3 ms·
The attack allows faking https certs as well as code signing certs; so it seems plausible that a MitM attacker could trick Windows Update (or other auto-updater
by ynik 7y ago
The attack allows faking https certs as well as code signing certs; so it seems plausible that a MitM attacker could trick Windows Update (or other auto-updaters) into executing malicious code.
- heartbreak 7y agoThat this exploit can be used to spoof the Windows Update system is a big yikes. You can’t necessarily trust today’s update itself.
- munchbunny 7y agoThat depends on whether Windows Update is using ECC certificates. A quick scan of my Windows 10 trusted root certificate store shows almost exclusively RSA based certificates, so I’d guess 80% odds that Windows Update itself isn’t affected.
- shakna 7y agoIt may still be affected, the system may accept a bad ECC cert and override the RSA cert.
- GhettoMaestro 7y agoThis is pure speculation and garbage.
- atxlurker 7y agoWhat about user certs. Some windows systems allow for authenticating with a user cert. depending on how bad the validation bug is, seems like spoofing a user certificate could be a valid attack vector.