7 ms·

A critical Windows component expires in 25 hours

276 points by svenfaw 11y ago

Retr0spectrum 11y ago
Can anyone else confirm this?
- maaarghk 11y ago
  well, running the command gives this: Microsoft Windows [Version 10.0.10240] (c) 2015 Microsoft Corporation. All rights reserved. C:\WINDOWS\system32>certutil -verifyCTL disallowed LastSyncTime = "22/09/2015 13:53" [DisallowedCTL] ListIdentifier = "DisallowedCert_AutoUpdate_1" SequenceNumber = 01d065c00c3f1258 ThisUpdate = "24/03/2015 00:21" NextUpdate = EMPTY SubjectAlgorithm = 1.3.6.1.4.1.311.10.11.15, "disallowedHash" SignerExpiration = "23/09/2015 21:36", "1.0 Days" WARNING = "SignerExpiration: Less than 180 Days" CTLEntries = 57 The system cannot find the file specified. 0x80070002 (WIN32: 2 ERROR_FILE_NOT_FOUND) -- http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcert.sst MissingCerts = 57 but I know nothing about the implications. It also looks like the file has the possibility to be downloaded from msft on the fly?
- AaronFriel 11y ago
  I have no idea of potential impact, but the command run on an up-to-date Windows 10 system reports: > certutil -verifyCTL disallowed LastSyncTime = "9/22/2015 9:33 AM" [DisallowedCTL] ListIdentifier = "DisallowedCert_AutoUpdate_1" SequenceNumber = 01d065c00c3f1258 ThisUpdate = "3/23/2015 6:21 PM" NextUpdate = EMPTY SubjectAlgorithm = 1.3.6.1.4.1.311.10.11.15, "disallowedHash" SignerExpiration = "9/23/2015 3:36 PM", "1.0 Days" WARNING = "SignerExpiration: Less than 180 Days" CTLEntries = 57 The system cannot find the file specified. 0x80070002 (WIN32: 2 ERROR_FILE_NOT_FOUND) -- http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcert.sst MissingCerts = 57
  - deleted 11y ago
    [deleted]
  - shlorn 11y ago
    Can confirm, getting similar output on Windows 10.0.10240. Although url is working works in chrome. Could this be a bug in the certutil updater?
- orf 11y ago
  (endpoint) C:\Users\orf λ certutil -verifyCTL disallowed | head LastSyncTime = "22/09/2015 18:24" [DisallowedCTL] ListIdentifier = "DisallowedCert_AutoUpdate_1" SequenceNumber = 01d065c00c3f1258 ThisUpdate = "24/03/2015 00:21" NextUpdate = EMPTY SubjectAlgorithm = 1.3.6.1.4.1.311.10.11.15, "disallowedHash" SignerExpiration = "23/09/2015 21:36", "1.0 Days" WARNING = "SignerExpiration: Less than 180 Days" CTLEntries = 57 Then a whole load of entries like: [f69d22ae1ed615b1b9e390e310bbbb31] CertId = 1.3.6.1.4.1.311.10.11.0 Subject = "MISSING_CERTIFICATE"
- GaryGapinski 11y ago
  As of a short while ago (times are US/Eastern): C:\Users\gapinski>certutil -verifyCTL disallowed|more LastSyncTime = "9/23/2015 3:33 AM" [DisallowedCTL] ListIdentifier = "DisallowedCert_AutoUpdate_1" SequenceNumber = 01d0f584a9ad12f7 ThisUpdate = "9/22/2015 6:18 PM" NextUpdate = EMPTY SubjectAlgorithm = 1.3.6.1.4.1.311.10.11.15, "disallowedHash" SignerExpiration = "8/14/2016 1:13 PM", "326.4 Days" CTLEntries = 57 …
3Pi 11y ago
Just a note: Your GMT date is wrong - should be 22, not 23. Apart from that, sounds scary.
- mparlane 11y ago
  I'm not sure it explains the last auto update check time for the trusted CTL ;)
cammsaul 11y ago
So the Untrusted CTL has an expiration of 25 hours. Your screenshot says "Did you know? ... the Untrusted CTL is updated once per day". Doesn't that explain it?
- deleted 11y ago
  [deleted]
- Implicated 11y ago
  I was asking myself the same question.
- BHSPitMonkey 11y ago
  In the screenshot, it says that CTL was last modified in March. Judging by the date, I'd guess it has an expiration of 6 months after it is issued. So, it's been nearly 6 months since the daily updates stopped occurring.
  - geofft 11y ago
    Is that the time it was last modified or the time it was last signed? The last high-profile mis-issued cert was last week, and didn't even escape the control of people who were entrusted with the CA private key. So MS might not even be manually revoking it. Before that, the last blog post on googleonlinesecurity.blogspot.com about a mis-issued certificate was ... March 23. I would guess that it's re-signed daily, but only changes when there's an actual change to be made.
    - geofft 11y ago
