How does it validate the updates, exactly?
Microsoft supposedly has source IP addresses known by their update clients, so that DNS spoofing won't work.
Microsoft supposedly has source IP addresses known by their update clients, so that DNS spoofing won't work.
Microsoft has leaked keys that weren't used for code signing. I've been on the receiving end of this actually, when someone from the Microsoft Active Protections Program accidentally sent me the program's email private key.
Microsoft has been tricked into signing bad code themselves, just like Apple, Google, and everyone else who does centralized review and signing.
Microsoft has had certificates forged, basically, through MD5 collisions. Trail of Bits did a good write-up of this years ago.
But I can't think of a case of Microsoft losing control of a code signing key. What are you referring to?
Attackers today may be willing to spend a few million dollars to access those keys.