Windows CryptoAPI Spoofing Vulnerability (portal.msrc.microsoft.com)

7 comments

[ 3.1 ms ] story [ 30.6 ms ] thread

Context: This is an anticipated vulnerability reported to Microsoft by the NSA, patched today as part of patch Tuesday.

Note that this does not seem to be limited to software signing, but affects all X.509 certificates[0]. This means it can be used for example to man in the middle HTTPS connections.

0: https://mobile.twitter.com/taviso/status/1217146026923978752

CiPHPerCoder 6y ago ↗

Page isn't loading, but it was archived.

https://archive.md/tykYn

Arnavion 6y ago ↗

I'm surprised to not see patches for Windows 7 and 8.1 (vuln is rated "important", 7 ends extended support today, 8.1 still has 3 years to go, so both should've qualified). I guess the vulnerability is new in Windows 10?

danielki 6y ago ↗

Win10 added support for Brainpool and Curve25519 ECC Curves [0], so this might be where the vulnerability lies

[0] https://docs.microsoft.com/en-us/windows-server/security/tls...

relaunched 6y ago ↗

Microsoft ended support for Windows 7 today. The consensus is that older systems are vulnerable, but not supported by the patch.

https://support.microsoft.com/en-us/help/4057281/windows-7-s...

kjaftaedi 6y ago ↗

Spoofed code signing certificate?

This sounds more like a key leak than a code exploit, no?