Slashdot Mirror
Microsoft Certificate Was Used To Sign Flame Malware
wiredmikey writes "Microsoft disclosed that 'unauthorized digital certificates derived from a Microsoft Certificate Authority' were used to sign components of the recently discovered Flame malware. 'We have discovered through our analysis that some components of the malware have been signed by certificates that allow software to appear as if it was produced by Microsoft,' Microsoft Security Response Center's Jonathan Ness wrote in a blog post. Microsoft is also warning that the same techniques could be leveraged by less sophisticated attackers to conduct more widespread attacks. In response to the discovery, Microsoft released a security advisory detailing steps that organizations should take in order block software signed by the unauthorized certificates, and also released an update to automatically protect customers. Also as part of its response effort, Microsoft said its Terminal Server Licensing Service no longer issues certificates that allow code to be signed."
I kind of thought Microsoft would make damn sure someone else couldn't duplicate their signatures (barring an employee or a government doing it).
Proving once and for all that Microsoft's control of the bootloader key that is used everywhere will make all future computers more secure!
"Microsoft Certificate Was Used To Sign Flame Malware" != "Counterfeit Microsoft Certificate Was Used To Sign Flame Malware"
I think it was an SHS exploit or something in the Windows Kernel. Steve Gibson stepped through the Kernel and concluded that this vulnerability was an intentionally placed backdoor, perhaps by a Microsoft employee. It's in one of his earlier podcasts. Lots of people thought maybe he was crazy at the time, but in retrospect ... maybe not so much.
I thought they were under all kinds of "tough" sanctions? I guess not too tough for Microsoft to make a quick buck selling them their shitty OS!
Attackers broke an old form of security which has been relatively trivially patched. This is actually good for Microsoft, because (ideally) now they will review all of their old authorized keys and determine which would be easier to generate. So it's not like Microsoft included their Private Key in plaintext in some code somewhere, or anything like that.
And this is how they plan to monopolize Secure Boot (UEFI) and get rid of Linux? why should I trust that ONE KEY that microsoft plans to install on all motherboards?
JP
They were totally in on it, and only issuing this advisory to cover their asses.
I wonder how long will it take for the government(s) to decide they in fact own every computer (or at least it's processing capabilities) and issue some sort of mandatory backdoor. As it seems antivirus companies might be first compelled to "go along" with the new paradigm, by probably "not detecting" presence of some (government?!) software (that we oldfashionedly still call "malware", whereas these pieces of code are highly focused towards very specific target, so majority of users/comp. owners should have no problems whatsoever with the sinister part of said software). Indeed, grim future may even be "you should let that piece of software alone, if you have nothing to hide". Weather or not this story has anything to do with the _NSAKEY.
I mean, if an America-hating country is paranoid enough they'll see this as Microsoft cooporating with american interests in order to bring a country down.
Bye Windows, hello home-rolled Dictatubuntu. "Sandbox-testing" just got a whole new meaning ^^
Remove Microsoft from your list of trusted CAs, because their certs can't be trusted.
... (arguably) be the first 0day in Flame. Let's see what is to come.
Considering that microsoft sold the possibility to sign ssl certificates for any domain to the late Tunisian government, why wouldn't they sell the same thing to the makers of that virus, if it really comes from a government?
source: http://arabcrunch.com/2011/09/wikileaks-microsoft-accused-in-helping-bin-ali-monitor-tunisians-corruption-stifling-open-source.html
Flamer is out in the wild since cca. 2007, with a MS signed certificate, and the only IT security organization that decides to bring it to public attention is a Russian company, and the first removal tool is from a Romanian company. Isn't this a bit strange? Isn't it more likely that this NA-designed spyware targetting the Middle East was released with the tacit agreement of Western security companies and it only became known because the Russians, for some reason, decided they would not play the game? Microsoft being unaware for thw last few years that hundreds of computers are infected with a 20 MB spyware pack bearing a security certifice of their own? Come on...
ok i guess that explanes it
What a delicious example of plausible deniability. If you don't believe them, you are paranoid. If you believe them, you have to willingly ignore Microsoft's rapacious, lying history. That it goes beyond what one might expect of incompetence, way off into Scott Adams' accounts of fictitious and roll on the ground laughing galactic screwups, implies that it was planned this way. But of course nobody would willingly do that, it's not even worth commenting about. Even the NSA is not that dumb. Or that smart. Or.. whatever, they are invisible and don't exist except in Hollywod. And when issuing secure linux operating systems.
