A Finnish IT professional was able to obtain an HTTPS certificate for the Finnish version of Microsoft's Windows Live service simply by asking for it.
The browser-trusted certificate authority Comodo was fooled by an e-mail address that should not have been given to a normal user in the first place.
It all started when the Finnish man, working as an IT manager, noticed in January that it is possible create multiple aliases in Microsoft Live e-mail service.
“I was wondering whether I could create an address resembling one of an admin. And just for laughs I gave it a go”, he tells Tivi.fi.
A few moments later, he had created the alias [email protected]. He decided to give the address a test run by trying to get a trusted certificate.
To his surprise, Comodo issued the certificate, no questions asked.
Had he had malicious intentions in mind, he could have created a genuine looking HTTPS-protected website. He could have used this to steal users’ data.
The man told Tivi.fi that he contacted both Microsoft and the Finnish Communications Regulatory Authority already in January but did not get a proper response from either of them.
Last Thursday he received a questionable thank you from Microsoft. The company had blocked his e-mail address, effectively making him unable to use his Lumia phone and Xbox account.
Now – two months after he notified Microsoft and the authorities – Microsoft says that the Finn’s findings are to be taken seriously. The company told Tivi.fi, that they plan to be in touch with the IT professional responsible for discovering the vulnerability.
On Monday, Microsoft removed the compromised certificate from use. In Windows 8.x, RT and Server 2012 the list of trusted certificates is updated automatically. Windows Vista, 7, Server 2009 and Server 2008 R2 require a separate update.
The Redmond giant notes that other companies should also make sure not to issue addresses or account names such as admin, administrator, postmaster, hostmaster and webmaster to outsiders.