      Following up: if anyone wants to poke around at the file, the download URL is http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab http://ctldl.windowsupdate.com/msdownload/update/v3/static/t... , a CAB archive that contains a single file disallowedcert.stl. That file itself is DER-formatted ASN.1, evidently a PKCS7-signed "Certificate Trust List" (1.3.6.1.4.1.311.10.1). `openssl asn1parse -inform der -in disallowedcert.stl` reads it just fine. There's a reference to the date 150923203626Z (2015-09-23 20:36:26 UTC) somewhere in there, but I'm having trouble figuring out what it applies to.
castratikron 11y ago
Why does the app say you're at risk if the certificate is still valid, and why does it say that the last check for one of the lists in the future? Feels like the usual crypto-fearmongering to me.
mtgx 11y ago
When is Microsoft going to adopt Certificate Transparency anyway? Google, Mozilla and Apple all support it already.
- Someone1234 11y ago
  > Mozilla and Apple all support it already. Do you have a source? As far as I know that is not accurate.
  - iancarroll 11y ago
    This is unrelated to CT; this would still be needed to kill any maliciously issued certificates. Apple has App Transport Security which allows you to require CT. I think the OP meant Google, as the patch[1] for CT is still pending in Firefox. [1] https://bugzilla.mozilla.org/show_bug.cgi?id=944175 https://bugzilla.mozilla.org/show_bug.cgi?id=944175
    - mtgx 11y ago
      Right. What I meant was actually that they either support it or are in the process of supporting it. But I haven't heard anything about it from Microsoft.
tedunangst 11y ago
> I can't accurately foresee what is going to happen in 25 hours Set the clock forward and see?
- Zoneman 11y ago
  I believe this is less about what one individual computer would do and more about what could happen to the millions of Windows users facing this problem in 25 hours.
  - tedunangst 11y ago
    Finding out what happens to one computer seems like a better start to informed speculation about millions of other computers than not finding out. Sure, it's no guarantee they're all the same, but we can more reasonably discuss whether the observed effects are plausibly widespread after observation...
    - iancarroll 11y ago
      I think the sentence was meant to imply MSFT might see this issue before the clock hits doomsday.
      - taspeotis 11y ago
        Microsoft has some experience with expired certificates [1]. [1] https://azure.microsoft.com/en-us/blog/windows-azure-service-disruption-from-expired-certificate/ https://azure.microsoft.com/en-us/blog/windows-azure-service...
- wslh 11y ago
  More technically: hook the time functions for that application only.
maurice2k 11y ago
Last autoupdate check on 2015-09-26 ... IN THE FUTURE? THE LAST ONE?
- svenfaw 11y ago
  Note to self: Do not take screenshots from the future.
  - tomaskafka 11y ago
    could you open lottery numbers page in the background and post another screenshot, just for clarity?
chris_wot 11y ago
I'm trying to get my head around what a CTL is anyway. I might be tired and a bit hungry (never helps my cognitive processes) but I was struggling to understand the Microsoft article I found here: https://msdn.microsoft.com/en-us/library/windows/desktop/aa376545(v=vs.85).aspx https://msdn.microsoft.com/en-us/library/windows/desktop/aa3...
Siez_ 11y ago
Windows has been automagically updating CTLs for a while now. Next one probably doesn't get swapped in until the old expires unless there's actual new entries added to the pre-existing one.
jagermo 11y ago
It just updated tonight, it seems Edit: ListIdentifier = "DisallowedCert_AutoUpdate_1" SequenceNumber = 01d0f584a9ad12f7 ThisUpdate = "23.09.2015 00:18" NextUpdate = LEER SubjectAlgorithm = 1.3.6.1.4.1.311.10.11.15, "disallowedHash" SignerExpiration = "14.08.2016 19:13", "326,3 Days" CTLEntries = 57 Das System kann die angegebene Datei nicht finden. 0x80070002 (WIN32: 2 ERROR_FI LE_NOT_FOUND) -- http://ctldl.windowsupdate.com/msdownload/update/v3/static/trus http://ctldl.windowsupdate.com/msdownload/update/v3/static/t... tedr/en/disallowedcertstl.sst MissingCerts = 57 yesterday it told me that it wasn't updated since 180 days.
- svenfaw 11y ago
  Can you post a screenshot? "Updated" can mean different things in this context. For the issue to be resolved, Microsoft also has to update the signing certificate itself, which it hasn't done for the last 15 months. Edit: Confirmed! Blog post updated.

