20 ms·

Cryptic Rumblings Ahead of First 2020 Patch Tuesday

230 points by dustinmoris 7y ago

AaronFriel 7y ago
Scary, but not an RCE so threat is limited. It would mean malicious actors could possible create spoofed signatures on malware or possibly websites (EV certificates?). Am I missing something or is there a way to turn a spoofed certificate into a single-click pwn? As I understand it, users would have to download a malicious payload or click a malicious URL to be exposed. Edit: People are asking why I assume it's not an RCE. That's a good question, but I am assuming Krebs on Security wouldn't report an RCE as a potential certificate validation bug. This quote in particular: > Equally concerning, a flaw in crypt32.dll might also be abused to spoof the digital signature tied to a specific piece of software. If crypt32.dll has a memory bug that can be exploited by feeding it an ill-formed certificate, that is wormable and orders of magnitude more severe, not equally concerning. We'll know more tomorrow, however.
- saagarjha 7y ago
  > Equally concerning, a flaw in crypt32.dll might also be abused to spoof the digital signature tied to a specific piece of software. Such a weakness could be exploited by attackers to make malware appear to be a benign program that was produced and signed by a legitimate software company. This looks like it could be abused to lead to code execution.
- resfirestar 7y ago
  We’ll find out tomorrow. Even if it’s just spoofing a valid signature on a exe I’d still call that pretty serious. Might get a piece of malware masquerading as a legit background program past a lot of SOC analysts. I’d bet there’s more to it though.
  - therein 7y ago
    Also kernel modules.
- chrismarlow9 7y ago
  If the matching of the signatures is bypassed because of the ability to manipulate the underlying control flow of the API via something like ROP, it could be used for many things. RCE in Windows Doesn't mean control over digital signature validation. But RCE in that particular API might mean both
- cjbprime 7y ago
  Wait, how do you know it's not an RCE? Memory safety flaws in a DLL become RCE all the time. > is there a way to turn a spoofed certificate into a single-click pwn? e.g. The victim clicks on a link to go to your website, their machine wants to validate the TLS cert you sent it, it calls into crypt32.dll to do that, it corrupts memory while handling your attacking cert, pwn? We don't know enough (anything!) about the actual bug yet other than which DLL it's in.
  - vsareto 7y ago
    I'm going to be disappointed if all of this hype is for non-code execution
  - bob1029 7y ago
    This would be a terrifying outcome if certificate-based RCE. Imagine an actor like google running an intentionally-compromised TLS certificate on their web servers... perhaps even targeted at specific IP addresses or on certain schedules to avoid detection. Certificates are an excellent initiation vector too. Especially, if one wanted to intentionally present a backdoor like this for national security reasons (all of the cryptographic primitives are already all right there for you to use to authenticate the cert).
    - gpm 7y ago
      I'd more more worried about either hacked sites, or a country with something like China's Great Cannon doing that than a legitimate US company like Google. Google doing that would be a great way for everyone involved to spend a long time in jail.
    - cjbprime 7y ago
      > Imagine an actor like google running an intentionally-compromised TLS certificate on their web servers... perhaps even targeted at specific IP addresses or on certain schedules to avoid detection. For what it's worth, you should read about Certificate Transparency, it tries to protect against this sort of problem. Browsers only accept certs that can prove they've been submitted to a public log, which means that their existence isn't being selectively exposed to some users only. (They mainly act as prevention against rogue certificate authorities rather than a rogue cert owner, though.)
- peterwwillis 7y ago
  > Am I missing something or is there a way to turn a spoofed certificate into a single-click pwn? 1) if there's a bug in the crypto library that creates RCE 2) if a mitm delivers a payload to an application (browser/plugin/etc) and that causes RCE. The former might cause NSA to get its panties in a wad. But it might be much worse than RCE. It might be like Heartbleed, where it can leak key material and memory all day (on servers and clients) and you'd never know it because the leak leaves no trace on the system and just looks like normal requests. Perfect exploit for spying. (And of course it's possible they had that exploit in their back pocket, but someone else reported it to M$, so now they're CYAing)
  - atxlurker 7y ago
    This is what I’m guessing
- DrJosiah 7y ago
  My money is on it to disable support for sha1 in old products; maybe a bigger break than the prefix attack currently known.
CiPHPerCoder 7y ago
Prediction: whatever this is will end up in pen-test reports for many years to come. Even if it's not a worthy successor to MS08-067.
- zrth 7y ago
  Not only obvious to me how 067’ and this is connected. Yet to save you a few sec: https://en.m.wikipedia.org/wiki/Conficker https://en.m.wikipedia.org/wiki/Conficker
  - acqq 7y ago
    "This is probably one of the easiest ways into a network if not the easiest way. Simply starting [xxxx] loading the module and giving it an IP address of a vulnerable Windows host will get you full administrative access to that system." "I myself have performed penetration tests in other countries such as China, and Russia where I was able to use MS08-067 to exploit systems running Windows systems with language packs that I was unable to actually read." https://blog.rapid7.com/2014/02/03/new-ms08-067/ https://blog.rapid7.com/2014/02/03/new-ms08-067/
