4

May 28, The Flame malware is discovered in Iran and by Kaspersky Labs.

June 5, Dan Goodin (Ars Technica) points out that Flame had hijacked WindowsUpdate, spreading signed malware through that channel.

June 17, Ryan Hurst argues that the certificate is flawed based on Qualsys SSL Labs reports, and is countered by Ivan Ristić stating "SSL Labs reuses Mozilla’s trust store", which (I think) means that SSL Labs is unable to correctly critique out-of-browser systems such as WindowsUpdate.

Today, SSL Labs still does not trust the certificate.

My questions are:

  • Is the WindowsUpdate certificate (still?) flawed?
  • Can SSL Labs be used to rate such a service?
  • Is there a reason for WindowsUpdate to support SSL 2.0?
Improve this question

2 Answers 2

Reset to default
3

If you read Ryan Hurst's blog post (which you link to), you will find that it contains a number of misconceptions. I would not trust anything you read in that blog post to be correct. In particular, most or all of the criticisms in that blog post appear to be invalid.

So, no, as far as I can tell, the WindowsUpdate certificate is not flawed.

No, SSL Labs cannot be used to evaluate the security of WindowsUpdate. I mean, you could probably rig up a way to use it, but that would be a mis-use of SSL Labs: the results of the report may not be applicable, given how WindowsUpdate works. For instance, Ryan Hurst is mis-interpreting the results from SSL Labs. SSL Labs is intended for evaluating public-facing web servers that are intended to be visited by people with their web browser. WindowsUpdate doesn't work that way; it is not a public-facing web service. Rather, most people get updates via a dedicated client that runs on their machine and speaks directly to the WindowsUpdate server. SSL Labs results are not relevant and may not be accurate in that context. For instance, Ryan Hurst's criticism that the WindowsUpdate certificate doesn't validate (with SSL Labs) just represents a confusion over how WindowsUpdate works; it is not expected nor required for the WindowsUpdate cert to validate using the Mozilla root certs, since only the Windows Update client needs to validate the WindowsUpdate root cert, and the Windows Update client does do so properly. WindowsUpdate has never supported Mozilla/Firefox. So this is basically a bogus criticism.

I don't know why the WindowsUpdate server supports SSL 2.0. That's a fair question.

(Please understand that Ryan Hurst's criticisms are orthogonal to the Flame attack. They are unrelated. I'm not sure how they got lumped into this question.)

Improve this answer
1
  • About the blog: all the confusion and misconceptions is what I wanted confirmed. Thanks. It seems from the blog post that Hurst jumped directly to SSLLabs after Mikko Hyppönen discovered that the trust chain of the certificate was bogus. However, as I understand it, the new WindowsUpdate certificate was created as a result of Flame, leading to Hyppönen's discovery, again leading to Hurst's criticism. So I believe there's a link. Anyway, thanks for the answer!
    – Henning Klevjer
    Oct 22, 2012 at 6:40
4

In short:

  • No, all CRLs were updated to revoke the offending cert, and Microsoft took steps to prevent MD5-based certs from being issued again.
  • Possibly, if you use a proxy to inspect the traffic. Not really sure how you'd go about setting this up. You could manually check the handshake in Wireshark though.
  • Maybe. There are still some strange crypto export rules in the US, which SSL 2 might help get around. It may also be a legacy thing - I bet there are still old XP SP0 boxes out there with no SSL 3 support.
Improve this answer
2
  • If there are Windows XP RTM boxes in the wild, and they are connected to the internet, then its clear nobody really cares about the integrity of those boxes. Even if they are not connected to the internet, nobody really cares about the integrity of those boxes, because they are security holes that still exist while offline ( i.e. usb thumbdrives ).
    – Ramhound
    Oct 22, 2012 at 11:07
  • @Ramhound Sadly there are still corporate environments that require XP SP0. Often they're not directly on the internet, but most airgaps are deeply flawed.
    – Polynomial
    Oct 22, 2012 at 11:29

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .