3 ms·
Hijack Windows Update on the infrastructure level and you're good to go, basically. All it takes is compromising the ISP, the DNS provider or the local network
by Legogris 7y ago
Hijack Windows Update on the infrastructure level and you're good to go, basically.
All it takes is compromising the ISP, the DNS provider or the local network admin.
- ryanlol 7y agoAs far as I understand you’re the first person to claim that windows update uses this key. Do you have any evidence to back up this claim?
- Legogris 7y agoNo, I don't have enough insight into how WU verification/certificates work to make such a strong claim in confidence actually. Would be curious to learn why this wouldn't be so, though. Given Microsoft's close relationship in NSA programs in the past (PRISM, Snowden leaks, others), it's not far-fetched to assume they have a key for a root CA or whatever else is needed for such an attack.
- lern_too_spel 7y agoMicrosoft has no relationship with the NSA in PRISM according to the Snowden leaks. The slides show they handle wiretaps for specific people under court order for the FBI, which we already knew.