Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

The Windows Update signing requirements are, AFAICT, not documented and they do require a special chain. Whether having Microsoft in the root is special enough is another question.

Regardless, it appears that a signed driver is enough to pwn any modern Windows box via USB. "The system is installing driver software for your device..."

EDIT: What it most likely would work for over the network would be a man-in-the-middle attack on users who "Always trust ActiveX controls from Microsoft". Not to mention plain old impersonating websites for users of MSIE and Chrome.

A scary but plausible possibility is that an attacker with such a cert could forge client certificate credentials to obtain remote access via RDP, MS Terminal Services Gateway, ISS certificate mapping, etc.



F-Secure claims that this /would/ allow forgery of Windows Updates (!!): http://www.f-secure.com/weblog/archives/00002377.html

"...Flame has a module which appears to attempt to do a man-in-the-middle attack on the Microsoft Update system..."


Yep. It appears that, in fact, windows update has been pwned by these certs.

More info. https://www.securelist.com/en/blog/208193558/Gadget_in_the_m...


>Regardless, it appears that a signed driver is enough to pwn any modern Windows box via USB.

Via USB you can pwn any modern OS by implementing standard mouse, keyboard and display device classes.




Consider applying for YC's Fall 2026 batch! Applications are open till July 27.

Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: