Microsoft: Stolen SSL certs can't be used to install malware via Windows Update

Updates also code-signed by separate certificate that Microsoft controls

By Gregg Keizer, Computerworld
September 06, 2011 11:47 AM ET

Microsoft said Sunday that a digital certificate stolen from a Dutch company could not be used to force-feed customers malware through its Windows Update service.

The company's assertion came after a massive theft of more than 500 SSL (secure socket layer) certificates, including several that could be used to impersonate Microsoft's update services, was revealed by Dutch authorities and several other affected developers.
"Attackers are not able to leverage a fraudulent Windows Update certificate to install malware via the Windows Update servers," said Jonathan Ness, an engineer with the Microsoft Security Response Center (MSRC), in a Sunday blog post. "The Windows Update client will only install binary payloads signed by the actual Microsoft root certificate, which is issued and secured by Microsoft."
Seven of the 531 certificates now known to have been fraudulently obtained by hackers in July were for the domains update.microsoft.com and windowsupdate.com, while another six were for *.microsoft.com.

According to Microsoft, the certificates issued for windowsupdate.com couldn't be used by attackers because the company no longer uses that domain. (Windows Update is now at windowsupdate.microsoft.com..) However, those for update.microsoft.com -- the domain for Microsoft Update -- and the wildcard *.microsoft.com could be.
As Ness said, updates delivered via Microsoft's services are signed with a separate certificate that's closely held by the company.
Without that code-signing certificate, attempts to deliver malware disguised as an update to a Windows PC would fail.
Other vendors, including Apple, also sign software updates with a separate certificate.
The certificates for the various Microsoft domains were issued by DigiNotar, a Dutch company that last week admitted its network had been hacked in mid-July .
The company initially believed it had revoked all the fraudulent certificates, but later realized it had overlooked one that could be used to impersonate any Google service, including Gmail. DigiNotar went public only after users reported their findings to Google.
Criminals or governments could use the stolen certificates to conduct "man-in-the-middle" attacks, tricking users into thinking they were at a legitimate site when in fact their communications were being secretly intercepted.
Microsoft has added its voice to the chorus from rival browser makers, notably Google and Mozilla, about the seriousness of the situation. Like its competitors, Microsoft will also permanently block all DigiNotar certificates.
"We are in the process of moving all DigiNotar owned or managed [certificate authorities] to the Untrusted Root Store, which will deny access to any website using DigiNotar certificates," said Dave Forstrom, a director in the Microsoft Trustworthy Computing group, in an emailed statement Sunday.
Forstrom did not set a date by when Microsoft would block all DigiNotar certificates, including those used by the Dutch government, which has been a major customer of the company.
Google updated Chrome on Saturday to block all DigiNotar certificates, while Mozilla plans to do the same on Tuesday for Firefox.
However, Microsoft's partial ban of DigiNotar certificates -- which it instituted last week -- and the complete sanction now in the works only protects users running Windows Vista, Windows 7, Windows Server 2008 and Windows Server 2008 R2.
Customers still on Windows XP or Windows Server 2003 must wait for an update specific to those operating systems; Ness said only that that update would "be available soon."
Until that Windows XP update is available, users can protect themselves by manually deleting the DigiNotar root from the list of approved certificate-issuing authorities. Microsoft has posted lengthy instructions for doing that on its "Security Research & Defense" blog.

Source: NetworkWorld and ComputerWorld

Stolen Google Certificate Puts Gmail Accounts in Danger

Aug 30, 2011 | 1:26 PM ET | By Matt Liebowitz, SecurityNewsDaily Staff Writer

Hackers have obtained a Google website authentication certificate, putting anyone visiting a Google-owned Web property, including Gmail and YouTube, in serious danger.

The Secure Sockets Layer (SSL) certificate allows whoever is wielding it to set up fraudulent Web pages under a legitimate Google domain name; the victims, security researchers say, would believe they were on a perfectly safe Google site while, behind the scenes, attackers could harvest all their personal information.

"This type of attack allows someone to eavesdrop on encrypted traffic, allowing them to decipher traffic which would otherwise not be possible," Kaspersky Lab researcher Roel Schouwenberg told SecurityNewsDaily.

Why is this so scary?

Most phishing emails or spoofed websites look legitimate, but close inspection will reveal a misspelled URL or an unencrypted Web session, or a third-party Web page that bears no resemblance to the original address. Anti-virus software often will detect these rogue pages as threats before they even get to you.

A stolen SSL certificate, however, could mean that when you log on to your Gmail account, or receive an email with a link to any Google.com Web domain (a YouTube video, for example), all of your credentials could be up for grabs.

"This particular certificate is a so-called 'wildcard' certificate," Schouwenberg said. "It's valid for any google.com subdomain. This means this certificate allows an attacker to eavesdrop on virtually all of Google's services, including Gmail, while the traffic is encrypted. This will allow the attacker to not only read/write emails but also grab the target's Google credentials."

Even worse, your computer — and you — would never even know, because nothing about the site would seem off. After all, the attack could take place on an encrypted Gmail page.

How did it happen?

Hackers accessed the SSL certificate on July 19 from DigiNotar, a Dutch certificate authority, which said in a press release that the breach "resulted in the fraudulent issuance of public key certificate requests for a number of domains, including Google.com."

DigiNotar said it revoked all the fraudulently issued certificates, but "recently, it was discovered that at least one fraudulent certificate had not been revoked at the time."

That certificate, for Google.com, has since been revoked, but it existed in the wild for more than five weeks.

An email to DigiNotar was not returned.

Who is behind the hack?

"This type of attack is mostly suited to intelligence/espionage operations," Schouwenberg said. "We have to keep in mind that these attacks are quite targeted and most likely carried out by nation-states."

Mikko Hypponen from the security firm F-Secure captured a screenshot of a compromised DigiNotar Web page that reads, "Hacked by KiAnPhP, Extrance Digital Security Team, Iranian Hackers."

"It's likely the Government of Iran is using these techniques to monitor local dissidents," Hypponen wrote.

Google itself supports this claim, writing in a blog post on Sunday (Aug. 28) that "the people affected were primarily located in Iran."

However, Hypponen came across another defaced DigiNotar Web page that reads, "Hacked by Black.Spook! Persian Gulf For Ever!!!"

"If you keep digging deeper, you'll find that although these Web defacements are still live right now, they are not new," Hypponen wrote. "Much worse: They were done years ago. In fact, these hacks are so old, it's unlikely they are connected to the current problem. Or at least so we hope."

What can you do?

"Unfortunately, there are only very few solutions for this type of problem," Schouwenberg told SecurityNewsDaily. "Right now, we have to rely on the browser makers to release an update to the browser which blacklists this particular certificate."

Thankfully, Mozilla Firefox, Microsoft Internet Explorer and Google Chrome have all updated their Web browsers to block the stolen Google SSL certificate.

Google warns users, especially located in Iran, to "keep their Web browsers and operating systems up to date and pay attention to Web browser security warnings."

Source: Security News Daily