Broadband Tech > Security > Security > Adobe's code signing certificate has been stolen

reply to Mele20

Re: Adobe's code signing certificate has been stolen

reply to Mele20
Trusted root certificates that are required by Windows 2000, by Windows XP, and by Windows Server 2003

Some certificates that are listed in the previous tables have expired. However, these certificates are necessary for backward compatibility. Even if there is an expired trusted root certificate, anything that was signed by using that certificate before the expiration date requires that the trusted root certificate be validated. As long as expired certificates are not revoked, they can be used to validate anything that was signed before their expiration.

For more information about how to remove root certificates from the store, click the following article number to view the article in the Microsoft Knowledge Base:
293819 How to remove a root certificate from the Trusted Root Store

»support.microsoft.com/kb/293781
--
Gladiator Security Forum
»www.gladiator-antivirus.com/

reply to StuartMW
Aside from Adobe's motives, or whatever with them, why does the Properties box claim the cert is "OK" when I downloaded Flash Player installer AFTER the expiration time today? The cert is NOT "OK" and that is a bit scary that the Properties box claims otherwise.

As for Adobe using multiple certs with different expiration dates for the same Flash Player version that is crazy and certainly not of benefit to the user. (But then since when has Adobe been concerned with benefiting the user)?
--
When governments fear people, there is liberty. When the people fear the government, there is tyranny. Thomas Jefferson

reply to Name Game

reply to MagnusM
I would assume if you were on a sever and the IT guys had it set up..you might not be able to install it or would get a warning.

reply to Mele20

reply to Mele20
my cert for the google chrome adobe flash does not expire until dec 2012 as I recall.

It is a 15 e5 ac 0a 48 70 63 71 8e 39 da 52 30 1a 04 88 which is a compromised cert... I could care less since we already know the files out there in the wild that used this cert and they certainly are not adobe stuff..

reply to Mele20

reply to Name Game
I figured it out. I didn't pay enough attention to the fact there is a countersigner to the Adobe digital signature that has expired. The countersigner is Symantec Time Stamping Countersigner and it doesn't expire until December 31, 2012.
--
When governments fear people, there is liberty. When the people fear the government, there is tyranny. Thomas Jefferson

Purpose for that one is to attest the thing was signed with the current time.

The adobe cert purpose was to..

. Ensures software came from the software publisher
and
. Protects the software from alteration after publication

reply to MagnusM

It indicates just what the info states;

. Ensures software came from the software publisher
and
. Protects the software from alteration after publication

And I assume you downloaded and installed it before 10/1/2012

AND you know where it came from.

is that the IE or non IE version ?

»www.oldapps.com/flash_player.php···yer=8243
--
Gladiator Security Forum
»www.gladiator-antivirus.com/

reply to MagnusM
I am ready for HTML5 to become ubiquitous so that everyone can dump Flash once and for all. There are already free and open codecs out there for the audio/video decoding.

I see it as a backup not a replacement

»en.wikipedia.org/wiki/Comparison···nd_Flash

reply to Name Game

reply to MagnusM
Post please if you personally first check the certs from any Adobe product before you install it.