News for hackers. Stuff that matters.

A comment on Private key for *.xboxlive.com certificate disclosed. Parent comment

Re:Private key for *.xboxlive.com certificate disclosed by tdicola on Tuesday December 08, 2015 @05:43PM (#10700275)
It happens. Engineer goes to upgrade the cert and copies it to a file share they didn't realize wasn't locked down. There's no evidence anyone malicious got the file but it's pretty standard protocol to just assume it's tainted and get a new cert.
[ Parent | on HN ]
Re:Private key for *.xboxlive.com certificate disclosed by meowface on Tuesday December 08, 2015 @06:43PM (#10700706)
I wish they would say how it was disclosed. Your scenario is bad, but less bad than actually sending it out to the Internet, or some malware on a dev's machine grabbing it.
[ Parent | on HN ]
Re:Private key for *.xboxlive.com certificate disclosed by eugenekolo2 on Tuesday December 08, 2015 @08:33PM (#10701284)
I give equal likelihood to it being malware related, to somebody moving just disabling a settings on some server that can potentially connect to the server hosting the key.

I don't think it's somebody just posting it online, or moving it.

[ Parent | on HN ]