14 ms·
Patch Critical Cryptographic Vulnerability in Microsoft Windows [pdf]
- CrazyStat 7y agoGuess this is what Krebs was referring to yesterday: https://krebsonsecurity.com/2020/01/cryptic-rumblings-ahead-of-first-2020-patch-tuesday/ https://krebsonsecurity.com/2020/01/cryptic-rumblings-ahead-... And the discussion on HN: https://news.ycombinator.com/item?id=22039481 https://news.ycombinator.com/item?id=22039481
- kornholi 7y agoFrom Krebs tweets: The NSA's Neuberger said this wasn't the first vulnerability the agency has reported to Microsoft, but it was the first one for which they accepted credit/attribution when MS asked. Sources say this disclosure from NSA is planned to be the first of many as part of a new initiative at NSA dubbed "Turn a New Leaf," aimed at making more of the agency's vulnerability research available to major software vendors and ultimately to the public.
- mrguyorama 7y ago>a new initiative at NSA dubbed "Turn a New Leaf," More like "do the actual job they are paid to do"
- eyegor 7y agoThey are paid to collect intelligence for the benefit of the american people, not american companies. Luckily citizens united hasn't stretched that far.
- monoideism 7y agoTheir mission also explicitly includes information assurance: Mission Statement The National Security Agency/Central Security Service (NSA/CSS) leads the U.S. Government in cryptology that encompasses both signals intelligence (SIGINT) and information assurance (now referred to as cybersecurity) products and services, and enables computer network operations (CNO) in order to gain a decision advantage for the Nation and our allies under all circumstances.
- Seenso 7y agoThey've got to balance both roles. IIRC, in earlier times the government didn't use as much COTS stuff, and civilian computer systems weren't so critical, so the roles were easier to separate. The NSA developed whole series of secret encryption algorithms for the exclusive use of the government/military, and civilian algorithms weren't approved to secure classified communications. https://en.wikipedia.org/wiki/NSA_cryptography https://en.wikipedia.org/wiki/NSA_cryptography
- A4ET8a8uTh0 7y agoI always wondered why Barr, Comey and basically every AG I paid attention to, consistently want to break encryption for the populace. I guess it makes sense proponents of those changes would be ok of breaking it for the proles of they thought their secrets are protected.
- thfuran 7y agoYou don't see how a lack of critical vulnerabilities is software infrastructure is of benefit to citizens?
- diffeomorphism 7y agoNo, I don't see how this is part of foreign intelligence/surveillance/espionage work. It is good that these vulnerabilities are fixed, of course. But shouldn't that be at least a separate partially independent branch of the NSA? Otherwise you get a large conflict of interest.
- xrayzerone 7y agoTheir job is to collect signals intelligence and execute cyber warfare operations. Not whatever you think it is.
- mrchucklepants 7y agoTheir job is more than that. "The National Security Agency/Central Security Service (NSA/CSS) leads the U.S. Government in cryptology that encompasses both signals intelligence (SIGINT) and information assurance (now referred to as cybersecurity) products and services, and enables computer network operations (CNO) in order to gain a decision advantage for the Nation and our allies under all circumstances." [1] https://www.nsa.gov/about/mission-values/ https://www.nsa.gov/about/mission-values/
- xrayzerone 7y agoSo...SIGINT and CNO. Exactly as I stated.
- toomuchtodo 7y agoSecurity assurance isn’t necessarily cyber warfare. To have the high ground is not the same as using it offensively, hence the expectation of defensive posture as part of the NSA’s mission (although admittedly some offensive activities are to be expected, depending on the situation, such as Stuxnet and Iran).
- ericmason 7y agoNot sure if you’re just being snarky, but the NSA’s stated mission includes helping with cyber security: https://www.nsa.gov/about/mission-values/ https://www.nsa.gov/about/mission-values/
- xrayzerone 7y agoAnd what do you think the end state of all that cybersecurity research is?
