The hacker who calls himself "Comodohacker" said this week that he could have used digital certificates stolen from a Dutch firm to issue fake updates to Windows PCs. If Comodohacker's assertion is accurate, he would have been able to push malware to Windows machines via the operating system's Windows Update service. Microsoft said that was impossible.
Comodohacker, who claims to be a 21-year-old Iranian, has taken credit for several attacks against certificate authorities, or CAs, the organizations and companies authorized to issue SSL (secure socket layer) certificates. In two of those attacks -- of Comodo in March and more recently of DigiNotar -- certificates were fraudulently generated. Among the 531 certificates stolen in the hack of Dutch-based DigiNotar were several that could be used to impersonate Microsoft's update services.
Comodohacker said he could exploit those certificates. "I'm able to issue Windows update[s]," Comodohacker claimed in one of several statements he has posted this week on Pastebin. "Microsoft's statement about Windows Update and that I can't issue such update is totally false!" Last weekend, Microsoft said that the certificates stolen from DigiNotar weren't enough to deliver actual updates.
Comodohacker, who claims to be a 21-year-old Iranian, has taken credit for several attacks against certificate authorities, or CAs, the organizations and companies authorized to issue SSL (secure socket layer) certificates. In two of those attacks -- of Comodo in March and more recently of DigiNotar -- certificates were fraudulently generated. Among the 531 certificates stolen in the hack of Dutch-based DigiNotar were several that could be used to impersonate Microsoft's update services.
Comodohacker said he could exploit those certificates. "I'm able to issue Windows update[s]," Comodohacker claimed in one of several statements he has posted this week on Pastebin. "Microsoft's statement about Windows Update and that I can't issue such update is totally false!" Last weekend, Microsoft said that the certificates stolen from DigiNotar weren't enough to deliver actual updates.
