Microsoft has issued a warning to computer users that someone may be using stolen verification certificates to deliver computer viruses over the internet.
The Seattle software giant said that a fraudster posing as a Microsoft employee managed to obtain two authentic digital certificates from VeriSign, a California computer security company. These certificates would allow the person to pass off rogue programs and possibly computer viruses as legitimate Microsoft software.
VeriSign notified Microsoft that it issued the two digital certificates - a key security feature of Microsoft's internet software - on January 29 and 30.
The problem is serious and the effects could last for years, said Russ Cooper of TruSecure Corp.
"This is an extremely huge mistake by VeriSign," he said. "There's no way that this certificate should have been given to a non-Microsoft employee."
Microsoft and VeriSign were working to correct the problem, both companies said. Users were warned to inspect for certificates that were issued on January 29 and 30, since no legitimate certificates were given on those dates, and to notify Microsoft or VeriSign if they discover them.
The FBI has also been notified, said Mahi deSilva, VeriSign's vice president, adding that the person who obtained the certificates had a sophisticated knowledge of ways to try to fool the company's security procedures. So far, VeriSign believes no one has used the certificates.
Microsoft also advised customers to set security levels to prevent viruses from being transmitted by e-mail in case the fraudulent program was opened. The company hoped to have a program available in the next two weeks that will automatically check for the fake certificates.
The program will be available to download for free off the internet for products including Windows and Internet Explorer.
Useful links
