Security Concern: Launcher Installs Custom Root CA Certificate for Authenticode Verification
By
vandalism
An everything bagel for the brain. Substantive, layered, well-seasoned.
Summary
A user reports a security concern about a launcher that installs a custom Root CA certificate ("Carbon Crew") onto their Windows machine. The certificate is used for Authenticode verification of downloaded launcher executables. The user warns that installing this as a trusted Root CA could expose users to having all their encrypted communications potentially compromised, as any certificate signed by this custom CA would be trusted by the system.
Key quotes
· 3 pulledHello, I've noticed that the launcher installs a custom Root CA certificate onto my machine.
After checking the code, it seems that this certificate is used for Authenticode verification of the validity of the signatures of automatically downloaded launcher executables.
with the installation of the 'Carbon Crew' CA certificate as a trusted Root CA, users of this launcher automatically become liable to having ALL their encrypted communications w
You might also wanna read
Attackers exploit FortiClient EMS vulnerability (CVE-2026-35616) to deliver infostealer to enterprise devices
Attackers are exploiting a known vulnerability (CVE-2026-35616) in FortiClient Enterprise Management Server (EMS) to deliver a broad-spectru
helpnetsecurity.com·5h ago
Critical Gogs RCE bug (CVSS 9.4) remains unpatched; exploit module now public
A critical remote code execution (RCE) vulnerability rated 9.4/10 has been discovered in Gogs, a popular open-source self-hosted Git service
theregister.com·5h ago
GrapheneOS: A privacy-focused, open-source mobile OS with Android app compatibility
GrapheneOS is a non-profit, open-source mobile operating system focused on privacy and security, with full Android app compatibility. Founde
grapheneos.org·5h ago
Anthropic Releases Free Security Plugin for Claude Code Terminal to Detect Vulnerabilities
Anthropic has released a free security-guidance plugin for its Claude Code terminal tool that autonomously reviews code edits, model outputs
cybersecuritynews.com·9h ago
Security Flaw in ChatGPT for Google Sheets Enables Data Exfiltration via Prompt Injection
OpenAI's ChatGPT extension for Google Sheets, which has over 185,000 downloads in less than a month, is vulnerable to indirect prompt inject
promptarmor.com·11h ago
Prompt Injection Attacks: The Top Security Threat Hijacking AI Chatbots
Prompt injection attacks are a critical security vulnerability in AI systems where hidden instructions within user data (like emails or docu
buff.ly·15h ago