Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

A Brazilian CA trusted only by Microsoft has issued a certificate for google.com

follow.agwa.name

Post reply on HN
Print view View original

191–200 of 233 posts

Re: A Brazilian CA trusted only by Microsoft has issued a certificate for google.com

#191

Post by will4274 »

cookiengineer wrote: post #165
echoangle wrote: post #155

Earlier quoted context omitted.

Do you have a link for the „lost sourcecode so we won’t patch“ claim? The link you gave just gives me a long list of patches.

CVE-2017-11882 and the NTLM relay attack come to mind, for example. Down the line they weren't actually fixed, and are continuously being used by a lot of ransomware / malware campaigns. I remember some Windows Fax Service related CVEs and some Wi-Fi drivers that couldn't be fixed directly, too, but don't remember the CVE or whether that was related to the Broadcom driver/module sideloading fuckup. > The link you gav…

> CVE-2017-11882 and the NTLM relay attack come to mind, for example. Down the line they weren't actually fixed, and are continuously being used by a lot of ransomware / malware campaigns.

Your own sources indicate CVE-2017-11882 was fixed in November of 2017. The title of the blob.0patch.com article is

> Did Microsoft Just Manually Patch Their Equation Editor Executable? Why Yes, Yes They Did. (CVE-2017-11882)

clearly indicating that Microsoft fixed the issue, contrary to your statement that they 'weren't actually fixed". The body content is consistent.

> NTLM relay attack

NTLM is bad, no question. It's based on a bad threat model - it assumes network admins can secure their corporate networks. Microsoft also fixed most of the issues in NTLM with NTLMv2 back in the Windows Vista and Windows 7 era. And Microsoft announced they will disable all NTLM versions by default within the Win11 lifetime. The biggest problem (unsurprisingly) is non-Microsoft software which has hardcoded the use of NTLM. It's fair to criticize Microsoft here for making available a technology that required so much from corporate network admins and leaving it available (and with use in Microsoft products) for so many years. At the same time, it's misleading to characterize these problems as "weren't actually fixed" - concrete issues with NTLM within its security model _were_ fixed and new technologies were created with better security models.

- https://techcommunity.microsoft.com/blog/windows-itpro-blog/...

> The link I gave you is the only disclosure/advisory page that Microsoft offers, don't blame me for them not offering a better UI. Ask them to do better.

You're mistaken. Microsoft has deep links for each CVE.

- https://msrc.microsoft.com/update-guide/vulnerability/CVE-20...

Re: A Brazilian CA trusted only by Microsoft has issued a certificate for google.com

#192

Post by will4274 »

resters wrote: post #17

The simple solution would be to have independent entities offer trust assertions about CAs and to allow users to consider multiple entities' views in their decision about whether to trust. It's surprising this doesn't exist yet when the attack vector is so clear.

It'd be a simple enough browser plugin to build - a tool that checks multiple trust stores when rendering a page. Probably it already exists.

The problem is between the keyboard and the chair. Users struggle to understand SSL already. Browsers decided that the distinctions between EV, DV, and OV were too complex and hid them. What will your grandmother think when she opens up her bank and your browser plugin shows a greenish yellow trust indicator because the cert is trusted by Google, Apple, and Microsoft, but not Mozilla?

Unfortunately, trust is binary. Your grandmother click on the bank bookmark and either sees her banking websites or sees a scary warning.

Re: A Brazilian CA trusted only by Microsoft has issued a certificate for google.com

#193

Post by foota »

lxgr wrote: post #64
foota wrote: post #63

Earlier quoted context omitted.

I think the parent is saying that if they meant to use the cert only internally (e.g., to monitor employees) then that would arguably not be malicious.

Not malicious, but also not exactly purely accidental, i.e. as part of some otherwise totally legitimate activity.

I think the accidental part would be in the scope. I'm not an expert on these things, but they could have intended to create a self signed cert only valid within the scope of their IT, but accidentally created one from their CA.

Re: A Brazilian CA trusted only by Microsoft has issued a certificate for google.com

#194

Post by foota »

tptacek wrote: post #94
foota wrote: post #63

Earlier quoted context omitted.

I think the parent is saying that if they meant to use the cert only internally (e.g., to monitor employees) then that would arguably not be malicious.

It would not be malicious. I don't think there's a serious argument here (bearing in mind that in the airless vacuum of a message we can, of course, argue anything). I don't know that's what happened here, though; there are malicious possible explanations!

I largely agree, although I think there's some part of a slippery slope specifically when it comes to government, since you could argue that a government monitoring its citizens is also not malicious since (in a democratic society) the government derives its mandate from the people.

This isn't too different from the argument that (I believe reasonably) applies for how a company has the right to monitor employees, but I think many people are opposed to even democratic governments monitoring people and would consider such use malicious.

So a government monitoring its employees is one step closer even than a company, since it's the same organization in this case (though again, I think it's largely reasonable for a government to monitor their employees).

Re: A Brazilian CA trusted only by Microsoft has issued a certificate for google.com

#195

Post by amluto »

tsimionescu wrote: post #189
nordsieck wrote: post #185

Earlier quoted context omitted.