- ct520 7y agomore like someone with some commonsense decided to capitalize on disclosing issues when other countries get zero days. Oh well, guess we can't use this anymore Bob, china has been exploiting it over the past week. Call Microsoft lets at least get some free PR in exchange of having to give this up.
- reaperducer 7y agoYou write that like it's a bad thing.
- SlowRobotAhead 7y agoYou can do the right thing for the wrong reasons.
- toyg 7y agoThey have probably done that for a while (this is the first public attribution, not the first disclosure); but they are now blowing their trumpet because they need some good PR. Why? Snowden.
- idlewords 7y agoMuch more likely the bad reaction to Eternal Blue.
- toyg 7y agoEternalBlue would have not received that much coverage had it not happened after Snowden proved that the American public cannot trust the agency. They had been dragged to the foreground before without repercussions, because reactions were limited to the IT world. Snowden made it a general-public issue, and now they are forced to to shape up.
- jka 7y agoAn alternative angle that could make sense is that it shows that they're not purely intent on hoarding exploits (particularly dangerous ones) and are willing to report them to software vendors in order to reduce everyone's risk profile. That'd be more of a communal-good, de-escalation approach. There's certainly something to be said for the fact that it displays the talent and expertise available too though (i.e. helping for recruitment).
- mzs 7y agoThe tweet* from the call with reporters - a cynical person might think instead that NSA thought that with the similarity to the LE and FF flaws it was not much longer before a hostile actor would find this crypt.dll flaw so it was time to notify MS. * https://twitter.com/briankrebs/status/1217125030452256768 https://twitter.com/briankrebs/status/1217125030452256768
- blaser-waffle 7y agoDidn't the FBI or NSA push for flawed Elliptical Curve Crypto in the past? Could be the knew about it for a while and had milked it hard until they caught someone else using it. Or like the parent said, previously discovered flaws meant that someone might catch this one, too.
- mzs 7y agoThere is no evidence that US push flawed curves.
- alasdair_ 7y ago>There is no evidence that US push flawed curves. "Reuters reported in December that the NSA had paid RSA $10 million to make a now-discredited cryptography system the default in software used by a wide range of Internet and computer security programs. The system, called Dual Elliptic Curve, was a random number generator, but it had a deliberate flaw - or “back door” - that allowed the NSA to crack the encryption." https://www.reuters.com/article/us-usa-security-nsa-rsa/exclusive-nsa-infiltrated-rsa-security-more-deeply-than-thought-study-idUSBREA2U0TY20140331 https://www.reuters.com/article/us-usa-security-nsa-rsa/excl...
- mzs 7y ago"random number generator"
- tptacek 7y ago"Dual Elliptic Curve" is an RNG, a PKRNG, that works by using a public key to encrypt its state, which is then directly revealed (as public key ciphertext) to callers (for instance: in the TLS random blob). The problem with PKRNGs has nothing to do with elliptic curves; you could design one with RSA as well. The problem is that for a given public key, there's also a private key, and if you have that private key you can "decrypt" the random value to reveal the RNG's state. That's not a flawed curve that NSA pushed; it's a much more straightforward cryptographic backdoor.
- cafxx 7y ago> Sources say this disclosure from NSA is planned to be the first of many as part of a new initiative at NSA dubbed "Turn a New Leaf," aimed at making more of the agency's vulnerability research available to major software vendors and ultimately to the public. Sounds like "we find so many critical bugs... we don't need all of them to achieve our goals, so let's blow some of them for PR"
- chance_state 7y agoI think it's more like, "We find so many critical bugs, let's blow some of them for PR once we discover that adversaries are using them too."
- swarnie_ 7y agoBull.... A more likely scenario is they've been sat on this for years and finally saw another actor using it in the wild.
- chance_state 7y agoSo... exactly what I said?
- Havoc 7y agoI like NSA being more active, but the concept of trusting NSA on crypto is just never gonna happen. Their core mandate is being able to break it so the whole concept is a non-starter
- tptacek 7y agoThis kind of logic is attractive on message boards but makes little sense in the real world. What NSA needs are NOBUS ("nobody but us") backdoors. Dual_EC is a NOBUS backdoor because it relies on public key encryption, using a key that presumably only NSA possesses. Any of NSA's adversaries, in Russia or Israel or China or France, would have to fundamentally break ECDLP crypto to exploit the Dual_EC backdoor themselves. Weak curves are not NOBUS backdoors. The "secret" is a scientific discovery, and every industrialized country has the resources needed to fund new cryptographic discoveries (and, of course, the more widely used a piece of weak cryptography is, the more likely it is that people will discover its weaknesses). This is why Menezes and Koblitz ruled out secret weaknesses in the NIST P-curves, despite the fact that their generation relies on a random number that we have to trust NSA about being truly random: if there was a vulnerability in specific curves NSA could roll the dice to generate, it would be prevalent enough to have been discovered by now. Clearly, no implementation flaw in Windows could qualify as a NOBUS backdoor; many thousands of people can read the underlying code in Ghidra or IDA and find the bug, once they're motivated to look for it.
- api 7y agoThis is yet another illustration of why complexity is evil in cryptographic and security critical code. It's evil everywhere, but it's particularly evil there. The relationship between bugs and complexity is exponential, not linear. X.509 is an over-engineered legacy-cruft-encrusted nightmare. I've implemented stuff that uses it and I never, even after the most careful auditing by myself and peers, leave with the sense that I have handled everything correctly or that my code is totally air-tight.
- rst 7y agoThe bug is being publicly described as specific to the implementation of a particular class of cryptographic primitives (ECC). If that's accurate, simplifying the certificate data format (unnecessarily messy though it may be) wouldn't do much to mitigate this particular issue.
- tptacek 7y agoTo the extent it's X.509 allowing curve parameters to be specified alongside signatures and public keys, this is indeed a case where all the extra joinery in X.509 is creating exploitable complexity, and the point 'api is making is well taken.
- cpascal 7y agoThe actual advisory from Microsoft (CVE-2020-0601): https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-0601 https://portal.msrc.microsoft.com/en-US/security-guidance/ad... > A successful exploit could also allow the attacker to conduct man-in-the-middle attacks and decrypt confidential information on user connections to the affected software.
- mrpippy 7y agoAt least this only affects Windows 10 (as far as I can tell)
- mrchucklepants 7y agoWindows 7 reached EOL today so they may leave it as is if it is affected.
- gruez 7y agoAccording to https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-0601 https://portal.msrc.microsoft.com/en-US/security-guidance/ad..., it doesn't look like windows 8.1 received a patch either, and that's still in support. Maybe only windows 10 has ECC support, and therefore any previous versions are not affected? Also, according to https://support.microsoft.com/help/4534310 https://support.microsoft.com/help/4534310, it looks like Windows 7 got security patches for this month.
- BlueTemplar 7y agoIndeed, got like 3 patches for Win7 this Tuesday.
- morpheuskafka 7y agoWindows 8.1 is still supported and does not have a patch either, so it looks like maybe it does actually affect 10 only.
- shantara 7y ago>This vulnerability affects all machines running 32- or 64-bit Windows 10 operating systems, including Windows Server versions 2016 and 2019 https://www.us-cert.gov/ncas/alerts/aa20-014a https://www.us-cert.gov/ncas/alerts/aa20-014a
- jve 7y agoOther CVEs include updates for Windows 7 and Windows 2008, for example CVE-2020-0608 | Win32k Information Disclosure Vulnerability: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-0608 https://portal.msrc.microsoft.com/en-US/security-guidance/ad...
- age_bronze 7y agoNothing screams "we have microsoft keys!" harder than the fact that the only vulnerabilities reported by the NSA is a cryptographic validation bug. If I had to guess exactly what kind of vulnerabilities they do not need, this is exactly those kind. Who needs crypto validation bug when you already own microsoft's keys?!
