Rogue root Certification!

[Sunshine-boy]

Hello friends, I was surfing the web and I found an interesting subject.

Dangerous root certificates are a serious problem. From Lenovo’s Superfish to Dell’s eDellRoot and a number of other certificates installed by adware programs, your computer’s manufacturer or a program you installed may have added a certificate that opens you to attack. Here’s how to check if your certificates are clean.
Read more here:

How to Check for Dangerous, Superfish-Like Certificates on Your Windows PC

how to check your system?

To get started, download Sigcheck from Microsoft. Open the downloaded .zip file and extract the sigcheck.exe file. For example, you could just drag and drop the file to your desktop.

Navigate to the folder containing the sigcheck.exe file you just extracted. For example, if you put it on your desktop, open the Desktop folder in File Explorer (or Windows Explorer, if you’re on Windows 7). Press and hold the Shift key on your keyboard, right-click in the File Explorer window, and select “Open command window here”.

Type the following command at the command prompt and press Enter:

sigcheck -tv

Sigcheck will download a list of trusted certificates from Microsoft and compare it to the certificates installed on your computer. If there are any certificates on your computer that aren’t on the “Microsoft Certificate Trust List”, you’ll see them listed here. If everything is good and you don’t have any rogue certificates, you’ll see the “No certificates found” message.

I did my test and I got this
I don't know why Adgaurd isn't in the Microsoft trusted list


PLS share the results

Added: another tool
RCC Download
this one is better
Scan your Windows computer for untrusted root certificates - gHacks Tech News

 

[Syafiq]

Here the results from my test:

 

[Sunshine-boy]

Hello, and thnx for the share, this means Eset SSL filter isn't into the microsoft trusted list but it doesnt means its bad i just want to know why Microsoft didnt trust it!same for Adguard!

 

[tanto259]

I also have the Adguard Personal CA root. As far as I know, Adguard, ESET, and any other SSL filtering app couldn't request for inclusion to the Microsoft Trusted Root Certificate program since they don't actually issue a public SSL certificate. The issuance is limited to your computer only. Plus, by issuing certificate to all the domains, including those they are not authorized to, they wouldn't pass auditing. Additionally, they also violate multiple regulation by the CA/B forum, such as issuing a certificate directly from the root without any intermediate certificate.

It's all about trust in this business. You trust Adguard or ESET to filter the bad guys out from your connection, even if they need to MiTM your SSL connection.

Spoiler: List of My "Rouge" Certificate

• ESET SSL Filter CA
  • Serial: 7E 42 D5 38 AD 01 AD 96 45 BA 83 86 F9 9E 3F 84
• Adguard Personal CA
  • Serial: 00 CC A6 CC FF 93 47 7A 16 6F A7 66 D9 F3 4E A7 82
• Universal ADB
  • Serial: 2F 42 BC 11 BE 8B 16 66

If you compare the serial number of my ESET CA with Syafiq's above, the serial number is different, proving that the root certificate is generated per device.

 

[Hadden]

Yes, I used RCC once to see if issues with my ID card reader were due certificates.
Nothing dangerous. ADB was listed, but I know it's not rouge
I put also sigcheck in my security apps folder

 

[Devilish]

Here is my result of rogue root certification test.
Apparently microsoft didn't have Kaspersky in their trsuted list.

Spoiler: Result screenshot