3 ms·
How is it possible that the trojan was able to use MS file certificates for it's own files? Isn't it that certificate works only for the original file?
by tomaszs 6y ago
How is it possible that the trojan was able to use MS file certificates for it's own files? Isn't it that certificate works only for the original file?
- aeternum 6y agoMS was basically the CA. It was SolarWind's signing key that was compromised via an on-prem attack. This article is somewhat over the top, it looks like what Microsoft actually did was just revoke the cert.
- comprambler 6y agoNo, they've had the functional equivalent of Mac Gatekeeper up since late windows 8 days called SmartScreen. They redlist the code signer cert there and it will flag the install process to the user. They've probably just done an OCSP revoke of that public key.