Hello, welcome to the Friday, February 17th, 2017 edition of the Santernet Storm Center's

Stormcast. My name is Johannes Orich and I'm recording from Jacksonville, Florida. In case you

haven't heard yet, Microsoft now officially announced that February's patches will be rolled into the

March update. So you will not rolled into the March update.

So you will not see a distinct February release.

This sounds like a reasonable way to deal with this issue,

as companies probably would have had a hard time scheduling extra work and so for a special patch Tuesday sometime later in February.

Cable modem ISPs are dealing with the fallout from last year's league of a private key by

router maker AVM. AVM is known for its Fritzbox routers, some of which integrate cable modems. The brand is mostly sold in Europe. Initially,

German website Heise.de.de reported back in November that some AVM cable modems contain

not only AVM's certificate authority certificate, but also the private key to go with it.

When reading about this back in November, I didn't give it too much thought as this is somewhat

a typical flaw for routers, and I didn't expect this to have much repercussions beyond

AVM, which, like I said, has a fairly limited distribution.

But it turns out that for cable modems, this is a flaw that transcends AVM.

For a cable modem to work with DOCS-compatible ISPs, the modem needs to contain a unique certificate that is assigned to the modem.

The leaked certificate authority pair was a specific certificate authority signed by the European DOCSIS

organization and it can be used to create rogue certificates that will in turn enable an attacker

to clone modems and steal service.

There are two root certificate authorities that cable ISPs typically trust.

One is the US DOCS organization Cable Labs and the other one is this EurodoxS organization, which

is similar to the US version, a little bit different frequency specs, but ISPs tend to trust

...