276 points by svenfaw 11y ago

Retr0spectrum 11y ago

Can anyone else confirm this?

maaarghk 11y ago
well, running the command gives this: Microsoft Windows [Version 10.0.10240] (c) 2015 Microsoft Corporation. All rights reserved. C:\WINDOWS\system32>certutil -verifyCTL disallowed LastSyncTime = "22/09/2015 13:53" [DisallowedCTL] ListIdentifier = "DisallowedCert_AutoUpdate_1" SequenceNumber = 01d065c00c3f1258 ThisUpdate = "24/03/2015 00:21" NextUpdate = EMPTY SubjectAlgorithm = 1.3.6.1.4.1.311.10.11.15, "disallowedHash" SignerExpiration = "23/09/2015 21:36", "1.0 Days" WARNING = "SignerExpiration: Less than 180 Days" CTLEntries = 57 The system cannot find the file specified. 0x80070002 (WIN32: 2 ERROR_FILE_NOT_FOUND) -- http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcert.sst MissingCerts = 57 but I know nothing about the implications. It also looks like the file has the possibility to be downloaded from msft on the fly?
AaronFriel 11y ago
I have no idea of potential impact, but the command run on an up-to-date Windows 10 system reports: > certutil -verifyCTL disallowed LastSyncTime = "9/22/2015 9:33 AM" [DisallowedCTL] ListIdentifier = "DisallowedCert_AutoUpdate_1" SequenceNumber = 01d065c00c3f1258 ThisUpdate = "3/23/2015 6:21 PM" NextUpdate = EMPTY SubjectAlgorithm = 1.3.6.1.4.1.311.10.11.15, "disallowedHash" SignerExpiration = "9/23/2015 3:36 PM", "1.0 Days" WARNING = "SignerExpiration: Less than 180 Days" CTLEntries = 57 The system cannot find the file specified. 0x80070002 (WIN32: 2 ERROR_FILE_NOT_FOUND) -- http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcert.sst MissingCerts = 57
- deleted 11y ago
  [deleted]
- shlorn 11y ago
  Can confirm, getting similar output on Windows 10.0.10240. Although url is working works in chrome. Could this be a bug in the certutil updater?
orf 11y ago
(endpoint) C:\Users\orf λ certutil -verifyCTL disallowed | head LastSyncTime = "22/09/2015 18:24" [DisallowedCTL] ListIdentifier = "DisallowedCert_AutoUpdate_1" SequenceNumber = 01d065c00c3f1258 ThisUpdate = "24/03/2015 00:21" NextUpdate = EMPTY SubjectAlgorithm = 1.3.6.1.4.1.311.10.11.15, "disallowedHash" SignerExpiration = "23/09/2015 21:36", "1.0 Days" WARNING = "SignerExpiration: Less than 180 Days" CTLEntries = 57 Then a whole load of entries like: [f69d22ae1ed615b1b9e390e310bbbb31] CertId = 1.3.6.1.4.1.311.10.11.0 Subject = "MISSING_CERTIFICATE"
GaryGapinski 11y ago
As of a short while ago (times are US/Eastern): C:\Users\gapinski>certutil -verifyCTL disallowed|more LastSyncTime = "9/23/2015 3:33 AM" [DisallowedCTL] ListIdentifier = "DisallowedCert_AutoUpdate_1" SequenceNumber = 01d0f584a9ad12f7 ThisUpdate = "9/22/2015 6:18 PM" NextUpdate = EMPTY SubjectAlgorithm = 1.3.6.1.4.1.311.10.11.15, "disallowedHash" SignerExpiration = "8/14/2016 1:13 PM", "326.4 Days" CTLEntries = 57 …

3Pi 11y ago

Just a note: Your GMT date is wrong - should be 22, not 23. Apart from that, sounds scary.

mparlane 11y ago
I'm not sure it explains the last auto update check time for the trusted CTL ;)

cammsaul 11y ago

So the Untrusted CTL has an expiration of 25 hours. Your screenshot says "Did you know? ... the Untrusted CTL is updated once per day". Doesn't that explain it?

