Microsoft throws 'kill switch' on own certificates after Flame hijack

Microsoft issues emergency update for all versions of Windows -- including the just-shipped Windows 8 Release Preview

Microsoft on Sunday revoked several of its own digital certificates after discovering that the makers of the Flame super-cyber spy kit figured out a way to sign their malware with the company's digital "signature."

The weekend emergency update for all versions of Windows -- including the just-shipped Windows 8 Release Preview -- was unusual, perhaps hinting at the seriousness of the flaw.

[ Also on InfoWorld: Flamer starts a flame war over origin. | Windows 8 is coming, and InfoWorld can help you get ready with the Windows 8 Deep Dive PDF special report, which explains Microsoft's bold new direction for Windows, the new Metro interface for tablet and desktop apps, the transition from Windows 7, and more. | Stay abreast of key Microsoft technologies in our Technology: Microsoft newsletter. ]

At least one security expert saw it that way. "This is a big deal," said Andrew Storms, director of security operations at nCircle Security, in an interview Sunday conducted via instant messaging.

Big because a flaw in Microsoft's Terminal Services licensing certificate authority (CA), which is normally used by enterprises to authorize remote desktop services and sessions, allowed attackers to generate digital certificates that could be used to "sign," or validate, code in Flame.

Flame is a massive espionage tool -- 20 to 40 times larger than Stuxnet, the worm that sabotaged Iran's nuclear fuel enrichment facilities -- that infiltrates networks, scouts out the digital landscape, then uses a variety of modules to pilfer information.

It appears Flame was aimed primarily at Iranian targets, as the majority of infected machines are in that country.

"Flame is using valid but fake Microsoft certificates to sign the code through a bug in their CA system via Terminal Services," Storms summarized. "So when the code was checked for validity, it properly linked back to the root and was accepted as okay."

The end result: Parts of Flame appeared innocuous because for all intents and purposes, they were signed by Microsoft itself.

Microsoft addressed the flaw by revoking three certificates, and issuing an update to all versions of Windows that added those certificates to the revocation list.

Even Windows 8 -- both the Consumer Preview and last week's Release Preview -- was affected, and will receive the certificate revocation update, Microsoft said in a security advisory released Sunday.

To prevent other attackers from doing the same -- and spoofing certificates on unpatched PCs -- Microsoft also modified the Terminal Server licensing service so it can no longer issue code-signing certificates.

That should not pose a problem for legitimate users of Terminal Services, said Storms. "Basically, users shouldn't worry," he said. "The [Terminal Services] hosts will re-authorize and will get issued new certificates."

Microsoft did not say which modules of Flame were code-signed by the fraudulent certificates. But Finnish antivirus firm F-Secure today claimed it had identified one such module.

"Flame has a module which appears to attempt to do a man-in-the-middle attack on the Microsoft Update system," said Mikko Hypponen, F-Secure's chief research officer, in a Monday blog post. "If successful, the attack drops a file called WUSETUPV.EXE to the target computer. This file is signed by Microsoft with a certificate that is chained up to Microsoft's root...except it isn't signed really by Microsoft."

Hypponen called the exploiting of the Windows Update and Microsoft Update -- two names for essentially the same service -- "the nightmare scenario" in security professionals' minds.

Microsoft seemed less concerned with Flame itself -- and its use of Microsoft-signed certificates -- than with the possibility that what it called "less sophisticated attackers" could leverage the same flaw to launch broader malware campaigns.

The company's Jonathan Ness, an engineer with the Microsoft Security Response Center, provided more detail on Flame's code-signing in a post to the Security Research & Defense blog.

The "out-of-band" update can be downloaded and installed via the Microsoft Update and Windows Update services, as well as through Windows Server Update Services.

Gregg Keizer covers Microsoft, security issues, Apple, Web browsers and general technology breaking news for Computerworld. Follow Gregg on Twitter at @gkeizer, on Google+ or subscribe to Gregg's RSS feed. His email address is gkeizer@computerworld.com.

See more by Gregg Keizer on Computerworld.com.

Read more about cybercrime and hacking in Computerworld's Cybercrime and Hacking Topic Center.

This story, "Microsoft throws 'kill switch' on own certificates after Flame hijack" was originally published by Computerworld.

From CIO: 8 Free Online Courses to Grow Your Tech Skills
Join the discussion
Be the first to comment on this article. Our Commenting Policies