I ran across some little seen/known documentation linked below related to the root CA programs of some various vendors, linked below.
All of these links cover what is required to become, and remain a trusted root CA for their products.
When looking over Microsoft's my thoughts are:
-
- Reading all of section 6.A and 6.B, they reserve the right to pull root certificates for any compromise/security incident/exceptional circumstance.
- They just so happen to provide the exact thing to email and the email address to send it to <[email protected]> per section 6.D.1 for when this kind of security incident occurs.
This leads me to wonder how and if they verify that a notice of these kinds of incidents are valid. For example, if a "security incident" occurs, there's a very real possibility that a signed message by them wouldn't guarantee that the notice was written by an authorized person, because the CA keys could realistically have been stolen. They couldn't check S-MIME or Document Signing Certificate if there was a root CA PKI breach, as then a malicious S-MIME or Document Signing Certificate could just be generated and used.
Because this isn't a reasonable way to verify the identity of the sender, and there's no detail as to how they would verify this. This would lead me to wonder if there's a possibility of a malicious actor being able to fraudulently email that form off to the proper location, and have a certificate removed.
Please note that these root CAs are extremely important, because what if no certificates from any root CA worked anymore for any purpose (code signing, TLS (https), or document signing)? This could potentially show insecure website warnings on huge groups of websites.
This is interesting, because people at Microsoft have to deal with emails about these security things. People fall for all kinds of dumb tricks. Theoretically, if we knew how to contact Microsoft in the proper way, it might be possible to trick Microsoft through email deception to pull any arbitrary root certificate from their trusted root CA list.
I just find this really interesting, and this is a truly theoretical idea on my behalf. I will take no actions on this other than potentially reaching out to see if they're willing to share some details about how they might verify these notices.
