Welcome to DU!
The truly grassroots left-of-center political community where regular people, not algorithms, drive the discussions and set the standards.
Join the community:
Create a free account
Support DU (and get rid of ads!):
Become a Star Member
Latest Breaking News
General Discussion
The DU Lounge
All Forums
Issue Forums
Culture Forums
Alliance Forums
Region Forums
Support Forums
Help & Search
Why this "secure boot" from Microsoft is a load of bullcrap...
...and was made only to keep people from installing other OSs on their machines. Or from using their perfectly functioning, perfectly licensed copies of Win XP or 7. An anti-customer idea they saw Apple doing and just LOVED. Hell, even Apple is slightly more friendly with you installing other OSs on Macs. (But I'll keep avoiding them too nonetheless.)
Secure, my ass.
Give Microsoft the finger. Use Linux. (Or a BSD Unix if that's more your fancy.)
http://www.securityweek.com/microsoft-unauthorized-certificate-was-used-sign-flame-malware
Microsoft Certificate Was Used to Sign "Flame" Malware
[font size="-1"]By Mike Lennon on June 04, 2012[/font]
Microsoft: Techniques Used By Flame Could Be Used By Less Sophisticated Attackers to Launch Widespread Attacks
On Sunday, Microsoft reached out to customers and notified the public that it had discovered unauthorized digital certificates that “chain up” to a Microsoft sub-certification authority issued under the Microsoft Root Authority.
Interestingly, there is a direct connection between this discovery and the recently discovered “Flame” malware (also known as Flamer and sKyWIper). While many have said the enterprise threat posed by “Flame” is minimal, Microsoft is now warning that some of the techniques used by components of Flame could be leveraged by less sophisticated attackers to conduct more widespread attacks, namely in malware using unauthorized certificates in order to appear to be legitimate software coming from Microsoft.
Microsoft certification authority signing certificates added to the Untrusted Certificate StoreWhile these security issues are not Flame-specific, and could be used in other forms of unrelated malware, Microsoft was able to identify components of the Flame malware that had been signed with a certificate that ultimately chained up to the Microsoft Root Authority.
“We have discovered through our analysis that some components of the malware have been signed by certificates that allow software to appear as if it was produced by Microsoft,” Microsoft Security Response Center’s Jonathan Ness wrote in a blog post. “We identified that an older cryptography algorithm could be exploited and then be used to sign code as if it originated from Microsoft. Specifically, our Terminal Server Licensing Service, which allowed customers to authorize Remote Desktop services in their enterprise, used that older algorithm and provided certificates with the ability to sign code, thus permitting code to be signed as if it came from Microsoft.”
[font size="-1"]By Mike Lennon on June 04, 2012[/font]
Microsoft: Techniques Used By Flame Could Be Used By Less Sophisticated Attackers to Launch Widespread Attacks
On Sunday, Microsoft reached out to customers and notified the public that it had discovered unauthorized digital certificates that “chain up” to a Microsoft sub-certification authority issued under the Microsoft Root Authority.
Interestingly, there is a direct connection between this discovery and the recently discovered “Flame” malware (also known as Flamer and sKyWIper). While many have said the enterprise threat posed by “Flame” is minimal, Microsoft is now warning that some of the techniques used by components of Flame could be leveraged by less sophisticated attackers to conduct more widespread attacks, namely in malware using unauthorized certificates in order to appear to be legitimate software coming from Microsoft.
Microsoft certification authority signing certificates added to the Untrusted Certificate StoreWhile these security issues are not Flame-specific, and could be used in other forms of unrelated malware, Microsoft was able to identify components of the Flame malware that had been signed with a certificate that ultimately chained up to the Microsoft Root Authority.
“We have discovered through our analysis that some components of the malware have been signed by certificates that allow software to appear as if it was produced by Microsoft,” Microsoft Security Response Center’s Jonathan Ness wrote in a blog post. “We identified that an older cryptography algorithm could be exploited and then be used to sign code as if it originated from Microsoft. Specifically, our Terminal Server Licensing Service, which allowed customers to authorize Remote Desktop services in their enterprise, used that older algorithm and provided certificates with the ability to sign code, thus permitting code to be signed as if it came from Microsoft.”
More at link.
23 replies
= new reply since forum marked as read
= new reply since forum marked as read
