<story><title>A critical Windows component expires in 25 hours</title><url>http://hexatomium.github.io/2015/09/22/expires-25h/</url></story><parent_chain><item><author>erikpt</author><text>Is anyone else concerned that the disallowed certs list is downloaded over plaintext HTTP?</text></item><item><author>geofft</author><text>Following up: if anyone wants to poke around at the file, the download URL is &lt;a href=&quot;http:&amp;#x2F;&amp;#x2F;ctldl.windowsupdate.com&amp;#x2F;msdownload&amp;#x2F;update&amp;#x2F;v3&amp;#x2F;static&amp;#x2F;trustedr&amp;#x2F;en&amp;#x2F;disallowedcertstl.cab&quot; rel=&quot;nofollow&quot;&gt;http:&amp;#x2F;&amp;#x2F;ctldl.windowsupdate.com&amp;#x2F;msdownload&amp;#x2F;update&amp;#x2F;v3&amp;#x2F;static&amp;#x2F;t...&lt;/a&gt; , a CAB archive that contains a single file disallowedcert.stl. That file itself is DER-formatted ASN.1, evidently a PKCS7-signed &amp;quot;Certificate Trust List&amp;quot; (1.3.6.1.4.1.311.10.1). `openssl asn1parse -inform der -in disallowedcert.stl` reads it just fine.&lt;p&gt;There&amp;#x27;s a reference to the date 150923203626Z (2015-09-23 20:36:26 UTC) somewhere in there, but I&amp;#x27;m having trouble figuring out what it applies to.</text></item><item><author>geofft</author><text>Is that the time it was last &lt;i&gt;modified&lt;/i&gt; or the time it was last &lt;i&gt;signed&lt;/i&gt;?&lt;p&gt;The last high-profile mis-issued cert was last week, and didn&amp;#x27;t even escape the control of people who were entrusted with the CA private key. So MS might not even be manually revoking it. Before that, the last blog post on googleonlinesecurity.blogspot.com about a mis-issued certificate was ... March 23.&lt;p&gt;I would guess that it&amp;#x27;s re-signed daily, but only changes when there&amp;#x27;s an actual change to be made.</text></item><item><author>BHSPitMonkey</author><text>In the screenshot, it says that CTL was last modified in March. Judging by the date, I&amp;#x27;d guess it has an expiration of 6 months after it is issued. So, it&amp;#x27;s been nearly 6 months since the daily updates stopped occurring.</text></item><item><author>cammsaul</author><text>So the Untrusted CTL has an expiration of 25 hours. Your screenshot says &amp;quot;Did you know? ... the Untrusted CTL is updated once per day&amp;quot;. Doesn&amp;#x27;t that explain it?</text></item></parent_chain><comment><author>geofft</author><text>It appears to be a signed message, and for these sorts of things, I&amp;#x27;m more of a fan of signed data (and the transport being unimportant) than a signed transport and unsigned data: there&amp;#x27;s a lot less attack surface on both ends.&lt;p&gt;apt, yum, PGP, etc. work the same way. There remains a decent argument for a secure transport anyway for privacy &amp;#x2F; avoiding side channels, or a general desire for HTTP delenda est, but it&amp;#x27;s nowhere near as strong an argument, HTTPS only provides marginal benefit to the side channels (Tor to a hidden service is much more effective), and other engineering concerns can legitimately override these concerns.</text></comment>
<story><title>A critical Windows component expires in 25 hours</title><url>http://hexatomium.github.io/2015/09/22/expires-25h/</url></story><parent_chain><item><author>erikpt</author><text>Is anyone else concerned that the disallowed certs list is downloaded over plaintext HTTP?</text></item><item><author>geofft</author><text>Following up: if anyone wants to poke around at the file, the download URL is &lt;a href=&quot;http:&amp;#x2F;&amp;#x2F;ctldl.windowsupdate.com&amp;#x2F;msdownload&amp;#x2F;update&amp;#x2F;v3&amp;#x2F;static&amp;#x2F;trustedr&amp;#x2F;en&amp;#x2F;disallowedcertstl.cab&quot; rel=&quot;nofollow&quot;&gt;http:&amp;#x2F;&amp;#x2F;ctldl.windowsupdate.com&amp;#x2F;msdownload&amp;#x2F;update&amp;#x2F;v3&amp;#x2F;static&amp;#x2F;t...&lt;/a&gt; , a CAB archive that contains a single file disallowedcert.stl. That file itself is DER-formatted ASN.1, evidently a PKCS7-signed &amp;quot;Certificate Trust List&amp;quot; (1.3.6.1.4.1.311.10.1). `openssl asn1parse -inform der -in disallowedcert.stl` reads it just fine.&lt;p&gt;There&amp;#x27;s a reference to the date 150923203626Z (2015-09-23 20:36:26 UTC) somewhere in there, but I&amp;#x27;m having trouble figuring out what it applies to.</text></item><item><author>geofft</author><text>Is that the time it was last &lt;i&gt;modified&lt;/i&gt; or the time it was last &lt;i&gt;signed&lt;/i&gt;?&lt;p&gt;The last high-profile mis-issued cert was last week, and didn&amp;#x27;t even escape the control of people who were entrusted with the CA private key. So MS might not even be manually revoking it. Before that, the last blog post on googleonlinesecurity.blogspot.com about a mis-issued certificate was ... March 23.&lt;p&gt;I would guess that it&amp;#x27;s re-signed daily, but only changes when there&amp;#x27;s an actual change to be made.</text></item><item><author>BHSPitMonkey</author><text>In the screenshot, it says that CTL was last modified in March. Judging by the date, I&amp;#x27;d guess it has an expiration of 6 months after it is issued. So, it&amp;#x27;s been nearly 6 months since the daily updates stopped occurring.</text></item><item><author>cammsaul</author><text>So the Untrusted CTL has an expiration of 25 hours. Your screenshot says &amp;quot;Did you know? ... the Untrusted CTL is updated once per day&amp;quot;. Doesn&amp;#x27;t that explain it?</text></item></parent_chain><comment><author>kbenson</author><text>I think that may be purposeful.  If your local certificate management system is on the fritz, you don&amp;#x27;t want that rejecting updates to the core cert lists.  Probably better to fall back on some other cryptological system on the files themselves, since the content is not private, it&amp;#x27;s just the authenticity you care about.</text></comment>