full-disclosure - Re: Recent claims that windows update is broken

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Date: Sat, 10 Sep 2011 12:41:50 -0700
From: Dan Kaminsky <dan@...para.com>
To: Georgi Guninski <guninski@...inski.com>
Cc: full-disclosure@...ts.grok.org.uk
Subject: Re: Recent claims that windows update is broken

>
> > For the record, no.  Windows Update doesn't just depend on
> WinVerifyTrust,
> > it also calls CertVerifyCertificateChainPolicy with
> > the CERT_CHAIN_POLICY_MICROSOFT_ROOT flag, documented here:
> >
> > http://msdn.microsoft.com/en-us/library/aa377163(v=vs.85).aspx
> >
> >
> >
>
> By your logic there would be no exploits just because the documentation
> writes so.
>

Nothing's stopping you from hooking CertVerifyCertificateChainPolicy and
seeing for yourself :)  See also:

http://twitter.com/#!/thierryzoller/status/112240979079204864

@thierryzoller: @dakami that finally explains why i didnt succeed in mitm it
few years ago

>
> I bothered to ask mainly for these reasons:
>
> 1. It is unclear to me what collection of private keys/certs Comodohacker
> has
>

He's been hitting certificates that have public interfaces, because as we
know, most public interfaces are terrible.

I do not expect the Microsoft Root to have a public interface.

> 2. From thereg article:
> >Microsoft declined to comment.
>

Microsoft commented rather clearly here:

http://bit.ly/q0JpIT

Attackers are not able to leverage a fraudulent Windows Update certificate
to install malware via the Windows Update servers. The Windows Update client
will only install binary payloads signed by the actual Microsoft root CA
certificate, which is issued and secured by Microsoft. Also, Windows Update
itself is not at risk, even to an attacker with a fraudulent certificate.

Obviously the guy's got all sorts of illicit access.  Just probably not
this.

>
> --
> georgi
>

Content of type "text/html" skipped

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/