5 ms·

Imagine hacking into a key supplier's driver software and sneaking in defective metadata to Windows Update. Wouldn't this result in mass installation on various

by kobpow 3y ago

Imagine hacking into a key supplier's driver software and sneaking in defective metadata to Windows Update. Wouldn't this result in mass installation on various systems? Sounds like a serious vulnerability in security.

lionkor 3y ago
No worries - if word gets out, you can simply deny the windows update! Oh wait, you can't. This may be an attack vector, for sure
Jerrrry 3y ago
chaining accessing a likely air-gapped rsa private key to sign the malformed update with an already unlikely attack vector of a metadata parsing exploit itself means this is pretty pie in the sky
- radicalbyte 3y ago
  I expect that many of the players have their private keys not only on accessible machines but also likely under version control. Probably on a cloud platform.
  - fathyb 3y ago
    I always liked imagining big players like Apple, Sony, Microsoft, Nintendo, etc.. taking absurd measures to protect their private signing keys, something like that Coca-Cola recipe vault.
    - bombcar 3y ago
      I've seen some documentaries implying that about some of the root keys for things like certificates, but you know that there are some laying around in easy to use format ...
    - radicalbyte 3y ago
      That was my assumption considering that is exactly what we did do for our covid certificates. Ran on the same infra as passports which is gold standard. Microsoft? YOLO with their crown jewels: https://techcrunch.com/2023/07/17/microsoft-lost-keys-government-hacked/?guccounter=1 https://techcrunch.com/2023/07/17/microsoft-lost-keys-govern...
    - Jerrrry 3y ago
      You can split any key into x/n pieces that require x outta n keys to approve a transaction. All senior dev's, physical locations, board members, hell, even all stock holders, could cryptographically vote via an agreed upon method for any actions.
    - pxeboot 3y ago
      Didn't Sony get hacked and had a nearly completed film leaked? I hope the others you listed have far better security.
- mschuster91 3y ago
  > chaining accessing a likely air-gapped rsa private key Unfortunately, who knows if that's the case? Whoever was behind Stuxnet managed to steal the crown jewels of not just one but two different companies. There's a lot of companies with credentials to sign Windows kernel level code out there... which is also the reason why Apple is so insistent on getting rid of kext's - they want to get rid of the entire business model of allowing anyone but themselves to run kernel-level code on ordinary macOS machines. [1] https://en.wikipedia.org/wiki/Stuxnet https://en.wikipedia.org/wiki/Stuxnet
- jowea 3y ago
  Even for a state-level actor?

by kobpow 3y ago

lionkor 3y ago

No worries - if word gets out, you can simply deny the windows update! Oh wait, you can't. This may be an attack vector, for sure

Jerrrry 3y ago

chaining accessing a likely air-gapped rsa private key to sign the malformed update with an already unlikely attack vector of a metadata parsing exploit itself means this is pretty pie in the sky

radicalbyte 3y ago
I expect that many of the players have their private keys not only on accessible machines but also likely under version control. Probably on a cloud platform.
- fathyb 3y ago
  I always liked imagining big players like Apple, Sony, Microsoft, Nintendo, etc.. taking absurd measures to protect their private signing keys, something like that Coca-Cola recipe vault.
  - bombcar 3y ago
    I've seen some documentaries implying that about some of the root keys for things like certificates, but you know that there are some laying around in easy to use format ...
  - radicalbyte 3y ago
    That was my assumption considering that is exactly what we did do for our covid certificates. Ran on the same infra as passports which is gold standard. Microsoft? YOLO with their crown jewels: https://techcrunch.com/2023/07/17/microsoft-lost-keys-government-hacked/?guccounter=1 https://techcrunch.com/2023/07/17/microsoft-lost-keys-govern...
  - Jerrrry 3y ago
    You can split any key into x/n pieces that require x outta n keys to approve a transaction. All senior dev's, physical locations, board members, hell, even all stock holders, could cryptographically vote via an agreed upon method for any actions.
  - pxeboot 3y ago
    Didn't Sony get hacked and had a nearly completed film leaked? I hope the others you listed have far better security.
mschuster91 3y ago
> chaining accessing a likely air-gapped rsa private key Unfortunately, who knows if that's the case? Whoever was behind Stuxnet managed to steal the crown jewels of not just one but two different companies. There's a lot of companies with credentials to sign Windows kernel level code out there... which is also the reason why Apple is so insistent on getting rid of kext's - they want to get rid of the entire business model of allowing anyone but themselves to run kernel-level code on ordinary macOS machines. [1] https://en.wikipedia.org/wiki/Stuxnet https://en.wikipedia.org/wiki/Stuxnet
jowea 3y ago
Even for a state-level actor?