Information Security Stack Exchange is a question and answer site for information security professionals. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

My real question is how are patches and updates authenticated in general. But for example how does windows know a windows update is really a windows update, does it just trust the URL or is there some kind of certificate?

share|improve this question
up vote 7 down vote accepted

All updates are digitally signed by Microsoft's private key, you will get warnings if any updates are not signed, or signed with the wrong key. Even if a MiTM was able to send fake updates they'd be rejected by the update utility for that reason.

share|improve this answer
Unless somebody gets hold of Microsoft's private key. Do you know how MS would deal with that situation? – Sideshow Bob Jan 3 '15 at 11:41

Comodohacker, the guy who breached DigiNotar last year, claimed that he is able to issue fake certificates in the identity of Microsoft, and that he could provide fake updates. I haven't heard any confirmation of this happening, and Microsoft moved immediately to revoke the trust of DigiNotar as soon as the hack was announced, so it's possible nothing happened as a result.

But my advice is you are still much safer trusting it than you are to run un-patched; just don't be completely surprised if someone does breach it some day.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.