> Either way, this makes little sense overall. If a CA is trustable, it can be trusted to sign a certificate for any domain. And if it's not trustable, then you can't trust it for any domain. That's a silly position to take. When I lived with roommates, I trusted them. But I also locked my bedroom when I went out. Because there's no good reason to rely on trust when you don't have to.

It is given the design of the PKI and DNS. There's no relation between CA and the TLDs on the certificate being signed.

This is true, but it’s an old design that has been (in my opinion at least) obviously wrong since the very beginning of HTTPS. Microsoft could easily fix it, at least for clients that can manage to use an updated API.

Re: A Brazilian CA trusted only by Microsoft has issued a certificate for google.com

#196

Post by cvalka »

kelnos wrote: post #65
amluto wrote: post #59

Earlier quoted context omitted.

The solution seems straightforward: limit the trust in the CA to .BR domains. [domain name typo fixed]

IIRC name constraints is very poorly supported by client software, so there are likely lots of clients out there that wouldn't even parse that restriction out of the cert, and happy accept anything singed by the CA.

As of 2024, they are well supported.

Re: A Brazilian CA trusted only by Microsoft has issued a certificate for google.com

#197

Post by II2II »

echoangle wrote: post #152
II2II wrote: post #85

Tangentially related: The system is deeply flawed, which is something I realized fifteen years ago when I was put into a situation where I had to use online banking. (Had to being the nearest branch of any bank was an hour long flight away, though there was an ice road you could use in the winter.) One of my first questions of the bank was: who issued their certificate. They didn't have a clue what I was talking abou…

How does knowing the issuer of the certificate tell you anything if any CA can make certificates for your bank domain? If the answer was „sure, we use GlobalSign“, is that good or bad? If the Brazilian CA is malicious, they can still MITM you, right? (Assuming certificate pinning doesn’t exist, which was the case 10 years ago and is true now, too)

If my bank uses "GlobalSign" and my browser says "Brazilian CA", I know something is wrong. Granted, such a discrepancy would have been more noticeable back then since the lock icon had the issuer displayed next to it. Now I have to click the lock, then select a menu item to get that information. And, if I'm feeling particularly paranoid, it takes 5 clicks to review the certificate. (At least in Firefox.)

If the bank is unable to tell me which CA they use through a trusted channel, the only way I could tell if there is a problem is if the CA changes.

Re: A Brazilian CA trusted only by Microsoft has issued a certificate for google.com

#198

Post by tptacek »

justinclift wrote: post #130
danpalmer wrote: post #2

This is a bad look. I expected the result would be Chrome and Firefox dropping trust for this CA, but they already don't trust this CA. Arguably, Microsoft/Windows trusting a CA that the other big players choose not to trust is an even worse look for Microsoft.

> an even worse look for Microsoft. Microsoft have a terrible reputation for security, which they've earned through doing stuff like this. It's not likely to get any better any time soon either, as their trajectory is still pointed downwards.

This is something people on message boards believe that practitioners roll their eyes about.

Re: A Brazilian CA trusted only by Microsoft has issued a certificate for google.com

#199

Post by cookiengineer »

will4274 wrote: post #191
cookiengineer wrote: post #165

Earlier quoted context omitted.

CVE-2017-11882 and the NTLM relay attack come to mind, for example. Down the line they weren't actually fixed, and are continuously being used by a lot of ransomware / malware campaigns. I remember some Windows Fax Service related CVEs and some Wi-Fi drivers that couldn't be fixed directly, too, but don't remember the CVE or whether that was related to the Broadcom driver/module sideloading fuckup. > The link you gav…

> CVE-2017-11882 and the NTLM relay attack come to mind, for example. Down the line they weren't actually fixed, and are continuously being used by a lot of ransomware / malware campaigns. Your own sources indicate CVE-2017-11882 was fixed in November of 2017. The title of the blob.0patch.com article is > Did Microsoft Just Manually Patch Their Equation Editor Executable? Why Yes, Yes They Did. (CVE-2017-11882) clear…

Your definition of "fixed" seems to be different than mine. Can't fix a broken architecture if Microsoft is not willing to replace it while also deprecating the old ways. If you want to move the goal post to "my computer is connected to the internet, so it's my fault" then sure, whatever. I still think that Microsoft didn't fix the issues at hand, and kerberoast problems and NTLM problems alone are beyond human knowability. That's why they are so feasible as an attack surface, especially on Azure with its cross-tenant problems, which kind of implies that Microsoft themselves cannot manage NTLM correctly.

I'll just leave this here, a month old (Oct 2024) because you seem to critize my old examples [1]. You can also google for "malware NTLM relay attack" and you'll find plenty of other examples.

PS: I also want to add that I won't collect 100s of CVEs for some random person online. I got better things to do than to convince people to ditch Windows. If you want a dossier and analysis, pay us and we'll make a contract for it.

If you want a better vulnerability database, we'll have that available as a product :)

[1] https://www.bleepingcomputer.com/news/security/exploit-relea...

Post reply on HN