2

Windows update sends software that gets installed on your system. Amongst other things, they might send you root certificates. It is clear in any way that if anyone could tamper with the stuff microsoft sends you, we would be in big trouble.

Obviously MS should use some signing/encrypting of the stuff they send, but I cannot find any references on the net on how exactly they do this...

The search terms "windows update security" are a bit awkward.

2
  • I would worry more about the fact that you are implicitly placing your trust in the root certificates provided by Microsoft than the transmission mechanism. Note that I'm not particularly worried about either. Jul 10, 2010 at 18:57
  • what is wrong with the root certificates microsoft provides?
    – ufotds
    Oct 10, 2010 at 21:02

3 Answers 3

2

They use (at least) public key certification and TLS/SSL. Beyond that, there's probably a few proprietary secrets involved.

Here in the MS privacy statement (as referenced by Windows Help when searching info about updates) was the closest 'direct', plain-English reference I could find showing they use SSL to transfer information.

Aside from that, and assuming your scenario:

To pull this off the black-hats would either have to gain control, or spoof the MS update servers, or convince your copy of Windows to go to another server.

They would also have to correctly encrypt and sign the fake updates they are sending you to convince your Windows they are legit, or hack your Windows to accept their incorrect encryption.

If they could hack your Windows machine and change those things, then they've already got all the access to you they need.

If they wanted to hit a broad audience via Windows Updates without hacking each machine, they'd have to do it via the fake/spoofed server method, which would be exceedingly difficult.

Hope that helps ease your fears... :)

0

The packages are all digitally signed and the transport of the packages is secured by SSL.

1
  • 1
    Do you have a reference?
    – ufotds
    Jul 10, 2010 at 6:27
-1

http://technet.microsoft.com/en-us/library/cc751157.aspx may not be a direct answer to your question, but it will certainly provide a good jumping off point.

Incidentally, you just have to talk nicely to Google: http://www.google.com/search?ie=UTF-8&q=%22windows+update%22+%22root+certificate%22+%22certificate+authority%22 :)

1
  • thanks, that is definitely an interesting article, but it doesn't answer the question. I didn't know about the MD5 weakness yet.
    – ufotds
    Jul 10, 2010 at 6:45

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .