3 ms·
The Windows Update signing requirements are, AFAICT, not documented and they do require a special chain. Whether having Microsoft in the root is special enough
by marshray 14y ago
The Windows Update signing requirements are, AFAICT, not documented and they do require a special chain. Whether having Microsoft in the root is special enough is another question.
Regardless, it appears that a signed driver is enough to pwn any modern Windows box via USB. "The system is installing driver software for your device..."
EDIT: What it most likely would work for over the network would be a man-in-the-middle attack on users who "Always trust ActiveX controls from Microsoft". Not to mention plain old impersonating websites for users of MSIE and Chrome.
A scary but plausible possibility is that an attacker with such a cert could forge client certificate credentials to obtain remote access via RDP, MS Terminal Services Gateway, ISS certificate mapping, etc.
- anonymfus 14y ago>Regardless, it appears that a signed driver is enough to pwn any modern Windows box via USB. Via USB you can pwn any modern OS by implementing standard mouse, keyboard and display device classes.
- semenko 14y agoF-Secure claims that this /would/ allow forgery of Windows Updates (!!): http://www.f-secure.com/weblog/archives/00002377.html http://www.f-secure.com/weblog/archives/00002377.html "...Flame has a module which appears to attempt to do a man-in-the-middle attack on the Microsoft Update system..."
- marshray 14y agoYep. It appears that, in fact, windows update has been pwned by these certs. More info. https://www.securelist.com/en/blog/208193558/Gadget_in_the_middle_Flame_malware_spreading_vector_identified https://www.securelist.com/en/blog/208193558/Gadget_in_the_m...