full-disclosure - [Bogus] Microsoft AuthenticodeT webcam viewer plugin

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20031029104152.GA19592@doxdesk.com>
From: and-bugtraq at doxdesk.com (Andrew Clover)
Subject: [Bogus] Microsoft AuthenticodeT webcam viewer plugin

Nick FitzGerald <nick@...us-l.demon.co.uk> wrote:

> FWIW, I think the biggest "problem" here is that a CA (Thawte in this 
> case) allows code-signing certificates with such ambiguous "names" as 
> "Browser Plugin"

They also have a very limited interpretation of "malicious code". Thawte
have refused to revoke certs issued to firms spreading homepage hijackers,
spyware and commercial RATs. Unless it actually formats your hard disc,
they do not, apparently, consider it malicious.

> Would they allow a cert in the company name "IE Plugins" too?

See for yourself. www.ieplugin.com

Given the ease of creating a misleading company name, and the unwillingness
of CAs to police abuse of their certs, one can only conclude that the
Authenticode process is 100% useless as a means of ensuring code is
trustworthy.

-- 
Andrew Clover
mailto:and@...desk.com
http://www.doxdesk.com/