Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

All of Oculus’s Rift headsets have stopped working due to an expired certificate

techcrunch.com

Post reply on HN
Print view View original

111–120 of 390 posts

Re: All of Oculus’s Rift headsets have stopped working due to an expired certificate

#111

Post by toomanybeersies »

scrollaway wrote: post #76

This, and many incidents like it, makes me think that running tests 1/10/100 years in the future should be a standard feature of test runners and CI systems. (on by default)

I had a bunch of tests fail at the start of this year because someone had hard coded 2017 into the tests.

Fortunately it was a problem with the tests, rather than the code itself, but these things do happen.

At my old job, we had a bunch of tests fail when daylight saving ticked over. For some reason, some things were using local time, rather than UTC. We also had a test that would fail if the minute was the same as the hour.

Time is hard

Re: All of Oculus’s Rift headsets have stopped working due to an expired certificate

#112

Post by wtallis »

sjburt wrote: post #110
wtallis wrote: post #92

Earlier quoted context omitted.

That's a reasonable answer to why the drivers need to be signed in order to be installed. That's not the question. The question is why should the already-installed drivers that you've been trusting all along suddenly stop working.

Apparently, they signed them incorrectly.

That puts the blame on Oculus, but the blame really should rest on Microsoft for enabling and enforcing a signature mode that shouldn't exist at all.

Re: All of Oculus’s Rift headsets have stopped working due to an expired certificate

#113

Post by sigstoat »

52-6F-62 wrote: post #74
aresant wrote: post #66

Earlier quoted context omitted.

I'd love to hear you expand on that comment. I've been surprised how many investors / technologists view VR as a niche market for enterprise / porn / limited gaming appeal.

Not the above commenter, but Google Earth VR is like something out of a sci-fi film from 20 years ago. I was sincerely impressed and enthralled. Of course, the more street views they can capture, the better it will get. There are other education experiences like BBC Home which is one of my favourites. Another, Mission:ISS allows you to explore the ISS and control the Canadarm to dock a module. Highly recommend them.…

> Not the above commenter, but Google Earth VR is like something out of a sci-fi film from 20 years ago.

google earth VR and the opportunity to show it to my friends was worth $350 on its own.

Re: All of Oculus’s Rift headsets have stopped working due to an expired certificate

#114

Post by slededit »

wtallis wrote: post #98
andrewstuart2 wrote: post #82

Earlier quoted context omitted.

The expiration date is the fallback if you don't have confirmation from the timestamp server that it was signed prior to expiration. Ideally it's not used except by the timestamp service, but it seems like a fairly reasonable fallback.

> The expiration date is the fallback if you don't have confirmation from the timestamp server that it was signed prior to expiration. The fact that the driver was installed locally before the expiration should be taken as proof that the driver was signed before expiration.

Then you would need an internet connection just to install a driver. It would make getting your network driver installed pretty difficult.

You could look at the system clock but that was not designed to be secure for this purpose.

Re: All of Oculus’s Rift headsets have stopped working due to an expired certificate

#115

Post by MertsA »

tedunangst wrote: post #73
tptacek wrote: post #67

Earlier quoted context omitted.

Part of what driver expiry does is to prevent attackers from trivially banking older vulnerable versions of drivers and using them to bypass kernel protections.

But that's only relevant/necessary to check at install time. Attackers aren't banking the drivers that I've already installed last year.

Checking at install time is effectively useless. The whole point of running signed code is that you can't just load some rootkit. Secure Boot only loads a signed bootloader which only loads a signed kernel which only loads signed kernel modules. You can't do what you're suggesting without fundamentally breaking this chain of trust. What's to stop a rootkit from just spoofing that it was installed months ago?

Re: All of Oculus’s Rift headsets have stopped working due to an expired certificate

#116

Post by ryanlol »

wtallis wrote: post #112
sjburt wrote: post #110

Earlier quoted context omitted.

Apparently, they signed them incorrectly.

That puts the blame on Oculus, but the blame really should rest on Microsoft for enabling and enforcing a signature mode that shouldn't exist at all.

Does that really not sound ridiculous to you? Microsoft needs to be blamed for their certificate validation implementation because people might use it to make their software expire? Instead of just writing code that does so?

Re: All of Oculus’s Rift headsets have stopped working due to an expired certificate

#117

Post by Ajedi32 »

lopmotr wrote: post #81
r1ch wrote: post #23

This is not how Windows code signing is supposed to work. Normally you'd get a countersignature from a timestamp server so that the verification process can prove that the certificate was valid at the time of signing. It would appear that Oculus signed their binaries without using a timestamp server, so without a way to verify when signing happened they become invalid as soon as the cert expires.

Something like that. Certificates aren't supposed to stop working just because they've expired! That would destroy all abandoned or poorly maintained software within a couple of years. This problem is deeper than forgetting to update it. It should never have caused a failure in the first place. Just the fact that the device apparently can't function at all without the internet is a problem too.

> Certificates aren't supposed to stop working just because they've expired!

Except TLS certs. That's the whole point of those certs having an expiration date in the first place.

Re: All of Oculus’s Rift headsets have stopped working due to an expired certificate

#118

Post by mulmen »

wtallis wrote: post #94
mulmen wrote: post #91

Earlier quoted context omitted.

Is that true though? Could a malicious driver be signed with a compromised key and distributed? Seems like a useful feature to be able to mark drivers as compromised.

> Seems like a useful feature to be able to mark drivers as compromised. Putting expiration dates on non-malicious drivers is not a particularly effective way to protect against malicious drivers.

> There's no reason to re-verify the signature every time the driver is used.

I was replying to this part of your comment. It does seem worthwhile to validate the signature of the driver every time the driver is used if that check would reveal when a certificate has been revoked for having been compromised.

Agreed that the expiration time is not particularly useful for this purpose.

Re: All of Oculus’s Rift headsets have stopped working due to an expired certificate

#119

Post by IncRnd »

makmanalp wrote: post #99
lopmotr wrote: post #81

Earlier quoted context omitted.

Something like that. Certificates aren't supposed to stop working just because they've expired! That would destroy all abandoned or poorly maintained software within a couple of years. This problem is deeper than forgetting to update it. It should never have caused a failure in the first place. Just the fact that the device apparently can't function at all without the internet is a problem too.

For the ignorant among us, what would expiration do then?

It's not an expiration on the signed executable but an expiration on the ability of the certificate to sign an executable.
Post reply on HN