- macinjosh 7y agoI think you're spot on. Everything agencies at this level do is calculated and weighed carefully. They definitely would not seek to patch a useful vuln. It is a PR stunt.
- cliqueiq 7y agoThinking with my tin-foil hat: Same date as windows 7 last patch right? Not sure if this was a risk decision or an intentional message.
- BlueTemplar 7y agoThey likely have the control over the Intel IME backdoor too. And maybe even the (Ryzen) AMD equivalent.
- cesarb 7y agoFollowing a couple of twitter threads led me to this PDF: https://media.defense.gov/2020/Jan/14/2002234275/-1/-1/0/CSA-WINDOWS-10-CRYPT-LIB-20190114.PDF https://media.defense.gov/2020/Jan/14/2002234275/-1/-1/0/CSA... (the tweet where I found it at https://mobile.twitter.com/NSAGov/status/1217152211056238593 https://mobile.twitter.com/NSAGov/status/1217152211056238593 has an image version of that PDF, in case you don't trust that domain)
- chrismartin 7y agoDo any browsers use CryptoAPI for TLS certificate validation?
- zokier 7y agoI think classic IE would do so.
- svenfaw 7y agoSo does Chrome, if I'm not mistaken
- WorldMaker 7y agoFirefox might with an Enterprise flag on?
- KwanEsq 7y agoThat can only make it check the system certificate store for trusted roots etc, it'd still use NSS for the crypto operations is my understanding.
- Uptrenda 7y agoNone of these links describe how the exploit works. I found this: https://media.defense.gov/2020/Jan/14/2002234275/-1/-1/0/CSA-WINDOWS-10-CRYPT-LIB-20190114.PDF https://media.defense.gov/2020/Jan/14/2002234275/-1/-1/0/CSA... So based on my limited understanding: 1. The certificates have a place for defining curve parameters. 2. The attacker specifies their own parameters so that they match the start of a standard curve but choose the rest of the parameters themselves. With the right ECC math they are able to generate a valid signature for the certificate even though they don't own the private key corresponding to the original curve. 3. The old crypto API -didn't- check that certificates were signed from a fixed set of valid parameters. It would just check for sig validity allowing for spoofing of the cert. Interesting stuff. So you might be able to cryptographically prove if there was ever any attacks in the wild from this at a given time (if we assume dates are checked at least)? I wonder what happens at the Microsoft Security Response Center when a big vuln hits like this? Does it tie up all their resources just working on the one vuln?
- tptacek 7y agoGood find. This page should almost certainly be the headline article on HN, at least until someone does a full write-up of the vulnerability --- but the vulnerability here looks very simple (and gross): if you can define your own curve parameters and get CryptoAPI to honor them, you can sign anything.
- deleted 7y ago[deleted]
- dc352 7y agoThe only way to do it (I'm lazy so didn't read any of the documents - my gut feeling of an engineer) ... is to use ECDH, which provides EC params in ServerKeyExchange. CryptoAPI might have used those and just pull the public key from the cert.
- Hello71 7y agoSounds similar to the post from a few days ago about the Firefox WebCrypto allowing too much adjustment of DH parameters: https://news.ycombinator.com/item?id=21980199 https://news.ycombinator.com/item?id=21980199
- m0xte 7y agoAnyone got any news on Windows 7 seeing as it's still 25% market share approx according to statcounter?
- floatingatoll 7y agoDoes Windows 7 crypt32.dll support ECC?
- withinrafael 7y agoYes. https://docs.microsoft.com/en-us/windows/win32/secauthn/tls-cipher-suites-in-windows-7 https://docs.microsoft.com/en-us/windows/win32/secauthn/tls-...
- mzs 7y agobut only shortname curves
- rkagerer 7y agoDoes that mean it's unaffected?
- mzs 7y agoI would expect everything not patched today is unaffected for such a reason yes.
- BlueTemplar 7y agoBut Win7 was patched this Tuesday...
- mzs 7y agoThat was the last roll-up not this security update.
- tptacek 7y agoFrom a conversation with Thomas Pornin, a plausible explanation given the details provided in the DoD advisory: Given an ECDSA signature and control over the curve domain parameters, it's straightforward to create a second private key that matches the original public key, without knowledge of the original signing private key. Here's how: To start with, you need to understand a little bit about how curve cryptography works. A curve point is simply the solution to an equation like y^2 = x^3 + ax + b mod p The "curve" itself consists of the parameters a, b, and p; for instance, in P-256, a is -3, b is (ee35 3fca 5428 a930 0d4a ba75 4a44 c00f dfec 0c9a e4b1 a180 3075 ed96 7b7b b73f), and p is 2^256 - 2^224 + 2^192 + 2^96 - 1. To use that curve for cryptography, we standardize a base point G, which generates all the points we'll use. A private key in ECC is simply a scalar number k mod p; the public key corresponding to that private key is kG (the curve scalar multiplication of the point G times our secret k). Everybody using P-256 uses the same base point; it's part of the standard. Assume that we have a signature validator in CryptoAPI that allows us to specify our own nonstandard base point. We're ready to specify the attack; it's just algebra: Let's call Q the public key corresponding to the signature; for instance, Q could be the ECC public key corresponding to an intermediate CA. Q is a point on a named curve (like P-256). Q = xG for some private key x; we don't, and won't ever, know x. G is the standard generator point for (say) P-256. What we'll do is define a "new curve", which is exactly P-256, but with a new generator point. We'll generate our own random private key --- call it x' --- and then from that random private key compute a malicious generator G' = (1/x')*Q. On our "new curve", Q remains a valid point (in fact, our evil curve is the same curve as P-256, just with a different generator), but now Q' = x'G', and we know x'. Now we sign a fake EE certificate with our evil private key x'. Presumably, Windows is just looking at the public key value and, reading between the lines of the DoD advisory, the curve equation, but not the base point. By swapping base points, we've tricked Windows into believing the private key corresponding to Q is x', a key we know, and not x, the key we don't know. I'm paraphrasing a shorter writeup Pornin provided, and the basic curve explanation is mine and not his, so if I've worded any of this poorly, blame me and not Thomas Pornin. The actual exploit-development details of the attack will involve figuring out in what circumstances attackers can swap in their own base point; you'd hope that the actual details of the attack are subtle and clever, and not as simple as "anyone could have specified their own base point straightforwardly at any time". See also this related exercise in Sean Devlin's Cryptopals Set 8: https://toadstyle.org/cryptopals/61.txt https://toadstyle.org/cryptopals/61.txt This attack --- related but not identical to what we suspect today's announcement is --- broke an earlier version of ACME (the LetsEncrypt protocol).
- deleted 7y ago[deleted]
- vermilingua 7y agoCould someone clarify: does this allow the creation of fake certificates that are accepted as authentic by any crypto library? Or rather, does it treat such faked certificates as authentic itself?
- gruez 7y ago> Could someone clarify: does this allow the creation of fake certificates that are accepted as authentic by any crypto library? No, only the Windows native one. For instance, Firefox (which uses NSS) would be safe.
- emayljames 7y agoAlthough, if one point can be exploited to gain access to one area, then privilege escalate or exploit from that vantage point, then a lot is at stake.
- es56yhse6 7y agoInteresting comment on reddit: > Within the federal space, we've been making unprecedented plans for patching systems as soon as this patch is released today. In my agency we're going to be aggressively quarantining and blocking unpatched systems beginning tomorrow. This patch has been the subject of many classified briefings within government agencies and military. https://old.reddit.com/r/sysadmin/comments/eoll74/all_hands_on_deck_major_ms_update_coming_today/ https://old.reddit.com/r/sysadmin/comments/eoll74/all_hands_...
- Bluecobra 7y agoThe Department of Homeland Security issued an emergency directive today for federal agencies to patch their systems within 10 business days: https://cyber.dhs.gov/ed/20-02/ https://cyber.dhs.gov/ed/20-02/
- mzs 7y agoAnd that's for civilian systems. The only other time I can recall this happened was with the DNS vuln.
