Under normal circumstances, only a certificate issued by Microsoft would have “All” in the root certificates “Intended Purposes” field. So any system with these drivers installed from any of the vendors will trust any certificate issued by the same CA-for “All” purposes. But this particular driver installed a certificate valid for “All” purposes. Root certificates can be installed for purposes such as timestamping, server authentication, code-signing, and so on. It was just introduced to complete the installation on Windows XP seamlessly. Ironically enough, the certificate wasn’t even needed to use the software. The installer was exactly the same for every Windows version. The silent install was designed to accommodate XP users, but it had the same effect in every Windows operating system from XP up to Windows 10. However, the audio driver skipped this step of prompting for approval (hence "silently" installing). Under normal circumstances, you would have to agree to “Always trust software from " before a certificate would be installed there. This self-signed root certificate was installed in the Trusted Root Certification Authorities store. In a recent article by RSA FirstWatch, we learned that a popular USB audio driver had silently installed a root certificate. We have talked about certificates in general before, but a recent event triggered our desire for further explanation about the ties between malware and certificates. They're issued by a certified authority (CA) and, essentially, verify that the software/website owner is who they say they are. Root certificates are the cornerstone of authentication and security in software and on the Internet.
0 kommentar(er)
