News

Microsoft Issues Alert on Fraudulent Digital Certificates

Nine fraudulent digital certificates are circulating and could be in use by hackers, Microsoft warned yesterday.

The company described the problem in Security Advisory 2524375. The unauthorized certificates, issued by root certificate authority company Comodo Group, can allow hackers to carry out attacks and retain information from users through their Internet browsers. One certificate can affect Windows Live ID users, according to Microsoft.

"This is not a Microsoft security vulnerability; however, one of the certificates potentially affects Windows Live ID users via login.live.com," wrote Bruce Cowper, manager of the Microsoft Trustworthy group, in a blog posting. "These certificates may be used to spoof content, perform phishing attacks, or perform man-in-the-middle attacks against end users. We are unaware of any active attacks."

It was also reported today that the fraudulent certificates offered to Comodo for authentication came from an Iranian IP address.

"An attacker obtained the username and password of a Comodo Trusted Partner in Southern Europe," wrote Phillip Hallam-Baker, a lead contributer at Comodo, in a blog post. "We are not yet clear about the nature or the details of the breach suffered by that partner other than knowing that other online accounts (not with Comodo) held by that partner were also compromised at about the same time."

The reasoning behind the hack was not discovered. However, Hallam-Baker theorized that the individuals responsible could be part of a government wanting to keep tabs on unrest or rebel groups. He also said that while the IP address was traced to Iran, the location could be a false trail for anyone searching for the culprits.

According to Microsoft, certificates associated with the following Web sites are affected:

  • addons.mozilla.org
  • login.skype.com
  • login.live.com
  • mail.google.com
  • www.google.com
  • login.yahoo.com (3 certificates)
  • "Global Trustee"

Since the disclosure, Comodo has retracted the certificates in question and listed them on its Certificate Revocation List. Users with the Online Certificate Status Protocol (OCSP) enabled in their browser will automatically have the fraudulent certificates blocked, according to Microsoft.

Microsoft, Google and the Mozilla Foundation have all since released patches and updates to their individual browsers. The Mozilla Foundation, in a press release, wrote that "current versions of Firefox are protected from this attack. We are still evaluating the possibility of further response to this issue. We encourage all users to keep their software up to date by regularly applying security updates."

For Windows users, an automatic security update is now available for all supported versions of Microsoft's OS.

About the Author

Chris Paoli is the site producer for Redmondmag.com and MCPmag.com.

Featured

  • Spaceflight Training in the Middle of a Pandemic

    Surprisingly, the worldwide COVID-19 lockdown has hardly slowed down the space training process for Brien. In fact, it has accelerated it.

  • Surface and ARM: Why Microsoft Shouldn't Follow Apple's Lead and Dump Intel

    Microsoft's current Surface flagship, the Surface Pro X, already runs on ARM. But as the ill-fated Surface RT showed, going all-in on ARM never did Microsoft many favors.

  • IT Security Isn't Supposed To Be Easy

    Joey explains why it's worth it to endure a little inconvenience for the long-term benefits of a password manager and multifactor authentication.

  • Microsoft Makes It Easier To Self-Provision PCs via Windows Autopilot When VPNs Are Used

    Microsoft announced this week that the Windows Autopilot service used with Microsoft Intune now supports enrolling devices, even in cases where virtual private networks (VPNs) might get in the way.

comments powered by Disqus

Office 365 Watch

Sign up for our newsletter.

Terms and Privacy Policy consent

I agree to this site's Privacy Policy.