Re: [Full-disclosure] Recent claims that windows update is broken

[Dan Kaminsky <dan@xxxxxxxxxxx>]

>
> > For the record, no.  Windows Update doesn't just depend on
> WinVerifyTrust,
> > it also calls CertVerifyCertificateChainPolicy with
> > the CERT_CHAIN_POLICY_MICROSOFT_ROOT flag, documented here:
> >
> > http://msdn.microsoft.com/en-us/library/aa377163(v=vs.85).aspx
> >
> >
> >
>
> By your logic there would be no exploits just because the documentation
> writes so.
>

Nothing's stopping you from hooking CertVerifyCertificateChainPolicy and
seeing for yourself :)  See also:

http://twitter.com/#!/thierryzoller/status/112240979079204864

@thierryzoller: @dakami that finally explains why i didnt succeed in mitm it
few years ago


>
> I bothered to ask mainly for these reasons:
>
> 1. It is unclear to me what collection of private keys/certs Comodohacker
> has
>

He's been hitting certificates that have public interfaces, because as we
know, most public interfaces are terrible.

I do not expect the Microsoft Root to have a public interface.


> 2. From thereg article:
> >Microsoft declined to comment.
>

Microsoft commented rather clearly here:

http://bit.ly/q0JpIT

Attackers are not able to leverage a fraudulent Windows Update certificate
to install malware via the Windows Update servers. The Windows Update client
will only install binary payloads signed by the actual Microsoft root CA
certificate, which is issued and secured by Microsoft. Also, Windows Update
itself is not at risk, even to an attacker with a fraudulent certificate.

Obviously the guy's got all sorts of illicit access.  Just probably not
this.

>
> --
> georgi
>

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/