Think about it. If you try and put an unsigned certificate into the Trusted Root Certificate store, Windows erases it because it is not related to the existing trusted certificates, but what is stopping someone from removing all the Windows certificates and replacing them with their own? In this way you can make it so virtually any certificate would be accepted by the Trusted Root Certificate store. This seems like a large gaping security hole.

  • 4
    And why would someone do this to themselves? – Michael Hampton Dec 2 '16 at 19:55
  • This is nuts. If I have access to a computer, albeit the access would have to be privileged, then you could theoretically swap in your own certificates and then load arbitrary driver code to access protected mode. Game over. This seems too easy, there must be measures in place to stop this from happening. Any ideas guys? – August Dec 3 '16 at 5:10
  • 1
    Unplug it and bury it in a concrete bunker? It's well known that if you can physically access the computer, it's game over. – Michael Hampton Dec 3 '16 at 5:11
  • This scares me. – August Dec 3 '16 at 6:15
  • You should look into the "evil maid attack", and then go think about your physical security some more. – Michael Hampton Dec 3 '16 at 9:54

Not being an administrator is what prevents this from happening. It's not a security hole if you already own the machine.

| improve this answer | |
  • And you're saying there are no other ways to achieve privileged access on a machine? – August Dec 3 '16 at 18:50
  • I'm saying it doesn't matter. The point of all of the security on a computer is to protect privileged access. – longneck Dec 3 '16 at 19:06
  • This is too easy. When something is too easy there is often measures in place to stop this from happening. – August Dec 3 '16 at 20:43
  • 1
    You're missing the point. Admin access gives you full control over everything. Anything you put in place to restrict access after getting admin access can be defeated BECAUSE YOU ALREADY HAVE ADMIN ACCESS. I could point to a hundred different things that are like your false certificate problem. Why not insert a hard drive filter driver? Or a key logger? Or attach to all processes as a debugger and dump memory? – longneck Dec 3 '16 at 21:23

Theoretically yes, you could do that with a lot of hassle, having in mind to establish your own "fake" trust chains. But what would you achieve? You would only get trust ON YOUR SERVER, nothing more: - outside clients will still use their own trust chains to verify any certs - your inside users are prone to you (as IT admin) mistakes, so you can put them in danger in many easier ways...but still, how could you compromise your own local users that way? By deploying hoax and phishing web sites inside your network? You can compromise them anyways :) - beside that, browsing and accessing other outside certs from your server would be almost impossible that way, as you would ruin all trust chains

So I see no security breach here, no gaps, nothing useful.

| improve this answer | |
  • No, once you get access to an arbitrary system with privileged rights, the next logical step for threat actors like Equation Group is to get a protected mode rootkit up and running. They used stolen digital certificates to insert a bogus driver, signed by a stolen certificate, into Windows, thus giving their bogus driver code (which is really just rootkit code) access to protected mode. What is stopping an adversary, after gaining privileged access, from inserting their own "driver" code by adding a bogus certificate to the certificate store? There must be countermeasures against this... – August Dec 3 '16 at 18:41
  • You are right, but still...isn't that all only possible inside local network and as an admin? – Labsy Dec 5 '16 at 8:48
  • I'm going back on what I said. Even if you have SYSTEM access or Administrator access, those permissions exist in USER mode. The OS and all it's gallantry, including signed driver code, are managed in PROTECTED mode. You could even have a bootkit such as the Stoned Bootkit, which has permissions above SYSTEM and Administrator, and still not be able to get into Protected mode. Protected mode can only be accessed by driver code, which needs to be signed and validated by certificates in the trusted certificate store, and the TCS doesn't accept foreign certificates, at least not from user mode. – August Dec 5 '16 at 20:29

Not only is this not a theoretical 'gaping security hole' - it's entirely possible and part of how certificates work.

Organisations include their own trusted root certification providers all the time. Fiddler uses a similar method to what you describe to allow decryption and analysis. Devs do it manually, too.

Security over the OS is critical - if your OS is compromised it's game over regardless.

| improve this answer | |
  • Yeah but once the system is compromised you can't just insert unsigned "driver" code for protected mode access, the certificates in the Trusted Certificate Store check to see if it has been signed by Microsoft. If bogus certificates are added to the TCS then any "driver" code signed by one of the bogus certificates will be accepted. It's not just game over if privileged access is attained, but in this scenario you'll never play again. – August Dec 3 '16 at 18:48
  • @August Well, obviously - that's why admin access is critical. To turn it around - how the hell do you imagine an operating system would work if not even the administrator could add certificates? Who would be able to maintain the trusted roots list, what about devs? Bear in mind that anyone can sign a driver - the checks are more stringent on Windows 10, but even so you just need a driver that's been signed prior to a certain date and voila. There are plenty of signed keyloggers and the like out there that simply need admin rights to install like everything else. – Dan Dec 4 '16 at 23:31
  • @August Ultimately, if the system is compromised at the root/admin level then it's game over for that system. And that goes for EVERYTHING. – Dan Dec 4 '16 at 23:31
  • I did read that bogus certificates added to the certificate store can be rejected if they do not bear in comparison to the existing legitimate certificates. I get the funny feeling that this process happens from protected mode, and you need signed driver code to access protected mode. You see the dilemma here. It's not a question of chicken before the egg, you need access to protected mode in the first place to install bogus certificates, not just administrator access. – August Dec 5 '16 at 1:21

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.