It would appear to me that most of Comodo employees are not part of the consumer web development team nor I would expect be trained to manage it either. If they had been then I would expect the consumer websites would be less of a mess.
Furthermore they have actually used a 3rd party marketing/web agency based in Clifton. I expect they may be contracted to carry out some of the updates.
So they take security very seriously for their forum but nether take direct responsibility or act in an advisory role in hardening the security of their own forum? I think we might be getting back to the Zack Whittaker's complaint then that it is a hollow statement for vendors to keep claiming to take security seriously after a data breach.
Is HackerProof used on this forum?
Why wouldn't they use it as part of taking security seriously and if there is a known issue with a 3rd party run service that directly impacts the Comodo brand to insist the 3rd party address the issue? Why wouldn't they also offer the Clifton agency free licenses to all the Comodo security tools if not at the very least for protecting the Comodo brand and Comodo customers? We should buy into security solutions even their own marketing agency wouldn't touch??
mmalheiros points out that the web server indicates it is Apache/Debian. He then points out an online tool to get that information. The online tools states it is Apache v2.4.45 which seems to indicate they are still running Debian 9. That distribution version was released in June 2017. At the time it made sense to have TLS 1.0 and TLS 1.1 enabled by default. In 2018, the IETF and NIST has stated those protocols should be considered deprecated. TLS 1.0 has not aged well with such issues as BEAST and POODLE. Shouldn't Comodo take security seriously enough to scan for that issue and see that it gets addressed?
The forum performs HTTP code 307 redirects to non-HTTPS emoji icons. In the past there have been browser exploits based on maliciously crafted image files. Shouldn't a Comodo that take security seriously avoid the potential for a man in the middle attack delivering such an exploit when sending the image unencrypted? Why are they undermining the HSTS setting with HTTP redirects to unencrypted transmission of these images?
According to BleepingComputer, the Comodo forums database include MD5 hashed password for the Comodo forums running the Simple Machines Forum software. According to the changelog for SMF, if the forum software is upgraded since 2005 then any successful login will also upgrade the MD5 hash to a SHA-1 hash. There have been 16 CVEs issued for the Simple Machines Forum software since 2005, have those security fixes not been applied? Shouldn't Comodo use it's "next dimension in website scanning" to make sure the web application is kept up to date with security patches? Would it really be acceptable that Comodo took security seriously by sitting on the side lines and letting a 3rd party using their brand not address this?
Once again, Comodo Dragon is not going to prevent forum software exploits being targeted on a web server.
If you picked any medium size company at random and told the CEO of that company that a product has 100% protection from zero-day attacks using zero trust breach protection, would that imply to that CEO that the software is not going to prevent forum software exploits? What is a zero-day attack if it isn't something that takes advantage of software exploits such as forum software exploits? What exactly is Comodo trying to communicate in the material for why we should be using the Comodo Dragon platform?
As far as I see it, the way Comodo claims their tools work to prevent at 100% levels make security worse for several users. If you believe that you have everything covered through magic without having to take any additional steps then you may become lax on applying other preventive measures. Getting lax to the point of leaving deprecated default configuration options, leaving open MITM attacks and not keeping software up to date for known issues would be bad for taking security seriously.
Instead, if Comodo could dial down their marketing claims just a slight notch such as stating their tools are helpful for security exploit mitigation when used as part of a well-balanced breakfast of security policies and tools, then the customer might be more aware to not be lax.
But the claim of having 100% prevention tools and have a data breach which can still happen when taking security very seriously just doesn't logically mesh together well.
