Fraudulent Digital Certificates Could Allow Spoofing

[Brink]

Microsoft Security Advisory (2607712)
Fraudulent Digital Certificates Could Allow Spoofing

General Information

Executive Summary

Microsoft is aware of at least one fraudulent digital certificate issued by DigiNotar, a certification authority present in the Trusted Root Certification Authorities Store, on all supported releases of Microsoft Windows. Although this is not a vulnerability in a Microsoft product, Microsoft is taking action to protect customers.

Microsoft has been able to confirm that one digital certificate affects all subdomains of google.com and may be used to spoof content, perform phishing attacks, or perform man-in-the-middle attacks against all Web browser users including users of Internet Explorer. Microsoft is continuing to investigate how many more certificates have been fraudulently issued. As a precautionary measure, Microsoft has removed the DigiNotar root certificate from the Microsoft Certificate Trust List.

All supported editions of Windows Vista, Windows 7, Windows Server 2008, and Windows Server 2008 R2 use the Microsoft Certificate Trust List to validate the trust of a certification authority. Users of these operating systems will be presented with an invalid certificate error when they browse to a Web site or try to install programs signed by the DigiNotar root certificate. In those cases users should follow the instructions in the message. Microsoft will release a future update to address this issue for all supported editions of Windows XP and Windows Server 2003.

Microsoft is continuing to investigate this issue and may release future updates to help protect customers.

Read more at: Microsoft Security Advisory (2607712): Fraudulent Digital Certificates Could Allow Spoofing

   Note

UPDATE:
V3.0 (September 6, 2011): Revised to announce the release of an update that addresses this issue. (KB2607712) available through Windows Update.

Microsoft Security Advisory: Fraudulent digital certificates could allow spoofing

Microsoft Security Advisory (2607712): Fraudulent Digital Certificates Could Allow Spoofing

 

[Phone Man]

Shawn,
There is a problem in your link. Looks like it is missing the 2 on the end of the link.

Jim

 

[Brink]

Thank you. Fixed.

 

[GEWB]

Official response from Vasco can be found here:

news_DigiNotar reports security incident

Others have made speculative comments such as:

"There's speculation that it's a MITM (man in the middle) by the Iranian government, but given the existing record of CAs ready to sell certs to anyone whose check clears, it could just be another Comodogate."

Regards,
GEWB

 

[Layback Bear]

Thanks Brink. Good to hear that MS is working on this problem.

 

[legacy7955]

This is why I respect MS so much more than Apple.

It disgusts me that Apple gets so much praise in the media too. When for the most part they DO NOT deserve it. While MS gets the beat down almost every time.

MS takes on every security issue head on, and is not so arrogant as to refuse to acknowledge an issue such as this, on the other hand Apple hides from this kind of thing and tells their customers to just "not worry". One more reason why I will always use Windows OS over Apple OS X.

 

[Phone Man]

Mozilla has released FF 6.0.1 to counter act this security breach.

https://www.mozilla.org/security/announce/2011/mfsa2011-34.html

Jim

 

[Layback Bear]

Thanks Phone man I how have the update.

 

[JMH]

Microsoft Confirms Spoofed Certificates for Microsoft.com and Windows

Microsoft Confirms Spoofed Certificates for Microsoft.com and Windowsupdate.com from DigiNotar

Spoofed certificates for .microsoft.com and .windowsupdate.com are among those issued by Dutch-based DigiNotar, which has been at the center of a scandal involved fraudulent certificates used to attack users of Google.com sites.

Microsoft has confirmed officially that certificates for its own online properties from DigiNotar have also been compromised, and already took measures in order to ensure that customers running Internet Explorer on Windows Vista and Windows 7 are protected.

Microsoft Confirms Spoofed Certificates for Microsoft.com and Windowsupdate.com from DigiNotar - Softpedia

 

[Brink]

Hackers Issue Rogue SSL Certificates for CIA, MI6, Mossad; Apple Pat

A well known security firm warns that the number of compromised digital security certificates from DigiNotar, a Dutch certificate authority outfit owned by VASCO Data Security International, has doubled in size over the past week from 250 false SSL certificates to 531. False certificates have now been issued for Facebook, Google, Tor, Skype, Mossad, CIA, MI6, Twitter, and several other high profile sites.

Read more at:
Maximum PC | Hackers Issue Rogue SSL Certificates for CIA, MI6, and Mossad; Apple Stands Pat

 

[JMH]

Protecting yourself from attacks that leverage fraudulent DigiNotar digital certificates

Last week, we released Security Advisory 2607712, notifying customers that fraudulent digital certificates had been issued by certificate authority DigiNotar. We’d like to follow up on that notification in this blog post by explaining more about the potential risks and actions you can take to protect yourself from any potential attacks that would leverage those fraudulent certificates.

Scope of the risk
Vulnerable configurations
What Microsoft is doing to protect you
What you can do to protect yourself
Additional protections built-in to Windows Update

Protecting yourself from attacks that leverage fraudulent DigiNotar digital certificates - Security Research & Defense - Site Home - TechNet Blogs

More on Microsoft’s response to the DigiNotar compromise

Microsoft’s investigation into the scope and impact of the DigiNotar compromise has continued over the holiday weekend. We’ve now confirmed that spoofed certificates for *.microsoft.com and *.windowsupdate.com are among those issued by the Dutch firm.

More on Microsoft

 

[GEWB]

From the Internet Storm Center

ISC Diary | DigiNotar audit - intermediate report available

Not a long read but interesting.

Regards,
GEWB

 

[Brink]

Microsoft Security Advisory Notification​

V3.0 (September 6, 2011): Revised to announce the release of an update that addresses this issue. (KB2607712) available through Windows Update.


Microsoft Security Advisory: Fraudulent digital certificates could allow spoofing

Microsoft Security Advisory (2607712): Fraudulent Digital Certificates Could Allow Spoofing

 

[seth500]

Thanks for the links Brink!

 

[Layback Bear]

We have enough military in Iraq that we should be able to paint that computer location Iran and accidentally drop a good one on them.

 

[Phone Man]

Microsoft Security Advisory Notification​

V3.0 (September 6, 2011): Revised to announce the release of an update that addresses this issue.

Microsoft Security Advisory: Fraudulent digital certificates could allow spoofing

Microsoft Security Advisory (2607712): Fraudulent Digital Certificates Could Allow Spoofing

I just received the MS update for this. KB2607712 listed as Important.

Jim

 

[Phone Man]

FF 6.0.2 Released

Mozilla has issued FF 6.0.2, another security update for this same problem.

MFSA 2011-35: Additional protection against fraudulent DigiNotar certificates

They have also updated the following products.



Jim

 

[JMH]

Second firm stops issuing digital certificates

A second company that provides digital certificates used to authenticate Web sites won't be issuing them while it investigates whether it has been compromised as a hacker has claimed.

A hacker who goes by the alias "Ich Sun" has taken responsibility for a recent breach at Dutch certificate authority DigiNotar that resulted in more than 500 SSL (Secure Sockets Layer) certificates being fraudulently issued, including one that was used to spoof Google.com.

Read more:

Second firm stops issuing digital certificates | InSecurity Complex - CNET News