- trulyrandom 7y agoThe advisory from Microsoft is quite bizarre. It focuses on code signature validation, rather than X.509 as a whole. It also doesn't say anything about how the vulnerability itself works. Vague advisories like this are dangerous, because it gives adversaries an advantage over IT departments that don't know which system they should patch first. It would be much better if everyone understood exactly what the impact is from the get go. The NSA advisory is a bit better, but still doesn't tell us how exactly the ECC certificate validation bug works. We're left with only a few hints.
- JackRabbitSlim 7y agoX509 as a whole is fine and this isn't so much arbitrary MITM of any web server. It's specific to ECC public keys(not specifically X509 certs) that validate from cryptoAPI which is a fairly limited but devastating scope. EG Code signing. Firefox uses its own NSS libraries not cryptoAPI to verify certs and is completely unaffected. I assume every major browser uses NSS or their own APIs as well. And of course RSA and AES certificates remain unaffected.
- trulyrandom 7y agoTLS supports ECC certificates, so any web client using crypt32 to verify those is affected. That includes web browsers and lots of other types of services, so it's not primarily code signed executables. Does Firefox still use NSS when using the Windows Certificate Store for the source of trusted root certs? What about Chrome? You're right that RSA certificates are unaffected. There's no such thing as AES certificates, though.
- tialaramex 7y ago> Does Firefox still use NSS when using the Windows Certificate Store for the source of trusted root certs? Yes. When enabled this feature in Firefox just effectively copies certificates from one of the Windows trust stores but continues to use its own (NSS) logic for trust decisions. Note also that Firefox's config switch only looks at your local changes - a corporate CA, a MITM proxy on a dev's workstation, something like that. Firefox continues to rely on Mozilla's judgement not Microsoft's for global trust policy. > What about Chrome? Chrome is probably affected. Chrome uses the platform (in this case crypt32.dll) trust decisions and then layers on additional rules from Google, such as the requirement for proof of CT logging. So unless an additional rule is blocking the weird curves they'll pass on Chrome on Windows.
- technion 7y agoIt's been reported that Windows Defender can detect and report on malicious certificates: https://twitter.com/AmitaiTechie/status/1217156973268893696 https://twitter.com/AmitaiTechie/status/1217156973268893696 Of course, that relies on not having Defender disabled by an alternate product.
- taspeotis 7y agoOn Windows Server 2016 and newer it stays enabled even with an “alternate product.” https://docs.microsoft.com/en-us/windows/security/threat-protection/windows-defender-antivirus/windows-defender-antivirus-on-windows-server-2016 https://docs.microsoft.com/en-us/windows/security/threat-pro... > In Windows Server 2016, Windows Defender AV will not disable itself if you are running another antivirus product.
- technion 7y agoTrue, but imagine you deployed SEP in accordance with supplier's instructions: https://support.symantec.com/us/en/article.tech237177.html https://support.symantec.com/us/en/article.tech237177.html Or Mcafee: https://kc.mcafee.com/corporate/index?page=content&id=KB82450 https://kc.mcafee.com/corporate/index?page=content&id=KB8245... (search for DisableRealtimeMonitoring) For a deeper dive: I ran into issues on a security assessment trying to run procdump on lsass being blocked by Defender. Workaround.. was to find a machine with McAfee installed where that behavior was allowed.
- dolmen 7y agoOh great. Mozilla just added last week an option for entreprises to enable trusting of system certificates on Windows. See Firefox 72.0 release notes: https://www.mozilla.org/en-US/firefox/72.0/releasenotes/ https://www.mozilla.org/en-US/firefox/72.0/releasenotes/
- dolmen 7y agoNote that from the release note the new option just allows to read certificates from the system store. Validation is still done by Firefox, so NSS crypto lib, not crypt.dll. So even if the option is enabled Firefox is not affected by the vulnerability (except for code signing check of the Firefox binary itself by the OS).
