My next class:

Microsoft Certificate Updater

Published: 2012-06-13. Last Updated: 2012-06-13 19:40:31 UTC
by Johannes Ullrich (Version: 1)
7 comment(s)

Microsoft released an automatic updated for untrusted certificates. A bid sad that we need this, but it does appear to be necessary to have a method to continuously update a bad certificate lists. The goal of the new updater is to allow for updates to the untrusted certificate store in one day or less after a new bad certificate is known.

Key revocation lists and OCSP were designed to notify clients of revoked certificates. However, these protocols haven't shown the scalability necessary to reliably notify clients of invalid certificates.

(thx Alex for pointing this out)

[1] http://blogs.technet.com/b/pki/archive/2012/06/12/announcing-the-automated-updater-of-untrustworthy-certificates-and-keys.aspx

------
Johannes B. Ullrich, Ph.D.
SANS Technology Institute
Twitter

7 comment(s)
My next class:

Comments

If these certificate updates keep requiring reboots it's going to greatly slow down their install rate :(
Happy to see a tool like this get released. I would think it wouldn't cause a reboot... anyone know if the KBs for previous cert updates caused a reboot?
#pedant mode on
"A bid sad" should be "A bit sad"
#pedant mode off
But yes, a loss of trust is always sad.
@mbrownnyc
KB2718704 didn't require a reboot.
KB2718704 didn't require a reboot on Vista & Win7 but did on XP
Soon enough, a security hole in this updater will require a Certificate Updater Updater. I hate to tell you this, but it's updaters all the way down.
Does this flaw have anything to do with this news article:

http://www.washingtonpost.com/world/national-security/us-israel-developed-computer-virus-to-slow-iranian-nuclear-efforts-officials-say/2012/06/19/gJQA6xBPoV_print.html

Diary Archives