Massive vulnerability is so massive, it's stupid. Massive corporation is so massive, it is holy. I believe the reason America greatly sucks right now is a fundamental cognitive dissonance. A flaw in the character that worked well in the 19th century but started to fail in the 20th and totally is epically failing in the 21st. It is clearly visible here. It's that Microsoft's greatest core competence, here beautifully demonstrated, is this totally crazy, smirking, malicious stupidity, it is so evil it is good, so hated that it is loved, a fundamental quantum impossibility that comes off as sexy panache on the TV sitcoms, that here simultaneously emphasizes rattle-trap monopoly while self-defusing any possibility of reprisal, and 3, 2, 1 inevitably will lead to greater profitability by emphasizing security in a related announcement.
It is just so hugely mind-bogglingly idiotic or evil you immediately censor yourself from pursuing it while gasping for oxygen. In summary, the country is shot because people love this wacky, profitable, bulletproof juggernaut that just comes back for more. It's the new America. It is how we got into the Iraq war. Never mind that I predicted a similar "wacky reason is invented so we can go clean up and get the oil" war about 5-10 years before it happened. It is really a problem, this megacorp supervulnerable smarmy I'm rubber you're glue, we are pals of the government which is why we can give absolutely brain exploding explanations and everybody has to shut up and eat it. Bruce come out and explain it to those dumb asses! Arrrggghhh!!
It has recently become obvious that spy agencies can get any keys/certificates they need. An obvious way to spread spy software would be to send a poisoned system update, or an update for Adobe, etc. In the end, we have to trust the people who provide software systems, or write everything from scratch (and possibly build the hardware). Is there a usable system that limits the extent to which software creators can take control? Would be nice if there was a system that wasn't constantly tied to an update repository, and the code was reviewed, yet it was still usable.
So... what did we learn today?
1. Signed code is not safe code.
2. An insecure operating system that only runs signed code is still an insecure operating system.
"In prison you just have to shut your eyes and take it. Here you have to shut your eyes and give it."
Cancel your support contracts with the federal government NOW.
It's so strange that about the only posts one sees here anymore are from users with ID#s in the 40,xxx,xxx block.
Yes, registering with MS for $99 (which goes entirely to Verisign) is an insurmountable problem.
If each end user has to do it, then yes, it is insurmountable in practice. It's especially hard for people who disagree with the principles of Norton software, which is sold by the same company that bought Verisign's certificate business.
Why are there two certificates with the exact same label? It takes a special kind of idiot.
"Microsoft Enforced Licensing Intermediate PCA"
Why does a certificate valid from 2002 to 2010 matter in 2012.. oh yea thats right code signing certificates are based on the timestamp of the code and so when you compromise a signing cert 100 years from now and take that impossibly difficult extra step of forging a valid timestamp it will still be valid. All code signing certs should have an indefinate expiration because effectivly thats what they really are. Any other label is grossly misleading.
The security week and MS article talks about forging keys using what I assume are insecure for signature algorithms.. I assume they mean MD5..but hey look at this:
The signature algorithm for Microsoft Enforced Licensing Registration Authority CA (SHA1) is sha1 this is currently what EVERYONE is using. Was this cert also compromised in the same way? Why is it here?
1. - make bloated spy software virus for government
2. - sign it
3. - it's no longer a virus
4. - profit
5. - disclaimer will follow about stollen cert
Red Hat's approach, as the other Slashdot story states, is to have a first stage bootloader load and verify GRUB, and then GRUB loads and verifies Linux, and then Linux loads and verifies modules. This works if you run an official kernel with all official modules but not, as that story's featured article mentions, with "out of tree drivers". If you need to compile a kernel module from source to support hardware whose driver isn't yet in the mainline kernel, then as I understand it, you can't load such a module into a securely booted kernel without paying the $99 VeriNorton tax.
Did you actualy try this, particulary if you ran some 12 year old applications?
disgusting old homos
So other homo's that are into disgusting things can hook up?
My question is, why do you browse that section?
Be seeing you...
How does one obtain a legitimate windows update certificate? are they not well maintained and secured?
Is this an inside job???
I would guess - since 1975 all passwords hardcoded into their systems were billgates