8 ms·
Private key for *.xboxlive.com certificate disclosed
- chris_wot 11y agoOne word summary: "Whoops!"
- deleted 11y ago[deleted]
- wyldfire 11y agoThank goodness for revocation lists. It's too bad -- they list "Affected Software" but they don't seem to disclose when the earliest time that xboxlive.com shouldn't have been trusted.
- jjp 11y agoCertificate was disallowed from December 1st.
- uxp 11y agoThe current certificate that I can see on (star).xboxlive.com is valid between December 1st 2014 and December 1st 2016. Is it common to issue a certificate for a year, but make it active for the previous year as well?
- tennysonmach 11y agoI suspect that they need to worry about xboxes using default time settings.
- tennysonmach 11y agoI suspect that they need to worry about xboxes using default time settings.
- blakeyrat 11y agoAn Xbox One can easily sit on the shelf for 3-4, or even more, years before being sold. Not quite the typical use-case...
- FireBeyond 11y agoUsing your powers of divination, given that the platform has only just had its second birthday?
- tedks 11y agoProbably entrail reading, which is more applicable to the games industry than divination. That, and the 30 years of console sales patterns to draw on.
- blakeyrat 11y agoHuh? Look, I guarantee there's a game shop in Small Town, USA, right now with more Xbox One consoles on their shelf than they'll sell in three or more years. And I guarantee you'll find "new in box" Xbox Ones on Ebay 8-10 years from now. Even if Microsoft stopped producing new Xbox Ones this afternoon, it wouldn't magically make those ones disappear.
- pwman 11y agoHeartbleed showed us that many certificate authorities reissue certificates from the original date they were first issued.
- zymhan 11y agoHow exactly does this happen?
- tdicola 11y agoIt happens. Engineer goes to upgrade the cert and copies it to a file share they didn't realize wasn't locked down. There's no evidence anyone malicious got the file but it's pretty standard protocol to just assume it's tainted and get a new cert.
- meowface 11y agoI wish they would say how it was disclosed. Your scenario is bad, but less bad than actually sending it out to the Internet, or some malware on a dev's machine grabbing it.
- eugenekolo2 11y agoI give equal likelihood to it being malware related, to somebody moving just disabling a settings on some server that can potentially connect to the server hosting the key. I don't think it's somebody just posting it online, or moving it.
- kozukumi 11y agoMy money would be on somebody commiting something to an externally facing and not security certified system. You see it quite a lot things that should be in gitignore for example.
- forgottenpass 11y agoEh, shit happens. Everything can't be perfect all the time. Especially in security.
- dwelch2344 11y agoPretty dangerous line of thinking when it comes to private keys for a wildcard cert on such a high traffic (and probably high value) target...
- alanh 11y agoPersonally, this makes for funny timing. As a first-time Xbox (One) owner (who never owned any PlayStation), I was telling a friend with a PS4 how damn buggy everything seemed to be, from setup to games themselves. She said she doesn’t have those problems on PS4. “Maybe you should’ve gotten a PlayStation!” “Yes, but isn’t Sony always getting hacked? Maybe the ideal thing would be a PlayStation that uses Microsoft’s web services!” sigh
- draw_down 11y agoIt's always funny to me when people say that sort of thing. Highly publicized attacks/vulns are bad, but it's likely that any given thing we use is getting owned all the time.
- alanh 11y agoSurely many hacks happen that we never find out about; nonetheless, the real world consequences of both the recent Sony (Pictures) hack and the older PSN hack were quite significant. The latter was quite relevant as it meant no one could play online games on their PlayStations for… weeks? months? if my understanding and recollection are correct.
- johncolanduoni 11y agoWell when we see vulnerabilities that can be traced back to boneheaded security, it seems reasonable to have some extra concern. Like when Sony decided to roll it's own crypto implementation for the PS3 and forgot to use different random numbers in one part, leading to the root private keys for the device being broken.
- chc 11y agoThey weren't actually hacked as far as anyone knows. They just discovered a private key had been leaked and invalid the certificate. But yeah, their services are buggy as crap.
- iLoch 11y agoI work with both PlayStation and Xbox network services (such as the ones affected by this leak) -- Microsoft's APIs are in a different league than the PlayStation ones. API versioning, contracts, solid SDKs, really solid separation of functionality and great coverage of core features. Sony's PlayStation API was clearly an afterthought at best, and a late night project after a drinking binge at worst. Another instance that reminded me Sony is indeed not a software company is their mobile app. MITM'd it to discover that they were sending something like 500 requests (totalling over 100MB IIRC) every time I opened the app. Wtf? But yeah, their services are buggy as crap.
- chrisfosterelli 11y agoCan anyone elaborate on how this affects non-windows products? If I go to https://developer.xboxlive.com https://developer.xboxlive.com I see a valid certificate, so my non-windows system trusts them. Have they revoked the old certificate? They only mention the certificate trust list, which I believe is a hardcoded list of certificates that Windows trusts. I understand that they should remove it from there but don't they also have to revoke the certificate for non-windows systems that use the standard verification methods?
- Sanddancer 11y agoWhat's the certificate info? Most likely, you got a valid cert. MS can give a bit extra security for mistakes like this in their own products because they have the keys to the castle, but everyone else will have to use the normal infrastructure, most likely OCSP. But from the sound of things, you're already using the new cert. https://en.wikipedia.org/wiki/Online_Certificate_Status_Protocol https://en.wikipedia.org/wiki/Online_Certificate_Status_Prot...
- chrisfosterelli 11y agoI imagine I am using the new cert. My question is that if an attacker got a hold of the past one, could I be MitM'd? They removed it from the Windows CTL but didn't mention anything explicitly about revoking it for everyone else...
- johncolanduoni 11y agoMicrosoft issues its own certificates, so if they add it to their own OCSP revocation list it will fail an OCSP check from any device. That said, many browsers don't do OCSP checks or will just accept a certificate if the OCSP server cannot be reached, although this was presumably an EV certificate where that attitude is less common. I'm also guessing this made it into Chrome's CRLSet (this kind of high profile EV revocation is exactly what it was designed for), so if you use Chrome you're pretty likely to be okay. edit: Actually I just checked the Chrome CRLSet, it doesn't appear to have revocations for any certificates from "Microsoft IT SSL SHA2" :(. You can turn on OCSP verification in most browsers, which should do it.
- vortico 11y agoThat security advisory is the longest possible way to say "Private key for *.xboxlive.com certificate disclosed." In my half-asleep mindset, I was expecting it to include the private key.
- OJFord 11y agoHas it changed since you read it? The title says one was inadvertently disclosed, and the first line says the one was that for *.xboxlive.com.
- 0x0 11y agoHow come "Xbox" is not in the list of affected devices?
- johncolanduoni 11y agoI suspect that the Xbox's communication with servers is validated using an entirely different certificate; it almost certainly doesn't use DNS to lookup Microsoft servers to connect to (I remember the Xbox 360 didn't). At the very least updates are (and I would be shocked if that key wasn't in an HSM inside a safe).
- speps 11y agoIt uses Windows 10 since November 2015.
- scott_karana 11y agoYes, and Windows 10 was affected, just like all the other listed OSes. However, xbox users might not be able to make the connection. Explicit is better than implicit for security announcements, I daresay. > An automatic updater of certificate trust lists is included in supported editions of ... Windows 10 ...
- elchief 11y agoAnd that's why you use an HSM kids!