Microsoft unleashes ‘Death Star’ on SolarWinds hackers in extraordinary response

Re:Microsoft unleashes ‘Death Star’ on SolarWinds hackers in... by tomaszs on Wednesday December 16, 2020 @11:39PM (#25452526)

How is it possible that the trojan was able to use MS file certificates for it's own files? Isn't it that certificate works only for the original file?

[ Parent | on HN ]

Re:Microsoft unleashes ‘Death Star’ on SolarWinds hackers in... by aeternum on Thursday December 17, 2020 @01:05AM (#25453054)

MS was basically the CA. It was SolarWind's signing key that was compromised via an on-prem attack. This article is somewhat over the top, it looks like what Microsoft actually did was just revoke the cert.

[ Parent | on HN ]

Re:Microsoft unleashes ‘Death Star’ on SolarWinds hackers in... by comprambler on Thursday December 17, 2020 @02:47AM (#25453532)

No, they've had the functional equivalent of Mac Gatekeeper up since late windows 8 days called SmartScreen. They redlist the code signer cert there and it will flag the install process to the user. They've probably just done an OCSP revoke of that public key.

[ Parent | on HN ]