Full Disclosure mailing list archives
Re: Recent claims that windows update is broken
From: Dan Kaminsky <dan () doxpara com>
Date: Sat, 10 Sep 2011 12:41:50 -0700
For the record, no. Windows Update doesn't just depend onWinVerifyTrust,it also calls CertVerifyCertificateChainPolicy with the CERT_CHAIN_POLICY_MICROSOFT_ROOT flag, documented here: http://msdn.microsoft.com/en-us/library/aa377163(v=vs.85).aspxBy your logic there would be no exploits just because the documentation writes so.
Nothing's stopping you from hooking CertVerifyCertificateChainPolicy and seeing for yourself :) See also: http://twitter.com/#!/thierryzoller/status/112240979079204864 @thierryzoller: @dakami that finally explains why i didnt succeed in mitm it few years ago
I bothered to ask mainly for these reasons: 1. It is unclear to me what collection of private keys/certs Comodohacker has
He's been hitting certificates that have public interfaces, because as we know, most public interfaces are terrible. I do not expect the Microsoft Root to have a public interface.
2. From thereg article:Microsoft declined to comment.
Microsoft commented rather clearly here: http://bit.ly/q0JpIT Attackers are not able to leverage a fraudulent Windows Update certificate to install malware via the Windows Update servers. The Windows Update client will only install binary payloads signed by the actual Microsoft root CA certificate, which is issued and secured by Microsoft. Also, Windows Update itself is not at risk, even to an attacker with a fraudulent certificate. Obviously the guy's got all sorts of illicit access. Just probably not this.
-- georgi
_______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
Current thread:
- Recent claims that windows update is broken Georgi Guninski (Sep 08)
- Re: Recent claims that windows update is broken Thor (Hammer of God) (Sep 08)
- Re: Recent claims that windows update is broken Dan Kaminsky (Sep 09)
- Re: Recent claims that windows update is broken Thor (Hammer of God) (Sep 09)
- Re: Recent claims that windows update is broken 夜神 岩男 (Sep 09)
- Re: Recent claims that windows update is broken Georgi Guninski (Sep 10)
- Re: Recent claims that windows update is broken Dan Kaminsky (Sep 10)
- Re: Recent claims that windows update is broken Thor (Hammer of God) (Sep 09)