Xcitium

Xcitium
Company typePrivate
IndustryComputer software
FoundedUnited Kingdom
(1998; 27 years ago (1998))[1]
Headquarters
Bloomfield, New Jersey
,
United States
Area served
Worldwide
Key people
Melih Abdulhayoğlu (President and Chairman)
Number of employees
1,200+[citation needed]
Websitewww.xcitium.com

Xcitium (formerly Comodo Security Solutions Inc.) is a cybersecurity company, including Zero Trust cybersecurity, based in Bloomfield, New Jersey, United States.[2] In 2022, the company rebranded as Xcitium.[3]

History

[edit]

The company was founded in 1998 in the United Kingdom[1] by Melih Abdulhayoğlu. The company relocated to the United States in 2004. Its products are focused on computer and internet security. The firm operates a certificate authority that issues SSL certificates. The company also helped set standards by contributing to the IETF (Internet Engineering Task Force) DNS Certification Authority Authorization (CAA) Resource Record.[4]

In October 2017, Francisco Partners acquired Comodo Certification Authority (Comodo CA) from Comodo Security Solutions, Inc. Francisco Partners rebranded Comodo CA in November 2018 to Sectigo.[5][6]

On June 28, 2018, the new organization announced that it was expanding from TLS/SSL certificates into IoT security with the announcement of its IoT device security platform.[7] The company announced its new headquarters in Roseland, New Jersey on July 3, 2018[8] and its acquisition of CodeGuard, a website maintenance and disaster recovery company, on August 16, 2018.[9]

Industry affiliations

[edit]

Comodo is a member of the following industry organizations:

  • Certificate Authority Security Council (CASC): In February 2013, Comodo became a founding member of this industry advocacy organization dedicated to addressing industry issues and educating the public on internet security.[10][11]
  • Common Computing Security Standards Forum (CCSF): In 2009 Comodo was a founding member of the CCSF, an industry organization that promotes industry standards that protect end users. Comodo CEO Melih Abdulhayoğlu is considered the founder of the CCSF.[12]
  • CA/Browser Forum: In 2005, Comodo was a founding member of a new consortium of certificate authorities and web browser vendors dedicated to promoting industry standards and baseline requirements for internet security.[13][14] Melih Abdulhayoğlu invited top browser providers and certification authorities to a round table to discuss the creation of a central authority responsible for delivering digital certificate issuance best practice guidelines.[15]

Products

[edit]

Controversies

[edit]

Certificate hacking

[edit]

On 23 March 2011, Comodo posted a report that 8 days earlier, on 15 March 2011, a user account with an affiliate registration authority had been compromised and was used to create a new user account that issued nine certificate signing requests.[16] Nine certificates for seven domains were issued.[16] The attack was traced to IP address 212.95.136.18, which originates in Tehran, Iran.[16] Moxie Marlinspike analyzed the IP address on his website the next day and found it to have English localization and Windows operating system.[17] Though the firm initially reported that the breach was the result of a "state-driven attack", it subsequently stated that the origin of the attack may be the "result of an attacker attempting to lay a false trail.".[16][18]

Comodo revoked all of the bogus certificates shortly after the breach was discovered. Comodo also stated that it was actively looking into ways to improve the security of its affiliates.[19]

In an update on 31 March 2011, Comodo stated that it detected and thwarted an intrusion into a reseller user account on 26 March 2011. The new controls implemented by Comodo following the incident on 15 March 2011, removed any risk of the fraudulent issue of certificates. Comodo believed the attack was from the same perpetrator as the incident on 15 March 2011.[20]

In regards to this second incident, Comodo stated, "Our CA infrastructure was not compromised. Our keys in our HSMs were not compromised. No certificates have been fraudulently issued. The attempt to fraudulently access the certificate ordering platform to issue a certificate failed."[21]

On 26 March 2011, a person under the username "ComodoHacker" verified that they were the attacker by posting the private keys online[22] and posted a series of messages detailing how poor Comodo's security is and bragging about their abilities.[23][24]

As of 2016, all of the certificates remain revoked.[16] Microsoft issued a security advisory and update to address the issue at the time of the event.[25][26]

Certificates issued to known malware distributors

[edit]

In 2009 Microsoft MVP Michael Burgess accused Comodo of issuing digital certificates to known malware distributors.[27] Comodo responded when notified and revoked the certificates in question, which were used to sign the known malware.[28]

Let's Encrypt trademark registration application

[edit]

In October 2015, Comodo applied for "Let's Encrypt", "Comodo Let's Encrypt", and "Let's Encrypt with Comodo" trademarks.[29][30][31] These trademark applications were filed almost a year after the Internet Security Research Group, parent organization of Let's Encrypt, started using the name Let's Encrypt publicly in November 2014,[32] and despite the fact Comodo's "intent to use" trademark filings acknowledge that it has never used "Let's Encrypt" as a brand.

