6 ms·
What if they don't need control of the entire machine? Such a backdoor could be much more conspicuous. What if the NSL they were handed only called for intercep
by Sir_Cmpwn 10y ago
What if they don't need control of the entire machine? Such a backdoor could be much more conspicuous. What if the NSL they were handed only called for intercepting TLS traffic as a means of surveillance?
- tptacek 10y agoIronically, the backdoor that provided access to the whole machine would be far less conspicuous than this one. That's the thing about the human cognitive bias towards narratives: RCE vulnerabilities in AV are found routinely, and don't land on the top of HN. This bug did because it was so cosmically stupid, it's surprising nobody noticed it before --- something Ormandy repeatedly states in his writeup. Which is all the more reason not to believe that it's enemy action.
- Sir_Cmpwn 10y agoWell, I don't know much about Windows and I don't know much about the design of this software, but let's speculate some more. I imagine that on Windows, you have to have escalated permissions to modify the certificate store. I also imagine that if you were writing a piece of software that could do this (i.e. AV), you wouldn't always be running everything as root (so to speak). I would guess that most RCEs wouldn't lead to being able to modify the certifiate store.