Jump to content

Microsoft issues unauthorized certificate warning, patch


Recommended Posts


Microsoft has issued a rather serious security advisory via TechNet, affecting virtually every currently supported Windows product, and issued a patch to correct the problem. The threat stems from unauthorized Microsoft Certificates being used to spoof content and carry out phishing attacks.

The report doesn't go into details on the attacks themselves, simply stating that Microsoft is aware of the problem and that the unauthorized certificates could be used to “spoof content, perform phishing attacks, or perform man-in-the-middle attacks.” Simply put, that's some pretty serious stuff, and the it could lead to a lot of personal information falling into the wrong hands if left unchecked.

Microsoft doesn't plan on letting that happen, and they suggest that install an update revoking the trust from the affected certificates, either via Windows Update. If that's not working for you, you can grab the patch directly from here.

The update addresses three certificates causing the problem, two from the Microsoft Enforced Licensing Intermediate PCA, and one from the Microsoft Enforced Licensing Registration Authority CA (SHA1). We'd love to tell you more, but that's all we've got for now.

Source: TechNet

Link to comment
Share on other sites

  • Replies 1
  • Views 1.5k
  • Created
  • Last Reply
  • Administrator

"Flame" malware was signed by rogue Microsoft certificate

Posted Image

Microsoft has pushed out a new patch for Windows.

Microsoft released an emergency Windows update on Sunday after revealing that one of its trusted digital signatures was being abused to certify the validity of the Flame malware that has infected computers in Iran and other Middle Eastern Countries.

The compromise exploited weaknesses in Terminal Server, a service many enterprises use to provide remote access to end-user computers. By targeting an undisclosed encryption algorithm Microsoft used to issue licenses for the service, attackers were able to create rogue intermediate certificate authorities that contained the imprimatur of Microsoft's own root authority certificate—an extremely sensitive cryptographic seal. Rogue intermediate certificate authorities that contained the stamp were then able to trick administrators and end users into trusting various Flame components by falsely certifying they were produced by Microsoft.

"We have discovered through our analysis that some components of the malware have been signed by certificates that allow software to appear as if it was produced by Microsoft," Microsoft Security Response Center Senior Director Mike Reavey wrote in a blog post published Sunday night. "We identified that an older cryptography algorithm could be exploited and then be used to sign code as if it originated from Microsoft. Specifically, our Terminal Server Licensing Service, which allowed customers to authorize Remote Desktop services in their enterprise, used that older algorithm and provided certificates with the ability to sign code, thus permitting code to be signed as if it came from Microsoft."

The exploit, which abused a series of intermediate authorities that were ultimately signed by Microsoft's root authority, is the latest coup for Flame, a highly sophisticated piece of espionage malware that came to light last Monday. Flame's 20-megabyte size, it's extensive menu of sophisticated spying capabilities, and its focus on computers in Iran have led researchers from Kaspersky Lab, Symantec, and other security firms to conclude it was sponsored by a wealthy nation-state. Microsoft's disclosure follows Friday's revelation that the George W. Bush and Obama administrations developed and deployed Stuxnet, the highly advanced software used to set back the Iranian nuclear program by sabotaging uranium centrifuges at Iran's Natanz refining facility.

The emergency update released by Microsoft blacklists three intermediate certificate authorities tied to Microsoft's root authority. All versions of Windows that have not applied the new patch can be tricked by the Flame attackers into displaying cryptographically generated assurances that the malicious wares were produced by Microsoft.

Microsoft engineers have also stopped issuing certificates that can be used for code signing with the Terminal Services activation and licensing process. The ability of the licensing mechanism to sign untrusted code that linked Microsoft's root authority is a mistake of breathtaking proportions. None of Microsoft's Sunday night blog posts explained why such design was ever allowed to be put in place. A description of the Terminal Services License Server Activation refers to a "limited-use digital certificate that validates server ownership and identity." Based on Microsoft's description of the attack, it would appear the capabilities of these certificates weren't as limited as company engineers had intended.

"This is a pretty big goof," Marsh Ray, a software developer two-factor authentication company PhoneFactor, told Ars. "I don't think anyone realized that this enabled the sub CA that was present on the licensing server to have the full authority of the trusted root CA itself."

Microsoft's mention of an older cryptography algorithm that could be exploited and used to sign code as if it originated from Microsoft evoked memories of an attack from 2008 to mint a rogue certificate authority that could be trusted by all major browsers. The attack in part relied on weaknesses in the MD5 cryptographic hash function that made it susceptible to "collisions," in which two or more different plaintext messages generated the same cryptographic hash. By unleashing 200 PlayStation 3 game consoles to essentially find a collision, the attackers could become a certificate authority that could spawn SSL (secure sockets layer) credentials trusted by major browsers and operating systems.

Based on the language in Microsoft's blog posts, it's impossible to rule out the possibility that at least one of the certificates revoked in the update was also created using MD5 weaknesses. Indeed, two of the underlying credentials used MD5, while the third used the more advanced SHA-1 algorithm. In a Frequently Asked Questions section of Microsoft Security Advisory (2718704), Microsoft's security team also said: "During our investigation, a third Certificate Authority has been found to have issued certificates with weak ciphers." The advisory didn't elaborate.

It's also unclear if those with control of one of the rogue Microsoft certificates could sign Windows software updates. Such a feat would allow attackers with control over a victim network to hijack Microsoft's update mechanism by using the credentials to pass off their malicious wares as official patches. Microsoft representatives didn't respond to an e-mail seeking comment on that possibility. This article will be updated if an answer arrives later.

Two of the rogue certificates were chained to a Microsoft Enforced Licensing Intermediate PCA. A third was chained to a Microsoft Enforced Licensing Registration Authority CA, and ultimately to the company's root authority. In addition to potential exploits from the actors behind Flame, unrelated attackers could also use the certificates to apply Microsoft's signature to malicious pieces of software.

A third Microsoft advisory pointed out that Flame so far has been found only on the machines of highly targeted victims, so the "vast majority of customers are not at risk."

"That said, our investigation has discovered some techniques used by this malware that could also be leveraged by less sophisticated attackers to launch more widespread attacks," Jonathan Ness, of Microsoft's Security Response Center, continued. "Therefore, to help protect both targeted customers and those that may be at risk in the future, we are sharing our discoveries and taking steps to mitigate the risk to customers."

:view: View: Original Article

Link to comment
Share on other sites


This topic is now archived and is closed to further replies.

  • Recently Browsing   0 members

    • No registered users viewing this page.
  • Create New...