Slashdot Mirror
Microsoft Revokes Trust In 28 of Its Own Certificates
Trailrunner7 writes "In the wake of the Flame malware attack, which involved the use of a fraudulent Microsoft digital certificate, the software giant has reviewed its certificates, found nearly 30 that aren't as secure as the company would like, and revoked them. Microsoft also released its new updater for certificates as a critical update for Windows Vista and later versions as part of today's July Patch Tuesday. Microsoft has not said exactly what the now-untrusted certificates were used for, but company officials said there were a total of 28 certificates affected by the move. However, the company said it was confident none of them had been compromised or used maliciously. The move to revoke trust in these certificates is a direct result of the investigation into the Flame malware and how the attackers were able to forge a Microsoft certificate and then use it to impersonate a Windows Update server."
That's what you get when you leave valuable certificates near open flames.
Everything is better with chainsaws.
I'm hardly a Microsoft fan, but good! They seem to be taking a proactive approach here.
For large sets, this will be our guide even unto death, for the LORD will work for each type of data it is applied to...
The sooner the better. Lets hope malware writers get on with it.
This is bad...why?
Isn't this precisely why revokable ceritificates are a good idea? We learn more about possible flaws in the underlying crypto, we determine something is weaker than we thought, and we can revoke the cert before it's compromised.
We complain about Microsoft doing the RIGHT thing now?
If they were able to fake a Windows update server, it'd have to to be as effective as an inside job.
...their new program of innovation.
Great, let's rely on them to secure all BIOS as well.
Didn't the whole attack hinge on a hash collision of an algorithm that's thought to be probably insecure and obsolete for years? (md5).. That, and it was implemented weakly in the first place?
So when are we going to see md5 replaced by a more secure method? (sha1?)
Microsoft Revokes Trust In 28 of Its Own Certificates
Old news. I revoked my trust in Microsoft over a decade ago...
There's no place like
The centrifuge operators in Iran may beg to differ..
Secure boot - Ha!
This is a Microsoft nightmare waiting to happen...
CAPTCHA = installs (amazing! How does it know!)
Then they would be on to something.
XP (and early) users beware!
Thats the whole point of this, they replaced old certificates with new ones that don't use MD5.
if, a few years into the future, somebody dusts off an old copy of Windows Vista/7 and runs an update. Will that version of Vista/7 still update? Will it still work?
I'm asking because of this whole business with certificate revocation. Obviously, to revoke a certificate "successfully" without inconveniencing users, you have to update users' systems to the new certificate using the old one. This has obvious consequences for the maintainance of Secure Boot-enabled systems.
Will Microsoft look into the theory that a government did this and take legal action if proof is obtained?
I would hope they would.
Microsoft also released its new updater for certificates as a critical update for Windows Vista and later versions as part of today's July Patch Tuesday. ... and how the attackers were able to forge a Microsoft certificate and then use it to impersonate a Windows Update server."
So, to protect users from potentially trusting a fake Windows Update server, Microsoft is releasing this update through a Windows Update server, which potentially could be fake? I suppose that if your computer already trusts a fake server, it is too late. However, I wish Microsoft would go back to providing downloadable updates that didn't depend on Windows Update.
Request a Linux Shockwave player here: http://www.macromedia.com/support/email/wishform/
I would hardly call it proactive, they have just discarded all the certs that would have been considered insecure a couple of years ago. A company that promotes "trusted computing" should have done this when they were found to be insecure.
The proactive approach would be to upgrade all certs to 2048 bits so they will be as good as current best standardized strength*. This is just removing those that they would consider insecure MD5 and less than 1024 bits. This is bear minimum to try and mitigate the damage.
*they could beet most Linux distros to do this completely.
"The move to revoke trust in these certificates is a direct result of the investigation into the Flame malware and how the attackers were able to forge a Microsoft certificate and then use it to impersonate a Windows Update server."
Umm, isn't it known how they did it? it is my understanding that the forged certs were using MD5 which is easily broken. US-CERT said in 2008 that "MD5 should be considered cryptographically broken and unsuitable for further use."
So, what's the mystery?
I've been away from /. for awhile, so seeing the MS corporate logo in place of the familiar Gates-Borg icon came as a bit of a shock.
When did our dear leaders get rid it? What possible reason, aside from a desire to be more bland, could they have?
The English word fart is one of the oldest words in the English vocabulary.
Having had to support Microsoft junk for over 15 years, the cynic in me screams that this was a reactive approach.
So, to protect users from potentially trusting a fake Windows Update server, Microsoft is releasing this update through a Windows Update server, which potentially could be fake? I suppose that if your computer already trusts a fake server, it is too late
This is not a fix for machines already pwned. It is a precautionary step to foil copycats (or the original attacker returning with a new kit). If a machine gets this update it will be immunized to attacks using these certs. You are correct that if a machine is already pwned or on a net with a fake WU server, that WU server could block this update to remain in the loop. This was never billed as a solution for that problem, however. If you suspect that your machine is pwned though a sophisticated attack like the Flame you really need to nuke it from orbit.
However, I wish Microsoft would go back to providing downloadable updates that didn't depend on Windows Update.
Ahem. Microsoft releases all updates as separately downloadable packages. Windows Update / Microsoft Update is merely a delivery mechanism. The knowledge base article (with download links) for this particular one is found here: http://support.microsoft.com/kb/2728973
Reading slashdot one-liner: (irm http://rss.slashdot.org/Slashdot/slashdot).rdf.item | fl title,desc*
This isn't the first time that a trusted software update mechanism has been used for state sponsored pwnage: SK Hack by an Advanced Persistent Threat
In some cases revoking certificates doesn't seem to be an effective response either, with hackers continuing to use malicious code signed prior to the certificate revocation date: Command and Control in the Fifth Domain (see page 3)
also certified by the NSA. Just like the old ones.
If they're doing this because of that Flame thingy, how is this going to affect how I play Angry Birds?!?!?!
UTF-8: There and Back Again
why didn't microsoft release those three certificates which were supposedly forged and these 28 new certificates?
it's the only way to prove they were not legitimate certificates.
This is not a fix for machines already pwned. It is a precautionary step to foil copycats
I figured as much. I just thought the loop was funny...
Microsoft releases all updates as separately downloadable packages.
I see that this patch does offer an executable download. However, not all patches are available as executables. I'm not on the machine now. So I'm not sure of the patch numbers. However, I have a Vista machine that has 2 security updates, from May, permanently stuck in an install loop. They successfully install about every 10 minutes. I tried several solutions. Microsoft has a FixIt application that told me Windows Update needed to be repaired. It claims to fix it every time it is run. However, the problem does not go away. So I tried to find the downloadable version of the update to see if installing it in Safe Mode would work. No Go. The only file available for download was a .msu file. Unfortunately, msu files require that Windows Update be running with an active network connection. They do not work in Safe Mode. At this point I think a reinstall is needed. However, Vista is a major pain. If I have to reinstall, I'm putting XP back on the machine.
Request a Linux Shockwave player here: http://www.macromedia.com/support/email/wishform/
"found nearly 30"
"found 28"
One of those is more concise, more informative and doesn't attempt to exaggerate by increasing the first digit (which people pay the most attention to) for no reason.