deleted 11y ago
[deleted]
Implicated 11y ago
I was asking myself the same question.
BHSPitMonkey 11y ago
In the screenshot, it says that CTL was last modified in March. Judging by the date, I'd guess it has an expiration of 6 months after it is issued. So, it's been nearly 6 months since the daily updates stopped occurring.
- geofft 11y ago
  Is that the time it was last modified or the time it was last signed? The last high-profile mis-issued cert was last week, and didn't even escape the control of people who were entrusted with the CA private key. So MS might not even be manually revoking it. Before that, the last blog post on googleonlinesecurity.blogspot.com about a mis-issued certificate was ... March 23. I would guess that it's re-signed daily, but only changes when there's an actual change to be made.
  - geofft 11y ago
    Following up: if anyone wants to poke around at the file, the download URL is http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab http://ctldl.windowsupdate.com/msdownload/update/v3/static/t... , a CAB archive that contains a single file disallowedcert.stl. That file itself is DER-formatted ASN.1, evidently a PKCS7-signed "Certificate Trust List" (1.3.6.1.4.1.311.10.1). `openssl asn1parse -inform der -in disallowedcert.stl` reads it just fine. There's a reference to the date 150923203626Z (2015-09-23 20:36:26 UTC) somewhere in there, but I'm having trouble figuring out what it applies to.

castratikron 11y ago

Why does the app say you're at risk if the certificate is still valid, and why does it say that the last check for one of the lists in the future? Feels like the usual crypto-fearmongering to me.

mtgx 11y ago

When is Microsoft going to adopt Certificate Transparency anyway? Google, Mozilla and Apple all support it already.

Someone1234 11y ago
> Mozilla and Apple all support it already. Do you have a source? As far as I know that is not accurate.
- iancarroll 11y ago
  This is unrelated to CT; this would still be needed to kill any maliciously issued certificates. Apple has App Transport Security which allows you to require CT. I think the OP meant Google, as the patch[1] for CT is still pending in Firefox. [1] https://bugzilla.mozilla.org/show_bug.cgi?id=944175 https://bugzilla.mozilla.org/show_bug.cgi?id=944175
  - mtgx 11y ago
    Right. What I meant was actually that they either support it or are in the process of supporting it. But I haven't heard anything about it from Microsoft.

tedunangst 11y ago

> I can't accurately foresee what is going to happen in 25 hours Set the clock forward and see?

Zoneman 11y ago
I believe this is less about what one individual computer would do and more about what could happen to the millions of Windows users facing this problem in 25 hours.
- tedunangst 11y ago
  Finding out what happens to one computer seems like a better start to informed speculation about millions of other computers than not finding out. Sure, it's no guarantee they're all the same, but we can more reasonably discuss whether the observed effects are plausibly widespread after observation...
  - iancarroll 11y ago
    I think the sentence was meant to imply MSFT might see this issue before the clock hits doomsday.
    - taspeotis 11y ago
      Microsoft has some experience with expired certificates [1]. [1] https://azure.microsoft.com/en-us/blog/windows-azure-service-disruption-from-expired-certificate/ https://azure.microsoft.com/en-us/blog/windows-azure-service...
wslh 11y ago
More technically: hook the time functions for that application only.

maurice2k 11y ago

Last autoupdate check on 2015-09-26 ... IN THE FUTURE? THE LAST ONE?

svenfaw 11y ago
Note to self: Do not take screenshots from the future.
- tomaskafka 11y ago
  could you open lottery numbers page in the background and post another screenshot, just for clarity?

chris_wot 11y ago

I'm trying to get my head around what a CTL is anyway. I might be tired and a bit hungry (never helps my cognitive processes) but I was struggling to understand the Microsoft article I found here: https://msdn.microsoft.com/en-us/library/windows/desktop/aa376545(v=vs.85).aspx https://msdn.microsoft.com/en-us/library/windows/desktop/aa3...

Siez_ 11y ago

Windows has been automagically updating CTLs for a while now. Next one probably doesn't get swapped in until the old expires unless there's actual new entries added to the pre-existing one.

jagermo 11y ago

It just updated tonight, it seems Edit: ListIdentifier = "DisallowedCert_AutoUpdate_1" SequenceNumber = 01d0f584a9ad12f7 ThisUpdate = "23.09.2015 00:18" NextUpdate = LEER SubjectAlgorithm = 1.3.6.1.4.1.311.10.11.15, "disallowedHash" SignerExpiration = "14.08.2016 19:13", "326,3 Days" CTLEntries = 57 Das System kann die angegebene Datei nicht finden. 0x80070002 (WIN32: 2 ERROR_FI LE_NOT_FOUND) -- http://ctldl.windowsupdate.com/msdownload/update/v3/static/trus http://ctldl.windowsupdate.com/msdownload/update/v3/static/t... tedr/en/disallowedcertstl.sst MissingCerts = 57 yesterday it told me that it wasn't updated since 180 days.

svenfaw 11y ago
Can you post a screenshot? "Updated" can mean different things in this context. For the issue to be resolved, Microsoft also has to update the signing certificate itself, which it hasn't done for the last 15 months. Edit: Confirmed! Blog post updated.