> > > For the record, no. Windows Update doesn't just depend on > WinVerifyTrust, > > it also calls CertVerifyCertificateChainPolicy with > > the CERT_CHAIN_POLICY_MICROSOFT_ROOT flag, documented here: > > > > http://msdn.microsoft.com/en-us/library/aa377163(v=vs.85).aspx > > > > > > > > By your logic there would be no exploits just because the documentation > writes so. >
Nothing's stopping you from hooking CertVerifyCertificateChainPolicy and seeing for yourself :) See also: http://twitter.com/#!/thierryzoller/status/112240979079204864 @thierryzoller: @dakami that finally explains why i didnt succeed in mitm it few years ago > > I bothered to ask mainly for these reasons: > > 1. It is unclear to me what collection of private keys/certs Comodohacker > has > He's been hitting certificates that have public interfaces, because as we know, most public interfaces are terrible. I do not expect the Microsoft Root to have a public interface. > 2. From thereg article: > >Microsoft declined to comment. > Microsoft commented rather clearly here: http://bit.ly/q0JpIT Attackers are not able to leverage a fraudulent Windows Update certificate to install malware via the Windows Update servers. The Windows Update client will only install binary payloads signed by the actual Microsoft root CA certificate, which is issued and secured by Microsoft. Also, Windows Update itself is not at risk, even to an attacker with a fraudulent certificate. Obviously the guy's got all sorts of illicit access. Just probably not this. > > -- > georgi >
_______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
