RE: trust? - win2k source code tools

["Mike Fratto" <mfratto () nwc com>]

> NOW EVERY EXECUTABLE IS TRUSTED AND DIGITALY SIGNED
>
> found this interesting... 
> \win2k\private\inet\mshtml\build\scripts\tools\x86
>
> iexpress.exe 
> signcode.exe
> makecert.exe ( DigSig.dll )
>
> ( in fast food voice ) and who would you like your package to 
> be certified from today sir? 
> \win2k\private\ispu\pkitrust\initpki\certs\

Nah, unless the private keys were in the directory, all you have are tools
to sign a binary. Big deal. The signatures aren't "trusted" until the target
has the certificate with the corresponding public key in the localkey store.

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html