News for hackers. Stuff that matters.

A comment on Microsoft admits to signing rootkit malware in supply-chain fiasco. Parent comment

Re:Microsoft admits to signing rootkit malware in supply-cha... by gene91 on Saturday June 26, 2021 @02:33PM (#27644560)
Can Microsoft revoke their signatures on kernel drivers? If so, why haven't they revoked Genshin Impact's anti-cheat driver now that it has been proven to be a vulnerability? Is there a technical reason, or purely business?
[ Parent | on HN ]
Re:Microsoft admits to signing rootkit malware in supply-cha... by aneutron on Saturday June 26, 2021 @04:46PM (#27645679)
It's a very difficult problem to solve. Once you sign something, it's by design impossible to repudiate that signature.

That in turn means you need some other way of "revoking" or "repudiating" that signature. In the case of TLS for example, it's a certificate revocation list.

I don't know if there's such a mechanism on Windows Kernel.

[ Parent | on HN ]