Re: [Full-disclosure] Recent claims that windows update is broken
On Fri, Sep 09, 2011 at 03:09:25PM -0700, Dan Kaminsky wrote: On Thu, Sep 8, 2011 at 2:55 AM, Georgi Guninski gunin...@guninski.comwrote: http://www.theregister.co.uk/2011/09/07/diginotar_hacker_proof/ I'm able to issue windows update, he [Comodohacker] wrote. Microsoft's statement about Windows Update and that I can't issue such update is totally false! The original Comodohacker statement is at: http://pastebin.com/85WV10EL Is this true? For the record, no. Windows Update doesn't just depend on WinVerifyTrust, it also calls CertVerifyCertificateChainPolicy with the CERT_CHAIN_POLICY_MICROSOFT_ROOT flag, documented here: http://msdn.microsoft.com/en-us/library/aa377163(v=vs.85).aspx By your logic there would be no exploits just because the documentation writes so. I bothered to ask mainly for these reasons: 1. It is unclear to me what collection of private keys/certs Comodohacker has 2. From thereg article: Microsoft declined to comment. -- georgi ___ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
Re: [Full-disclosure] Recent claims that windows update is broken
For the record, no. Windows Update doesn't just depend on WinVerifyTrust, it also calls CertVerifyCertificateChainPolicy with the CERT_CHAIN_POLICY_MICROSOFT_ROOT flag, documented here: http://msdn.microsoft.com/en-us/library/aa377163(v=vs.85).aspx By your logic there would be no exploits just because the documentation writes so. Nothing's stopping you from hooking CertVerifyCertificateChainPolicy and seeing for yourself :) See also: http://twitter.com/#!/thierryzoller/status/112240979079204864 @thierryzoller: @dakami that finally explains why i didnt succeed in mitm it few years ago I bothered to ask mainly for these reasons: 1. It is unclear to me what collection of private keys/certs Comodohacker has He's been hitting certificates that have public interfaces, because as we know, most public interfaces are terrible. I do not expect the Microsoft Root to have a public interface. 2. From thereg article: Microsoft declined to comment. Microsoft commented rather clearly here: http://bit.ly/q0JpIT Attackers are not able to leverage a fraudulent Windows Update certificate to install malware via the Windows Update servers. The Windows Update client will only install binary payloads signed by the actual Microsoft root CA certificate, which is issued and secured by Microsoft. Also, Windows Update itself is not at risk, even to an attacker with a fraudulent certificate. Obviously the guy's got all sorts of illicit access. Just probably not this. -- georgi ___ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
Re: [Full-disclosure] Recent claims that windows update is broken
On Thu, Sep 8, 2011 at 2:55 AM, Georgi Guninski gunin...@guninski.comwrote: http://www.theregister.co.uk/2011/09/07/diginotar_hacker_proof/ I'm able to issue windows update, he [Comodohacker] wrote. Microsoft's statement about Windows Update and that I can't issue such update is totally false! The original Comodohacker statement is at: http://pastebin.com/85WV10EL Is this true? For the record, no. Windows Update doesn't just depend on WinVerifyTrust, it also calls CertVerifyCertificateChainPolicy with the CERT_CHAIN_POLICY_MICROSOFT_ROOT flag, documented here: http://msdn.microsoft.com/en-us/library/aa377163(v=vs.85).aspx -- joro ___ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/ ___ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
Re: [Full-disclosure] Recent claims that windows update is broken
I don't think anyone actually believed this; It sounded more like Joro was trolling on behalf of the blog monkeys :) It really does make me wonder if the publish-whatever-we-see-posted-elsewhere-while-abandoning-journalistic-integrity-to-drive-ad-clicks model is actually working for these people. I suppose it must be, otherwise these guys wouldn't be selling off little pieces of their soul with each article. t From: full-disclosure-boun...@lists.grok.org.uk [mailto:full-disclosure-boun...@lists.grok.org.uk] On Behalf Of Dan Kaminsky Sent: Friday, September 09, 2011 3:09 PM To: Georgi Guninski Cc: full-disclosure@lists.grok.org.uk Subject: Re: [Full-disclosure] Recent claims that windows update is broken On Thu, Sep 8, 2011 at 2:55 AM, Georgi Guninski gunin...@guninski.commailto:gunin...@guninski.com wrote: http://www.theregister.co.uk/2011/09/07/diginotar_hacker_proof/ I'm able to issue windows update, he [Comodohacker] wrote. Microsoft's statement about Windows Update and that I can't issue such update is totally false! The original Comodohacker statement is at: http://pastebin.com/85WV10EL Is this true? For the record, no. Windows Update doesn't just depend on WinVerifyTrust, it also calls CertVerifyCertificateChainPolicy with the CERT_CHAIN_POLICY_MICROSOFT_ROOT flag, documented here: http://msdn.microsoft.com/en-us/library/aa377163(v=vs.85).aspx -- joro ___ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/ ___ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
Re: [Full-disclosure] Recent claims that windows update is broken
Journalistic integrity? Such anachronism, Thor; and quite a surprise coming from you. This is the Internet circa 2011 + Humanity circa Anytime. Nothing more can be expected from a bunch of unwashed monkeys with keyboards lacking the talent to truly create. On 09/10/2011 10:20 AM, Thor (Hammer of God) wrote: I don’t think anyone actually believed this; It sounded more like Joro was trolling on behalf of the blog monkeys J It really does make me wonder if the publish-whatever-we-see-posted-elsewhere-while-abandoning-journalistic-integrity-to-drive-ad-clicks model is actually working for these people. I suppose it must be, otherwise these guys wouldn’t be selling off little pieces of their soul with each article. t *From:*full-disclosure-boun...@lists.grok.org.uk [mailto:full-disclosure-boun...@lists.grok.org.uk] *On Behalf Of *Dan Kaminsky *Sent:* Friday, September 09, 2011 3:09 PM *To:* Georgi Guninski *Cc:* full-disclosure@lists.grok.org.uk *Subject:* Re: [Full-disclosure] Recent claims that windows update is broken On Thu, Sep 8, 2011 at 2:55 AM, Georgi Guninski gunin...@guninski.com mailto:gunin...@guninski.com wrote: http://www.theregister.co.uk/2011/09/07/diginotar_hacker_proof/ I'm able to issue windows update, he [Comodohacker] wrote. Microsoft's statement about Windows Update and that I can't issue such update is totally false! The original Comodohacker statement is at: http://pastebin.com/85WV10EL Is this true? For the record, no. Windows Update doesn't just depend on WinVerifyTrust, it also calls CertVerifyCertificateChainPolicy with the CERT_CHAIN_POLICY_MICROSOFT_ROOT flag, documented here: http://msdn.microsoft.com/en-us/library/aa377163(v=vs.85).aspx -- joro ___ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/ ___ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/ ___ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
[Full-disclosure] Recent claims that windows update is broken
http://www.theregister.co.uk/2011/09/07/diginotar_hacker_proof/ I'm able to issue windows update, he [Comodohacker] wrote. Microsoft's statement about Windows Update and that I can't issue such update is totally false! The original Comodohacker statement is at: http://pastebin.com/85WV10EL Is this true? -- joro ___ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
Re: [Full-disclosure] Recent claims that windows update is broken
The original Comodohacker statement is at: http://pastebin.com/85WV10EL Is this true? In his world, I'm sure it is. t ___ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
