full-disclosure - Re: MS-02-052

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <20020920202159.9497.qmail@propane.zoomph.net>
From: dev-null at no-id.com (dev-null@...id.com)
Subject: Re: MS-02-052

(I am the original poster of this thread)
My main problem was that the only place to obtain the patch attempted to d/l and install an *unsigned* ActiveX control that is required to use Windows Update.  Microsoft, it seems, have quietly replaced this with a signed control (however, the chain of trust only goes up to Microsoft Root Authority.)

The real nut-kicker in all this is the text on the Windows Update page that tells the user to "select YES in any "Security Warning" dialog boxes that appear".  Since the dialog to install a control always has a title of "Security Warning" whether the control is signed or not, Microsoft's instructions circumvent the whole point of code signing.  

I still have no idea whether the unsigned control of 2 days ago was legitimate or a trojan (I chose not to install it), and presumably MS isn't going to tell us.

--
This message has been sent via an anonymous mail relay at www.no-id.com.