The Broken Shield: Measuring Revocation Effectiveness in the Windows Code-Signing PKI
summary
Researchers collect seven datasets, build a pipeline to map code‑signing certificates to Windows CRL/OCSP endpoints, and measure revocation end‑to‑end. Key findings: average revocation delay is 5.6 months, capture‑recapture estimates show about three times more compromised certificates in the wild than security feeds observe, CAs set wrong effective‑revocation dates for ~5% wrong effective date of revoked certs so signed malware remains valid, ~60% of CRL/OCSP endpoints are unreachable and ~5% return 404, and 90 certs show inconsistent OCSP vs CRL answers.
AI-written summary · about
chapters (12)
- 0:00Introduction and motivation
- 2:25Revocation process framework
- 2:58Discovery of compromises
- 3:44Invalidating signed malware
- 4:54Disseminating revocation data
- 6:28Research methodology
- 7:44Measurement of revocation delay
- 9:29Estimating compromised certs
- 12:20Analyzing revocation policies
- 15:32Infrastructure and findings
- 19:23Conclusion and data release
- 20:35Discussion and Q&A
related talks
30mMalicious Code-signing at Scale: How Attackers Impersonate Thousands of Real Businesses
30mTrust Engineering: Building Security Leadership at Early-Stage...
48mChain of Fools: An Exploration of Certificate Chain Validation Mishaps
32mA SSLippery Slope: Unraveling the Hidden Dangers of Certificate Misuse
16mPKI problem: who we actually trust
50mThe Many Faces of Identity
45mMillions Of Public Certificates Are Reusing Old Private Keys
51mCertificate Transparency Logs: Roadmaps to Riches or Ruin?