4 ms·

Allowing code signing with a certificate that we generate for and hand out to enterprise customers was certainly not something we intended to do at Microsoft.

by jness 14y ago

Allowing code signing with a certificate that we generate for and hand out to enterprise customers was certainly not something we intended to do at Microsoft. It was sloppy and a mistake on our part that we rushed to address as soon as we discovered the issue. Honestly, I think many of us are terribly embarrassed by this failure and a little surprised that no one (us included) had discovered this issue years ago. :(

rdl 14y ago
I agree that is by far the most likely case, but if you wanted to give the USG a backdoor to sign code, this is also exactly how you'd do it -- as a deniable oversight, which, when found, could be explained as a simple oversight and rapidly corrected.
- eli 14y ago
  Frankly, if I were going to create a deliberate backdoor I'd make it harder to find than this. I wonder when it was first discovered.
  - rdl 14y ago
    Yeah, so would I. It also got put in one ago, which is before putting back doors into commodity OSes was such a useful thing for national security (probably compromising crypto systems and specific RF hardware used in air defense, etc was the primary goal back then). I probably wouldnt rush to fix a convenient exploit once discovered, though, if existing USG policies could protect against it (removing most CAs, using DOD CAs) for government operations.
cpeterso 14y ago
Humans are always the weakest link. I worked on Microsoft's crypto QA team many years ago. VeriSign issued some test certificates for our internal testing. A co-worker called VeriSign customer service, asking them to revoke one of the test certificates so we could test CRLs (Certificate Revocation Lists). Without any additional authentication or verification, the customer service person revoked Microsoft Corporation's root certificate! This was misunderstanding was quickly remedied, but it was a perfect demonstration that CA trust chains is a house of cards.

by jness 14y ago

rdl 14y ago

I agree that is by far the most likely case, but if you wanted to give the USG a backdoor to sign code, this is also exactly how you'd do it -- as a deniable oversight, which, when found, could be explained as a simple oversight and rapidly corrected.

eli 14y ago
Frankly, if I were going to create a deliberate backdoor I'd make it harder to find than this. I wonder when it was first discovered.
- rdl 14y ago
  Yeah, so would I. It also got put in one ago, which is before putting back doors into commodity OSes was such a useful thing for national security (probably compromising crypto systems and specific RF hardware used in air defense, etc was the primary goal back then). I probably wouldnt rush to fix a convenient exploit once discovered, though, if existing USG policies could protect against it (removing most CAs, using DOD CAs) for government operations.

cpeterso 14y ago

Humans are always the weakest link. I worked on Microsoft's crypto QA team many years ago. VeriSign issued some test certificates for our internal testing. A co-worker called VeriSign customer service, asking them to revoke one of the test certificates so we could test CRLs (Certificate Revocation Lists). Without any additional authentication or verification, the customer service person revoked Microsoft Corporation's root certificate! This was misunderstanding was quickly remedied, but it was a perfect demonstration that CA trust chains is a house of cards.