTINUED…
• BACKING UP THE WEBSITE DATA
REGULARLY BY CREATING MANUAL AND
AUTOMATIC BACKUPS.
• THE XSS OR CROSS SITE SCRIPTING AND
SQL INJECTIONS NEED TO BE MONITORED
CAREFULLY THROUGH QUERIES WHICH
ARE PARAMETERIZED TO CHECK
UNUSUAL INSERTION OF CODES IN THE
SERVER (COMODO CERTIFICATE HACK
2018).
• SPECIAL SOFTWARE SUCH AS WEB
APPLICATION FIREWALL CAN BE USED BY
THE COMPANY TO FILTER ANY HACKING
ATTEMPTS AND PROVIDE AN EXTRA
LAYER OF PROTECTION

CONTINUED…
• USAGE OF STRONG PASSWORDS IS
MANDATORY AND DOUBLE
AUTHENTICATION SHOULD BE MADE
MANDATORY FOR EVERY USER OF THE
COMPANY’S WEBSITE.
• TO PROTECT ITS CUSTOMERS, DOTTI
CAN REMOVE THE AUTO FILL OPTION
FROM ITS WEBSITE TO PREVENT THE
HACKERS FROM STEALING SENSITIVE
CUSTOMER INFORMATION
• . THE COMPANY NEEDS TO APPOINT A
PROPER SECURITY TEAM WHICH WILL
HAVE THE ABILITY TO CHECK UPLOADED
FILES WITH SUSPICION AND MONITOR
THE ACTIVITY OF THE UPLOADED FILES.

ONS
• THE NETWORK OF THE COMPANY NEEDS TO BE
DIVIDED INTO MANAGEABLE ZONES AND FOR THE
WORKING TEAMS, MULTIFACTOR AUTHENTICATION
NEEDS TO BE PROVIDED TO MANAGE THE SCENARIO.
• SECURITY POLICIES NEED TO BE REVISED AND
ENFORCED ACCORDINGLY TO PROVIDE STRONGER
DEFENCES THAT CAN RESPOND TO HTTP AS WELL AS
HTTPS ATTACKS.
• EMPLOYEES NEED TO BE EDUCATED ABOUT THE
IMPORTANCE OF ACCESS CONTROLS,
AUTHENTICATION AND IDENTITY VERIFICATION.
• VPN OR VIRTUAL PRIVATE NETWORKS NEEDS TO BE
USED TO PREVENT MAN IN THE MIDDLE ATTACKS.
• THE SOFTWARE AND PATCHES NEEDS TO BE
CHECKED IF THEY ARE UP TO DATE TO PREVENT THE
LATEST THREATS.

CONTINUED…
• TO STOP THE ATTACKING SYSTEM AND
IDENTIFYING THE MALICIOUS ATTACKERS,
IPS OR INTRUSION PREVENTION SYSTEM
NEEDS TO BE USED.
• TO CHECK THE CURRENT PERFORMANCE OF
THE NETWORK AND MAINTAIN THE
SECURITY GOALS FOR THE FUTURE, THE
COMPANY NEEDS TO INSTALL A NGFW OR
NEXT GENERATION FIREWALL AND INSTALL
APPROPRIATE ANTIVIRUSES.
• A RISK ANALYSIS TEST NEEDS TO BE
PERFORMED AND A SECURITY AUDIT NEEDS
TO BE SCHEDULED IN A ROUTINE MANNER
TO CHECK THE VULNERABILITIES THAT THE

REFERENCES
COMODO CERTIFICATE HACK—IT GETS WORSE - BRAVATEK.COM. [ONLINE] AVAILABLE AT:
HTTPS://BRAVATEK.COM/COMODO-CERTIFICATE-HACK-IT-GETS-WORSE/
DOTTI ONLINE SHOP | SHOP THE LATEST WOMENS CLOTHING, DRESSES & FASHION [ONLINE].
AVAILABLE AT: HTTPS://WWW.DOTTI.COM.AU/ [ACCESSED 2018]
KHAN, S., ZHANG, Z., ZHU, L., LI, M., SAFI, K., GUL, Q. AND CHEN, X., 2018. ACCOUNTABLE AND
TRANSPARENT TLS CERTIFICATE MANAGEMENT: AN ALTERNATE PUBLIC-KEY INFRASTRUCTURE
WITH VERIFIABLE TRUSTED PARTIES. SECURITY AND COMMUNICATION NETWORKS, 2018.
PARKINSON, S.F., EMC CORP, 2014. CERTIFICATE CROSSCHECKING BY MULTIPLE CERTIFICATE
AUTHORITIES. U.S. PATENT 8,850,208.