Revoca di certificati e update di sistema

L'update di Windows di stamani contiene una revoca di certificati ("update to the certificate revocation list").

Questo update è anche necessario al fine di "keep your systems certificate list up to date".

Questa frasetta in apparenza innocua ("vabbé, uno dei soliti aggiornamenti") nasconde in realtà qualcosa di molto delicato ed importante. L'update infatti serve a rimuovere dal TrustSet alcuni Issuer Microsoft (!).

Ripeto: serve a rimuovere dal TrustSet alcuni Issuer Microsoft. Spero sia chiaro a tutti cosa significhi.

L'update riferisce un articolo della Knowledge Base Microsoft identificato con KB2718704. Cercando questo identificatore su Google si trova un security advisory emesso da Microsoft proprio ieri:

Microsoft is aware of active attacks using unauthorized digital certificates derived from a Microsoft Certificate Authority. An unauthorized certificate could be used to spoof content, perform phishing attacks, or perform man-in-the-middle attacks. This issue affects all supported releases of Microsoft Windows.

Microsoft is providing an update for all supported releases of Microsoft Windows. The update revokes the trust of the following intermediate CA certificates:

• Microsoft Enforced Licensing Intermediate PCA (2 certificates)
• Microsoft Enforced Licensing Registration Authority CA (SHA1)

http://technet.microsoft.com/en-us/security/advisory/2718704

Aggiornamento successivo

Alert (TA12-156A)
Microsoft Windows Unauthorized Digital Certificates

X.509 digital certificates issued by the Microsoft Terminal Services licensing certificate authority (CA) can be illegitimately used to sign code. This problem was discovered in the Flame malware. Microsoft has released updates to revoke trust in the affected certificates
http://www.us-cert.gov/cas/techalerts/TA12-156A.html