Slashdot Mirror
Microsoft Revokes Trust In 28 of Its Own Certificates
Trailrunner7 writes "In the wake of the Flame malware attack, which involved the use of a fraudulent Microsoft digital certificate, the software giant has reviewed its certificates, found nearly 30 that aren't as secure as the company would like, and revoked them. Microsoft also released its new updater for certificates as a critical update for Windows Vista and later versions as part of today's July Patch Tuesday. Microsoft has not said exactly what the now-untrusted certificates were used for, but company officials said there were a total of 28 certificates affected by the move. However, the company said it was confident none of them had been compromised or used maliciously. The move to revoke trust in these certificates is a direct result of the investigation into the Flame malware and how the attackers were able to forge a Microsoft certificate and then use it to impersonate a Windows Update server."
That's what you get when you leave valuable certificates near open flames.
Everything is better with chainsaws.
I'm hardly a Microsoft fan, but good! They seem to be taking a proactive approach here.
For large sets, this will be our guide even unto death, for the LORD will work for each type of data it is applied to...
If they were able to fake a Windows update server, it'd have to to be as effective as an inside job.
Microsoft Revokes Trust In 28 of Its Own Certificates
Old news. I revoked my trust in Microsoft over a decade ago...
There's no place like
The centrifuge operators in Iran may beg to differ..
Thats the whole point of this, they replaced old certificates with new ones that don't use MD5.
if, a few years into the future, somebody dusts off an old copy of Windows Vista/7 and runs an update. Will that version of Vista/7 still update? Will it still work?
I'm asking because of this whole business with certificate revocation. Obviously, to revoke a certificate "successfully" without inconveniencing users, you have to update users' systems to the new certificate using the old one. This has obvious consequences for the maintainance of Secure Boot-enabled systems.
Microsoft also released its new updater for certificates as a critical update for Windows Vista and later versions as part of today's July Patch Tuesday. ... and how the attackers were able to forge a Microsoft certificate and then use it to impersonate a Windows Update server."
So, to protect users from potentially trusting a fake Windows Update server, Microsoft is releasing this update through a Windows Update server, which potentially could be fake? I suppose that if your computer already trusts a fake server, it is too late. However, I wish Microsoft would go back to providing downloadable updates that didn't depend on Windows Update.
Request a Linux Shockwave player here: http://www.macromedia.com/support/email/wishform/
I would hardly call it proactive, they have just discarded all the certs that would have been considered insecure a couple of years ago. A company that promotes "trusted computing" should have done this when they were found to be insecure.
The proactive approach would be to upgrade all certs to 2048 bits so they will be as good as current best standardized strength*. This is just removing those that they would consider insecure MD5 and less than 1024 bits. This is bear minimum to try and mitigate the damage.
*they could beet most Linux distros to do this completely.
I've been away from /. for awhile, so seeing the MS corporate logo in place of the familiar Gates-Borg icon came as a bit of a shock.
When did our dear leaders get rid it? What possible reason, aside from a desire to be more bland, could they have?
The English word fart is one of the oldest words in the English vocabulary.