Microsoft Releases Automatic Updater for Certificate Revocation Lists, Plans to Invalidate Short RSA Keys

As part of its response to the Flame malware and its usage of a forged Microsoft certificate to sign malicious files, Microsoft has changed the way that Windows handles certificates, releasing an automatic updater function that will recognize and flag untrusted certificates.

As part of its response to the Flame malware and its usage of a forged Microsoft certificate to sign malicious files, Microsoft has changed the way that Windows handles certificates, releasing an automatic updater function that will recognize and flag untrusted certificates.

The new functionality is a major change in the way that Windows deals with certificate revocation lists and gives the company a mechanism to quickly revoke trust in forged or stolen certificates. Microsoft also made a change that will invalidate all certificates with keys shorter than 1024 bits in August. Even if those certificates are actually valid and are signed by a trusted root, Microsoft will treat them as invalid because of the short key length. 

This new automatic updater feature provides a mechanism that allows Windows to specifically flag certificates as untrusted. With this new feature, Windows will check daily for updated information about certificates that are no longer trustworthy. In the past, movement of certificates to the untrusted store required a manual update,” Microsoft said of the change to the certificate revocation mechanism.

The automatic updater for certificate revocations is available for Windows Vista SP 2, Windows 7, Windows Server 2008 SP 2 and Windows Server 2008 R2. The change is a direct response to the usage of a forged Microsoft certificate by the attackers behind the Flame malware. Those attackers were able to use a bug in the way that Microsoft’s Terminal Services licensing server worked in order to produce a forged, but valid, certificate that they then used to sign a binary and impersonate Windows Update. That was one of the methods that the attackers used to spread Flame from machine to machine.

This attack was a black eye for Microsoft and, as one might imagine, did not sit well with the security team in Redmond. So, the automatic update for untrusted certificates is one part of the company’s response.

In the past, customers would have had to make changes to the Untrusted Certificate Store by initiating updates through Windows Update or by using a manual method. For example, the updates published in KB 2718704, which describes an update to move unauthorized certificates to the untrusted store, had to be initiated manually. This new feature provides dynamic updates for revocation information so that Windows clients can be updated with untrusted certificates at most within a day of the information being published (no user interaction required). This new automatic updater will enable Certificate Authorities to report information about their revoked CA certificates to Microsoft and have them publicly untrusted in a much faster manner as compared to propagating this information by using CRLs,” Kurt Hudson of Microsoft wrote in a blog post.

The change to the kinds of RSA keys that Microsoft will trust is a response to both the continued increase in compute power and the changes in the threat landscape.
“Public key based cryptographic algorithms strength is determined based on the time taken to derive the private key using brute force methods. The algorithm is deemed to be strong enough when the time required to derive private key is prohibitive enough using the computing power at disposal. The threat landscape continues to evolve.  As such, we are further hardening our criteria for the RSA algorithm with key length less than 1024 bits. To further reduce the risk of unauthorized exposure of sensitive information, Microsoft has created a software update that will be released in August 2012 for the following operating systems: Windows XP, Windows Server 2003, Windows Server 2003 R2, Windows Vista, Windows Server 2008, Windows 7, and Windows Server 2008 R2,” Hudson said.

Suggested articles

biggest headlines 2020

The 5 Most-Wanted Threatpost Stories of 2020

A look back at what was hot with readers — offering a snapshot of the security stories that were most top-of-mind for security professionals and consumers throughout the year.

Discussion

Subscribe to our newsletter, Threatpost Today!

Get the latest breaking news delivered daily to your inbox.