search

rzander / cmcollctr

Collection Commander
Microsoft Public License
11 stars 4 forks source link

CMcollctrl.exe outgoing attempt on port 54981 - Malicious company in China took over certificate? #15

Open paddingtonb3ar opened 2 years ago

paddingtonb3ar commented 2 years ago

It seems there is an issue or some sort of modified file uploaded here in Github. Cause this pops up in our environment, everytime CMcollctrl.exe is started. Which freaks out our Security team and flags every PC that are using this application.

<CMcollctrl.exe outgoing attempt on port 54981 to Address - 101.198.193.12 port 80>

And this IP nowdays goes to virustotal URL

if IP is typed into browser this goes up Screenshot 2022-10-01 at 01-00-51 Notice to all StartCom subscribers

<101.198.193.12 (101.198.192.0/22) AS 55992 ( Beijing Qihu Technology Company Limited )>

Screenshot 2022-10-01 at 01-02-56 VirusTotal - Ip address - 101 198 193 12

Has the signing certificate been sold to malicious actors in China?

paddingtonb3ar commented 2 years ago

Ive read some and this popped up on Wikipedia aswell which might explain all the "fuzz"

Certificates According to documents released by the Mozilla Corporation in 2016, Qihoo appears to have acquired a controlling interest in the previously Israeli-run Certificate Authority "StartCom", through a chain of acquisitions, including the Chinese-owned company WoSign. WoSign also has a certificate authority business; WoSign has been accused of poor control and of misissuing certificates.[30] Furthermore, Mozilla alleges that WoSign and StartCom violate their obligations as Certificate Authorities in respect of their failure to disclose the change in ownership of StartCom; Mozilla is threatening to take action, to protect their users.[31]

Google have stated that their Chrome product will no longer trust by default any certificates signed by StartCom or Wosign roots, starting with Chrome 61.[32] Mozilla have stated that their Firefox product will no longer trust by default any certificates signed by StartCom or WoSign roots, starting with Firefox version 58

Is there any chance to re-package CMCOLLCTRL without this old expired sold certificate please Roger? so that this application can be used for good purposes once again.

rzander commented 2 years ago

There is no further maintenance on this project planned. But you can sign the executable with an own code-signing cert....

paddingtonb3ar commented 2 years ago

There is no further maintenance on this project planned. But you can sign the executable with an own code-signing cert....

I see. Are there any chance you can compile the old version but without any certification at all so there are none outgoing connection attempt to pre-release (Comodo signed) or the old with (StartCom) connection attempt(s) at program startup?

paddingtonb3ar commented 2 years ago

There is no further maintenance on this project planned. But you can sign the executable with an own code-signing cert....

Can you upload cmcollctr.1.0.0.11.msi here on Github Roger? Im pretty sure that will do the magic for me. Since that seems to be signed locally as far as i can tell and should not try to connect to remote code signing certificate servers.

Since i am pretty sure cmcollctr.1.0.6 that is reaching out to Comodo US servers on startup will trigger our Firewalls.