News

Microsoft: Windows Live ID Users at Risk from Fraudulent Certificates

Microsoft issued a warning on Wednesday about nine fraudulent digital certificates that could potentially be abused by hackers.

The unauthorized certificates were issued by root certificate authority company Comodo Group. According to Microsoft Security Advisory 2524375, the certificates can enable hackers to carry out attacks against and retain information from users through their browsers. One certificate places Windows Live ID users at risk, Microsoft said.

"This is not a Microsoft security vulnerability; however, one of the certificates potentially affects Windows Live ID users via login.live.com," wrote Bruce Cowper, manager of the Microsoft Trustworthy group, in a blog post. "These certificates may be used to spoof content, perform phishing attacks or perform man-in-the-middle attacks against end users. We are unaware of any active attacks."

It was also revealed that the fraudulent certificates offered to Comodo for authentication came from an Iranian IP address.

"An attacker obtained the username and password of a Comodo Trusted Partner in Southern Europe," wrote Phillip Hallam-Baker, a lead contributor at Comodo, in a blog post. "We are not yet clear about the nature or the details of the breach suffered by that partner other than knowing that other online accounts (not with Comodo) held by that partner were also compromised at about the same time."

The intent behind the hack is not yet known. However, Hallam-Baker theorized that the individuals responsible could be part of a government that wants to keep tabs on unrest or rebel groups. He also said that while the IP address was traced to Iran, the location could be a false trail designed to thwart anyone searching for the culprits.

According to Microsoft, certificates associated with the following Web sites are affected:

  • addons.mozilla.org
  • login.skype.com
  • login.live.com
  • mail.google.com
  • www.google.com
  • login.yahoo.com (three certificates)
  • "Global Trustee"

Since the disclosure, Comodo has retracted the certificates in question and listed them on its Certificate Revocation List. Users with the Online Certificate Status Protocol (OCSP) enabled in their browser will automatically have the fraudulent certificates blocked, according to Microsoft.

Microsoft, Google and the Mozilla Foundation have all since released patches and updates to their individual browsers. The Mozilla Foundation, in a press release, wrote that "current versions of Firefox are protected from this attack. We are still evaluating the possibility of further response to this issue. We encourage all users to keep their software up to date by regularly applying security updates."

For Windows users, an automatic security update is now available for all supported versions of Microsoft's OS.

About the Author

Chris Paoli (@ChrisPaoli5) is the associate editor for Converge360.

Featured

  • The 2021 Microsoft Product Roadmap

    From Windows 10X to the next generation of Microsoft's application server products, here are the product milestones coming down the pipeline in 2021.

  • Microsoft Says System Center 2022 Will Arrive Early Next Year

    Microsoft is planning to release its new System Center product in the first quarter of 2022, with a private preview arriving within months.

  • Microsoft Talks Up Windows Server 2022's Azure Integrations

    Windows Server became available on Sept. 1; last week, Microsoft gave the product its official unveiling, focusing on all of the other products and services it will work with.

  • 2021 Microsoft Conference Calendar: For Partners, IT Pros and Developers

    Here's your guide to all the IT training sessions, partner meet-ups and annual Microsoft conferences you won't want to miss.