If you're not familiar with the Diginotar debacle, this is a Certificate
Authority whose servers were compromised and had fraudulent SSL
certificates issued. If your users hit any of the sites with these
fraudulent certificates then they are subject to spoofed content, phishing
attacks or man-in-the-middle attacks. Microsoft is actually releasing an
out-of-cycle patch to address this issue.
Unfortunately, this exposed a problem with Mac OS X's ability to warn
users who decided to "untrust" these root certificates. It doesn't work.
So far, Apple hasn't released an update to correct this. Mac users are
advised to remove the certificate completely.
More information:
"Microsoft Security Advisory (2607712)"
<http://www.microsoft.com/technet/security/advisory/2607712.mspx>
"Safari users still susceptible to attacks using fake DigiNotar certs"
<http://arstechnica.com/apple/news/2011/09/safari-users-still-susceptible-t
o-attacks-using-fake-diginotar-certs.ars?utm_source=rss&utm_medium=rss&utm_
campaign=rss>
"Removing DigiNotar Trust in OS X"
<http://krypted.com/mac-os-x/7068/>
Our Corp IT folks passed down a mandate to remove the Diginotar
certificates from our machines and so I devised the following method to
remove them from our Macs and make record of their removal. Hope folks
find it useful.
- Create an extension attribute populated by the following script:
#!/bin/sh
CONTENTS=$(security find-certificate -e info at diginotar.nl
"/System/Library/Keychains/SystemRootCertificates.keychain")
if ( test "$CONTENTS" ) then
RESULT="Certificate installed."
else
RESULT="Certificate not installed."
fi
echo "<result>$RESULT</result>"
Create a smart group to list Macs found by the extension attribute with
"Certificate installed." I have this group set to email me when anything
changes.
Create an ongoing policy triggered by "any" and scoped to the smart
group that will run the following command:
security delete-certificate -Z C060ED44CBD881BD0EF86C0BA287DDCF8167478C
"/System/Library/Keychains/SystemRootCertificates.keychain"
and to inventory the machine.
To kickstart the process I'm using Casper Remote and ARD to quickly
inventory my machines and get whether the Diginotar certificate is
installed. The policy will take over from there and remove it.
--
William Smith
Technical Analyst
Merrill Communications LLC
(651) 632-1492
