Hacker News Reader

Comment by kobpow | Hacker News Reader

Imagine hacking into a key supplier's driver software and sneaking in defective metadata to Windows Update. Wouldn't this result in mass installation on various systems? Sounds like a serious vulnerability in security.

View on HN

No worries - if word gets out, you can simply deny the windows update! Oh wait, you can't.

This may be an attack vector, for sure

chaining accessing a likely air-gapped rsa private key to sign the malformed update with an already unlikely attack vector of a metadata parsing exploit itself means this is pretty pie in the sky

I expect that many of the players have their private keys not only on accessible machines but also likely under version control. Probably on a cloud platform.

I always liked imagining big players like Apple, Sony, Microsoft, Nintendo, etc.. taking absurd measures to protect their private signing keys, something like that Coca-Cola recipe vault.

I've seen some documentaries implying that about some of the root keys for things like certificates, but you know that there are some laying around in easy to use format ...

That was my assumption considering that is exactly what we did do for our covid certificates. Ran on the same infra as passports which is gold standard.

Microsoft? YOLO with their crown jewels:

https://techcrunch.com/2023/07/17/microsoft-lost-keys-govern...

You can split any key into x/n pieces that require x outta n keys to approve a transaction.

All senior dev's, physical locations, board members, hell, even all stock holders, could cryptographically vote via an agreed upon method for any actions.

Didn't Sony get hacked and had a nearly completed film leaked? I hope the others you listed have far better security.

> chaining accessing a likely air-gapped rsa private key

Unfortunately, who knows if that's the case? Whoever was behind Stuxnet managed to steal the crown jewels of not just one but two different companies. There's a lot of companies with credentials to sign Windows kernel level code out there... which is also the reason why Apple is so insistent on getting rid of kext's - they want to get rid of the entire business model of allowing anyone but themselves to run kernel-level code on ordinary macOS machines.

[1] https://en.wikipedia.org/wiki/Stuxnet

Even for a state-level actor?

Reply on news.ycombinator.com