News Leaked Nvidia Code-Signing Certificate Now Being Used by Malware

[Admin]

Among all the sensitive hardware and driver data spilled by hacking extortion group Lapsus$, there were some expired but still usable Nvidia code-signing certificates.

Leaked Nvidia Code-Signing Certificate Now Being Used by Malware : Read more

 

[digitalgriffin]

I called it.

Time for Microsoft to update revoked certs in their security update.

 

[InvalidError]

People should have the ability to install stuff with expired certificates, just have a warning popup informing that the certificate is expired or revoked to let the user know to be extra careful about the stuff's origin and that the certificate makes sense for what they downloaded.

 

[digitalgriffin]

People should have the ability to install stuff with expired certificates, just have a warning popup informing that the certificate is expired or revoked to let the user know to be extra careful about the stuff's origin and that the certificate makes sense for what they downloaded.

I more than fully agree. But there are few people who are tech savvy as us who are likely looking for an outdated driver on a cheap GPU because they can't afford anything else. So do we protect the non-tech savvy, or provide assistance to outdated hardware? I've seen more than one post here where people ask for support for their old hardware. (Usually India, Far East, or East European)

 

[InvalidError]

So do we protect the non-tech savvy, or provide assistance to outdated hardware?

Make the "expired certificate" window scary enough to scare most normal people into doing their due diligence before going through with the install and you can accommodate most of both kinds of users. The only ones left are the ones who have no clue what they are doing and will fall for just about anything anyway who are never going to be remotely safe no matter how hard you try.