Xbox Live private keys mistakenly disclosed, says Microsoft
Microsoft statement did not list the source of the leaks but the company said that the leaked keys have so far not been used in any cyber attack.
In the security advisory released Wednesday, Microsoft said it has invalidated the leaked certificate. “To help protect customers from potentially fraudulent use of the SSL/TLS digital certificate, the certificate has been deemed no longer valid and Microsoft is updating the Certificate Trust list (CTL) for all supported releases of Microsoft Windows to remove the trust of the certificate,” reads the advisory. The leaked digital certificate cannot be used to impersonate domains, create new certificates or sign code.
However the biggest concern is that the private keys could be used to mount a in a “man-in-the-middle” attack. Potential hacker could use the leaked Xbox Live private keys to gain access to a secure connection. “Each user in the communication unknowingly sends traffic to and receives traffic from the attacker, all the while thinking they are communicating only with the intended user,” Microsoft explained. A hacker could intercept messages sent between Microsoft and the Xbox Live user. Information or sensitive data could be stolen via this method.
Posted:
Related Forum: Xbox Forum
Source: http://www.techworm.net/2015/12/xbox-live-users-open-to-hack-as-microsoft-accidentally-leaks-private-keys.html
Related Articles
Comments
DusknoirPosted:
TTG_JAMBO Please someone with knowledge explain is this the same private 2048 bit RSA key that is used to sign the Xbox live digital cert, that jtag users wouldve needed to sign off their own version of live or have any console work online without the need for authentication of any kind, or are we talking digital certs of Xbox.com website
Private keys to xbl itself, that can give someone access to APIs and stuff.
SagePosted:
Mickers It's alright, my card linked never has money on it.
That really sucks man... Sadly mine usually does have money on it :)
ThespianPosted:
Well I am most likely gonna remove all credit cards and things from my account. Not going to take the risk.
TTG_JAMBOPosted:
Please someone with knowledge explain is this the same private 2048 bit RSA key that is used to sign the Xbox live digital cert, that jtag users wouldve needed to sign off their own version of live or have any console work online without the need for authentication of any kind, or are we talking digital certs of Xbox.com website
vLunaPosted:
Hopefully nothing does happen.. and thanks to Microsoft for informing everyone about it. Would be a lot worse if it came out of the blue that someone was using your CC details.
Latest Downloads
- 01. Need for Speed: Most Wanted (2005) - SaveGame (0% career, 2 BMWs in the garage)(0)
- 02. [EU] CARX DRIFT RACING ONLINE - PROGRESS SAVE 6 SP DUO (CUSA15633)(3)
- 03. Fallout Shelter Modded Save PC(0)
- 04. Remember Me: SaveGame (The Game done 100%)(0)
- 05. The Long Drive: SaveGame (American pickup)(0)
- 06. Goemon's Great Adventure (US / NTSC) - Nintendo 64 Game Save(1)
- 07. The Long Drive: SaveGame (blue VW Beetle)(0)
- 08. Deadly Creatures | Complete Savegame(0)
- 09. Driift Mania | 100% Savegame(0)
- 10. LostWinds: Winter of the Melodias | 100% Savegame(0)
- 11. Lost Winds | 100% Savegame(0)
- 12. Mega Man 10 | Savegame(0)
- 13. Mega Man 9 | Savegame(0)
- 14. LASTFIGHT Secret character unlocked(1)
- 15. PC Horizon Forbidden West Complete Save(14)
Latest Tutorials
- 01. The Redress Of Mira 100% Walkthrough | Trophy & Achievement(435)
- 02. Russian Pinocchio Quick Trophy Guide(531)
- 03. Venatrix Quick Trophy & Achievement Guide(496)
- 04. Call of the Sea 100% Platinum Walkthrough(638)
- 05. Wire Lips 100% Platinum Walkthrough(607)
- 06. The Expanse 100% Platinum Walkthrough | Trophy & Achievement(559)
- 07. Doctor Who: The Edge of Reality - PS4 Platinum P/Thru(476)
- 08. Doctor Who:The Lonely Assassins - 100% Guide(452)
- 09. DAYMARE 1998 PS4 - Full game 100% TROPHY WALKTHROUGH(410)
- 10. Stray Platinum Walkthrough | Trophy & Achievement Guide(434)
- 11. Raji: An Ancient Epic | Complete Gameplay Walkthrough(579)
- 12. Corpse Killer: 25th Anniversary Edition - Longplay(555)
- 13. Song of Horror: Complete Edition Gameplay Walkthrough(391)
- 14. Remoteness 100% All Trophies Walkthrough(562)
- 15. Detective Inspector Mysterious Clues Platinum Walkthrough(497)
"Xbox Live private keys mistakenly disclosed, says Microsoft" :: Login/Create an Account :: 39 comments