On 24 June 2016, Comodo publicly posted in its forum that it had filed for "express abandonment" of their trademark applications.[33]

Comodo's Chief Technical Officer Robin Alden said, "Comodo has filed for express abandonment of the trademark applications at this time instead of waiting and allowing them to lapse. Following collaboration between Let's Encrypt and Comodo, the trademark issue is now resolved and behind us, and we'd like to thank the Let's Encrypt team for helping to bring it to a resolution."[34]

See also

[edit]

References

[edit]
  1. ^ a b "How US entrepreneur's global internet security firm started life in Bradford". Telegraph & Argus. 3 September 2014. Retrieved 3 September 2014.
  2. ^ "Comodo Security Solutions Rebrands to Xcitium". nasdaq. 7 July 2022. Retrieved 7 July 2022.
  3. ^ Fernando, Chris (7 July 2022). "Comodo Security Solutions Rebrands to Xcitium". Retrieved 10 June 2025.
  4. ^ Hallam-Baker, P.; Stradling, R. (2013). "DNS Certification Authority Authorization – Comodo". doi:10.17487/RFC6844. S2CID 46132708. Retrieved 14 January 2013.
  5. ^ "Comodo Sells Certificate Business to Private Equity Firm". SecurityWeek.com. 31 October 2017. Retrieved 29 October 2019.
  6. ^ Murphy, Ian (2 November 2018). "Comodo CA becomes Sectigo and expands to cover IoT". Enterprise Times. Retrieved 21 November 2019.
  7. ^ "Comodo CA launches IoT security platform". BetaNews. 28 June 2018. Retrieved 29 October 2019.
  8. ^ Perry, Jessica (3 July 2018). "Comodo CA global HQ coming to Roseland". NJBIZ. Retrieved 29 October 2019.
  9. ^ Novinson, Michael (16 August 2018). "Comodo CA Buys Website Disaster Recovery Startup CodeGuard". CRN. Retrieved 29 October 2019.
  10. ^ Ellen Messmer (14 February 2013). "Multivendor power council formed to address digital certificate issues". Network World. Archived from the original on 28 July 2013.
  11. ^ "Authentication Security News, Analysis, Discussion, & Community". Darkreading.com. Archived from the original on 10 April 2013. Retrieved 30 March 2015.
  12. ^ "SecurityPark". Archived from the original on 2 April 2015. Retrieved 30 March 2015.
  13. ^ "CA/Browser Forum". Cabforum.org. Retrieved 23 April 2013.
  14. ^ Wilson, Wilson. "CA/Browser Forum History" (PDF). DigiCert. Retrieved 23 April 2013.
  15. ^ "Industry Round Table May 17th 2005 – New York" (PDF). Retrieved 17 May 2005.
  16. ^ a b c d e "Report of incident on 15-MAR-2011: Update 31-MAR-2011". Comodo group. Retrieved 24 March 2011.
  17. ^ "DEF CON 19 - Moxie Marlinspike - SSL And The Future Of Authenticity - YouTube". www.youtube.com. 2 November 2013. Archived from the original on 13 December 2021. Retrieved 13 January 2021.
  18. ^ Hallam-Baker, Phillip (23 March 2011). "The Recent RA Compromise". Comodo Blog. Retrieved 24 March 2011.[permanent dead link]
  19. ^ "Iran accused in 'dire' net security attack". BBC News. 24 March 2011. Retrieved 23 December 2016.
  20. ^ "Update 31-MAR-2011". Retrieved 23 December 2016.
  21. ^ "Update 31-Mar-2011". Retrieved 23 December 2016.
  22. ^ Graham, Robert. "Verifying the Comodo Hacker's key".
  23. ^ Bright, Peter (28 March 2011). "Independent Iranian Hacker Claims Responsibility for Comodo Hack" (WIRED). Wired. Retrieved 29 March 2011.
  24. ^ "ComodoHacker's Pastebin". Pastebin.com. 5 March 2011. Retrieved 30 March 2015.
  25. ^ "Microsoft Security Advisory (2524375)" (Microsoft). Microsoft. 23 March 2011. Retrieved 24 March 2011.
  26. ^ "Microsoft Security Advisory: Fraudulent Digital Certificates could allow spoofing". Microsoft. 23 March 2011. Retrieved 24 March 2011.
  27. ^ "Comodo continue to to[sic] issue certificates to known Malware - May 2009 - Forums".
  28. ^ "Microsoft MVP Mike Burgess Responds To Comodo's CEO On Comodo Certificates Issued To Malware Distributors". Retrieved 23 December 2016.
  29. ^ "Trademark Status & Document Retrieval". tsdr.uspto.gov. Retrieved 23 June 2016.
  30. ^ "Trademark Status & Document Retrieval". tsdr.uspto.gov. Retrieved 23 June 2016.
  31. ^ "Trademark Status & Document Retrieval". tsdr.uspto.gov. Retrieved 23 June 2016.
  32. ^ Tsidulko, Joseph (19 November 2014). "Let's Encrypt, A Free And Automated Certificate Authority, Comes Out Of Stealth Mode". CRN. Retrieved 23 June 2016.
  33. ^ "Topic: Trademark registration". Archived from the original on 8 November 2020. Retrieved 24 June 2016.
  34. ^ "Comodo Stands Down From Trademark Tussle with Let's Encrypt". 27 June 2016. Retrieved 23 December 2016.
[edit]
Retrieved from "https://en.wikipedia.org/w/index.php?title=Xcitium&oldid=1295694100"