- 1970-01-01 7y agoSo Win7 isn't affected? At this point in time I have to point out a fully patched Win7, having ~8 hours of support life left, just happens to be more secure than Win10 for trusting certs.
- userbinator 7y agoIt's called maturity... code that isn't radically changed or added to will asymptotically approach being completely bug-free as all the bugs get gradually discovered and fixed over time. This also implies that the majority of bugs are found in the newest code.
- dc352 7y agoI suspect you're overcomplicating the attack with all the math and we can ignore most of it. The only way the attacker can tell the MS Crypto API is via the TLS protocol. You can only do it if it's relevant. The only option for that is to use ECDH, which allows the server to supply EC parameters for the Diffie-Hellmann exchange. My bet is that the problem is that MS Crypto API took those parameters as correct without checking them against what's in the certificate. I.e., ServerKeyExchange - here's the EC spec, we just need the public key Certificate - ah - here's public key, we have the ECparams - let's run the math :)
- mzs 7y ago> https://twitter.com/randomoracle/status/1217198437281804290 https://twitter.com/randomoracle/status/1217198437281804290 Some speculation on CVE-2020-0601. Earlier version of Windows cryptography API only supported a handful of elliptic curves from NIST suite-B. It could not handle say an arbitrary prime-curve in Weierstrass form with user defined parameters … While it could not grok arbitrary curves, Windows API made an attempt to recognize when a curve with explicit user-defined parameters was in fact identical to "built-in" curve that is supported It appears that mapping was "lazy:" it failed to check that all curve parameters are identical to the known curve. In particular, switching the generator point results in a different curve in which an attacker can forge signatures that match a victim public key > https://twitter.com/esizkur/status/1217176214047219713 https://twitter.com/esizkur/status/1217176214047219713 It looks like this may be a caching issue: There's a CCertObjectCache class in crypt32.dll. In the latest release its member function FindKnownStoreFlags (called from its constructor) started checking the public key and parameters > https://twitter.com/thracky/status/1217175743316348929 https://twitter.com/thracky/status/1217175743316348929 ChainComparePublicKeyParametersAndBytes used to just be a memcmp before the patch. Same with any calls to IsRootEntryMatch. Both new functions.
- miguelmota 7y agoInteresting, makes you wonder how many exploits the NSA purposely doesn't mention to the vendor for their own benefit
- cliqueiq 7y agoI think the scariest thing about this is if this was a PR stunt, the release of an unknown vuln could be completely controlled by whoever knew about it. Best case scenario is a relationships between Microsoft and the five eyes. It could have just as easily been China, a independent group or whatever. It's even possible that the top of Microsoft and/or NSA might not even know. But if it wasn't planned, no one would admit it anyway.
- morpheuskafka 7y agoI'm assuming there will never be an official proof of concept release, so how long do you all think it will be before we see widely available exploit code and fake certificates out in the wild?
- spuz 7y agoTpcaek has said elsewhere in this thread: > Saleem Rashid worked out a POC for this on Slack in something like 45 minutes today So I would be amazed if there were not some malicious certificates out there already.
- Maxious 7y agosome examples of fake certificates/signings https://twitter.com/matthew_d_green/status/1217246161440051200 https://twitter.com/matthew_d_green/status/12172461614400512... https://twitter.com/subTee/status/1217300590696501249 https://twitter.com/subTee/status/1217300590696501249
- gelo 7y agoFor those that need proof their machine is updated the article numbers listed here are the KB numbers you should match in windows 10 update list. https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-0601 https://portal.msrc.microsoft.com/en-US/security-guidance/ad...
- eeZah7Ux 7y agoSome things never change...
- mtgx 7y agoNobody here seems to ask for how long has the NSA known about this. It's obvious they're only now making it public and taking credit for it because the Chinese likely learned about it, too.
- akayoshi1 7y agoGlobalist conspiracy. X files intro music
- classified 7y agoWhen will they learn that the only way to respond to a hostile government is to overthrow it?