News

Microsoft: Windows Live ID Users at Risk from Fraudulent Certificates

• By Chris Paoli
• March 25, 2011

Microsoft issued a warning on Wednesday about nine fraudulent digital certificates that could potentially be abused by hackers.

The unauthorized certificates were issued by root certificate authority company Comodo Group. According to Microsoft Security Advisory 2524375, the certificates can enable hackers to carry out attacks against and retain information from users through their browsers. One certificate places Windows Live ID users at risk, Microsoft said.

"This is not a Microsoft security vulnerability; however, one of the certificates potentially affects Windows Live ID users via login.live.com," wrote Bruce Cowper, manager of the Microsoft Trustworthy group, in a blog post. "These certificates may be used to spoof content, perform phishing attacks or perform man-in-the-middle attacks against end users. We are unaware of any active attacks."

It was also revealed that the fraudulent certificates offered to Comodo for authentication came from an Iranian IP address.

"An attacker obtained the username and password of a Comodo Trusted Partner in Southern Europe," wrote Phillip Hallam-Baker, a lead contributor at Comodo, in a blog post. "We are not yet clear about the nature or the details of the breach suffered by that partner other than knowing that other online accounts (not with Comodo) held by that partner were also compromised at about the same time."

The intent behind the hack is not yet known. However, Hallam-Baker theorized that the individuals responsible could be part of a government that wants to keep tabs on unrest or rebel groups. He also said that while the IP address was traced to Iran, the location could be a false trail designed to thwart anyone searching for the culprits.

According to Microsoft, certificates associated with the following Web sites are affected:

• addons.mozilla.org
• login.skype.com
• login.live.com
• mail.google.com
• www.google.com
• login.yahoo.com (three certificates)
• "Global Trustee"

Since the disclosure, Comodo has retracted the certificates in question and listed them on its Certificate Revocation List. Users with the Online Certificate Status Protocol (OCSP) enabled in their browser will automatically have the fraudulent certificates blocked, according to Microsoft.

Microsoft, Google and the Mozilla Foundation have all since released patches and updates to their individual browsers. The Mozilla Foundation, in a press release, wrote that "current versions of Firefox are protected from this attack. We are still evaluating the possibility of further response to this issue. We encourage all users to keep their software up to date by regularly applying security updates."

For Windows users, an automatic security update is now available for all supported versions of Microsoft's OS.