Could Lead to Global Havoc Stolen digital certificates in Microsoft's name could be used to infect millions of PCs with viruses. Millions of PC users who use Microsoft's programs could be vulnerable to fake software updates loaded with malicious code, security experts warned on Friday. Microsoft has issued a warning to customers that security software maker VeriSign mistakenly issued digital certificates to an imposter posing as a Microsoft employee. Digital signatures are a key component of online security.
Most Web surfers encounter such certificates when they're downloading software upgrades or patches.
In this case, the certificates would verify that the software updates really do come from Microsoft. Microsoft said it plans to release an update next week that will automatically detect the stolen signatures and warn users that they are invalid. It's an awareness issue. According to Russ Cooper, a Microsoft security expert with TruSecure and editor of the NTBugtraq security update list, it's too early to assess the risk at this point. The potential for damage, he said, depends on the motives behind the theft.