3 ms·

>a Microsoft-signed malicious update would be worldwide news https://twitter.com/craiu/status/879690795946827776 https://twitter.com/craiu/status/8796907959468

• willstrafach 9y ago
  > https://twitter.com/craiu/status/879690795946827776 https://twitter.com/craiu/status/879690795946827776 1. That screenshot clearly shows the certificate is being treated as not valid. I assume it is being shared for IOC purposes. 2. I am referring to a software update, in the context of revmoo's "forced updates + NSL" comment. > Pre-Snowden a lot of things had been considered "could possibly happen" tinfoil hat theories, turned out a lot of them had not been mere theories. I could believe that is the case for those outside of the information security community, but nothing novel/tinfoil-hat-worthy was in the leaks, just confirmations of predictable sources/methods used for intelligence gathering and CNE work. Forcing a company to issue a blessed update containing malicious code is very different, and again, I am very interested to hear of any proof of such a thing occurring without detection (It doesn't seem possible for that to happen without it being detected and being discussed very loudly).