Microsoft throws 'kill switch' on own certificates after Flame hijack

Cyber-spying tool exploited bug in Microsoft licensing service to 'sign' code, including some related to Windows Update

1 2 Page 2
Page 2 of 2

Microsoft did not say which modules of Flame were code-signed by the fraudulent certificates. But Finnish antivirus firm F-Secure today claimed it had identified one such module.

"Flame has a module which appears to attempt to do a man-in-the-middle attack on the Microsoft Update system," said Mikko Hypponen, F-Secure's chief research officer, in a Monday blog post. "If successful, the attack drops a file called WUSETUPV.EXE to the target computer. This file is signed by Microsoft with a certificate that is chained up to Microsoft's root...except it isn't signed really by Microsoft."

Hypponen called the exploiting of the Windows Update and Microsoft Update -- two names for essentially the same service -- "the nightmare scenario" in security professionals' minds.

Microsoft seemed less concerned with Flame itself -- and its use of Microsoft-signed certificates -- than with the possibility that what it called "less sophisticated attackers" could leverage the same flaw to launch broader malware campaigns.

The company's Jonathan Ness, an engineer with the Microsoft Security Response Center, provided more detail on Flame's code-signing in a post to the Security Research & Defense blog.

The "out-of-band" update can be downloaded and installed via the Microsoft Update and Windows Update services, as well as through Windows Server Update Services.

Gregg Keizer covers Microsoft, security issues, Apple, Web browsers and general technology breaking news for Computerworld. Follow Gregg on Twitter at @gkeizer, on Google+ or subscribe to Gregg's RSS feed . His email address is gkeizer@computerworld.com.

See more by Gregg Keizer on Computerworld.com.

Copyright © 2012 IDG Communications, Inc.

1 2 Page 2
Page 2 of 2
  
Shop Tech Products at Amazon