Microsoft throws 'kill switch' on own certificates after Flame hijack
Cyber-spying tool exploited bug in Microsoft licensing service to 'sign' code, including some related to Windows Update
Computerworld - Microsoft on Sunday revoked several of its own digital certificates after discovering that the makers of the Flame super-cyber spy kit figured out a way to sign their malware with the company's digital "signature."
The weekend emergency update for all versions of Windows -- including the just-shipped Windows 8 Release Preview -- was unusual, perhaps hinting at the seriousness of the flaw.
At least one security expert saw it that way. "This is a big deal," said Andrew Storms, director of security operations at nCircle Security, in an interview Sunday conducted via instant messaging.
Big because a flaw in Microsoft's Terminal Services licensing certificate authority (CA), which is normally used by enterprises to authorize remote desktop services and sessions, allowed attackers to generate digital certificates that could be used to "sign," or validate, code in Flame.
Flame is a massive espionage tool -- 20 to 40 times larger than Stuxnet, the worm that sabotaged Iran's nuclear fuel enrichment facilities -- that infiltrates networks, scouts out the digital landscape, then uses a variety of modules to pilfer information.
It appears Flame was aimed primarily at Iranian targets, as the majority of infected machines are in that country.
"Flame is using valid but fake Microsoft certificates to sign the code through a bug in their CA system via Terminal Services," Storms summarized. "So when the code was checked for validity, it properly linked back to the root and was accepted as okay."
The end result: Parts of Flame appeared innocuous because for all intents and purposes, they were signed by Microsoft itself.
Microsoft addressed the flaw by revoking three certificates, and issuing an update to all versions of Windows that added those certificates to the revocation list.
Even Windows 8 -- both the Consumer Preview and last week's Release Preview -- was affected, and will receive the certificate revocation update, Microsoft said in a security advisory released Sunday.
To prevent other attackers from doing the same -- and spoofing certificates on unpatched PCs -- Microsoft also modified the Terminal Server licensing service so it can no longer issue code-signing certificates.
That should not pose a problem for legitimate users of Terminal Services, said Storms. "Basically, users shouldn't worry," he said. "The [Terminal Services] hosts will re-authorize and will get issued new certificates."
- DOJ's charges against China reframe security, surveillance debate
- Hacker indictments against China's military unlikely to change anything
- U.S. to formally accuse Chinese military of hacking
- Cyberattacks could paralyze U.S., former defense chief warns
- The NSA blame game: Singling out RSA diverts attention from others
- Jury still out on FISA court
- Suspected China-based hackers 'Comment Crew' rises again
- Chinese hackers master the art of lying in wait
- Spy court OK'd all U.S. wiretap requests it received in 2012
- Groups denounce FBI plan to require Internet backdoors for wiretaps
- Transforming Information Security: Future-Proofing Processes This report provides a valuable set of recommendations from 19 of the world'd leading security officers to help organizations build security strategies for...
- The Evolution of Corporate Cyberthreats Cybercriminals are creating and deploying new threats every day that are more destructive than ever before. While you may have more people devoted...
- 3 Questions to Ask Your DNS Host about Lowering DDoS Risks Neustar has had wide-ranging conversations with clients wanting to know how they can optimize protection as DDoS attacks increase in frequency and size.
- The Danger Deepens: 2014 Neustar Annual DDoS Attacks and Impact Report This report compares DDoS findings from 2013 to 2012, based on a survey of 440 North American companies, including 139 businesses delivering technology...
- Establish Cyber Resiliency: Developing a Continuous Response Architecture Many enterprises fail to proactively prepare the battlefield for a data breach by only leveraging outdated techniques that focus on the perimeter or...
- An Incident Response Playbook: From Monitoring to Operations As cyber-attacks grow more sophisticated, many organizations are investing more into incident detection and response capabilities. In this webcast, learn how to develop... All Cybercrime and Hacking White Papers | Webcasts