5 ms·
Is it not by creating whatever software you want and signing it as Microsoft software. You could essentially replace core windows components and the OS would r
by InsomniacL 7y ago
Is it not by creating whatever software you want and signing it as Microsoft software.
You could essentially replace core windows components and the OS would run them without warning.
- CrazyStat 7y agoIt was for crypto specifically, to enforce export controls.
- GhettoMaestro 7y agoUs companies are also not allowed to export software with “pluggable crypto modules”.
- deleted 7y ago[deleted]
- Legogris 7y agoHijack Windows Update on the infrastructure level and you're good to go, basically. All it takes is compromising the ISP, the DNS provider or the local network admin.
- ryanlol 7y agoAs far as I understand you’re the first person to claim that windows update uses this key. Do you have any evidence to back up this claim?
- Legogris 7y agoNo, I don't have enough insight into how WU verification/certificates work to make such a strong claim in confidence actually. Would be curious to learn why this wouldn't be so, though. Given Microsoft's close relationship in NSA programs in the past (PRISM, Snowden leaks, others), it's not far-fetched to assume they have a key for a root CA or whatever else is needed for such an attack.
- lern_too_spel 7y agoMicrosoft has no relationship with the NSA in PRISM according to the Snowden leaks. The slides show they handle wiretaps for specific people under court order for the FBI, which we already knew.
- ryanlol 7y agoThat’s a pretty fucking terrible backdoor if it assumes that you already have local access.