JackRabbitSlim 7y ago
The NSA prepping PR damage control already? "Finally removed all totally inactive and harmless old _NSAKEY references." I wouldn't bet against something along those lines.
- zrth 7y ago
  What is the nsa’s role in this and what kind of key reference do you mean?
  - di 7y ago
    https://en.wikipedia.org/wiki/NSAKEY https://en.wikipedia.org/wiki/NSAKEY
James-primitive 7y ago
Equally concerning, a flaw in crypt32.dll might also be abused to spoof the digital signature tied to a specific piece of software. --yes, I am attempting to disassociate myself from these people
annoyingnoob 7y ago
I know what I'll be doing tomorrow evening...
computator 7y ago
It's a shame that mathematically proving correctness of code, even for extremely important code, is never done. I wonder how many lines of code in crypt32.dll. Is it on the order of 7500 lines? If Microsoft spent a few man-years mathematically proving the correctness of that code, they could have the saved the world about 10,000 man-years. Windows has a user base of 1 billion[1]. A ballpark figure for proving the correctness of 7500 lines of very complex code[2] is about 30 man years[3]. If even 1% of the 1 billion Windows users and sysadmins has to spend a couple hours on things related to this patch, it works out to 9615 man-years of worldwide waste (based on an 8 hour workday and 260 workdays a year). Had there been a wide-spread exploit, it could have cost the world millions of man-years. [1] https://en.wikipedia.org/wiki/Usage_share_of_operating_systems https://en.wikipedia.org/wiki/Usage_share_of_operating_syste... [2] https://www.schneier.com/blog/archives/2009/10/proving_a_compu.html https://www.schneier.com/blog/archives/2009/10/proving_a_com... [3] Professor Gernot Heiser, the John Lions Chair in Computer Science in the School of Computer Science and Engineering and a senior principal researcher with NICTA, said for the first time a team had been able to prove with mathematical rigour that an operating-system kernel—the code at the heart of any computer or microprocessor—was 100 per cent bug-free and therefore immune to crashes and failures. Verifying the kernel—known as the seL4 microkernel—involved mathematically proving the correctness of about 7,500 lines of computer code in a project taking an average of six people more than five years.
- saagarjha 7y ago
  Usually you don't really verify the correctness of existing code; you rewrite it in a language that makes it possible to make guarantees that you care about. In addition, Microsoft needs to allocate their time: which components should be verified? Not all of them can be verified practically yet.
  - chabad360 7y ago
    Keep in mind that we are discussing code meant to run cryptography operations, I'm pretty sure that kind of stuff should be high up on the priority list.
  - erk__ 7y ago
sys32768 7y ago
I wonder if Windows 7 will get this on its end of support day tomorrow.
- kijin 7y ago
  I'm sure they set the EOL date to a Patch Tuesday for a reason. :) Besides, end of support is not a hard deadline. Microsoft needs to produce patches for Extended Security Updates (ESU) customers anyway, and some of that can trickle down to ordinary users. Windows XP got an unexpected patch to fix a particularly serious vulnerability several weeks after the official EOL.
- Silhouette 7y ago
  Presumably it will. It would be remarkably convenient if Microsoft, having turned off support for Windows 7 and advocated an upgrade to Windows 10 that a lot of the hold-outs don't want because of the user-hostile changes, then mysteriously discovered a serious security flaw within hours of the cut-off. The optics would be terrible.
- pnako 7y ago
  It most certainly will. They released a security patch for XP last year. The reason they won't support they systems forever is the cost of doing so (and of course they want people to upgrade), but the cost of fixing a really bad security issue in an otherwise unsupported system every other year is probably fine.
jorblumesea 7y ago
Do I understand it right that the implication is that NSA helped find or patch bugs in MS crypto libraries? If so that's incredibly useful.
- gruturo 7y ago
  It's part of their mission. Back in the day they helped make DES stronger against differential cryptanalysis, which was unknown at the time.
  - syshum 7y ago
    When they feel like, most of the time however they hold back vunerablities so they can exploit them for their own purposes. Modern NSA is more Black Hat than white Hat sadly
    - skyyler 7y ago
      >When they feel like, most of the time however they hold back vunerablities so they can exploit them for their own purposes. You have no idea if that's true or not. It's probably true, but neither of us have the information required to assert our opinions on the matter as fact.
      - syshum 7y ago
        Pretty sure several leaks, and their own admissions have confirmed they do in fact hold back most of the time
- heartbreak 7y ago
  That has been confirmed this morning in the linked article.
hoseja 7y ago
It's an "airtight hatchway", guys!
- throwaheyy 7y ago
  No, crypt32 runs in user mode too.
jqueryin 7y ago
Isn't the timing of this a bit of a coincidence with the announcement of the new SHA1 collision exploit?
yread 7y ago
Perhaps it's related to this? https://github.com/dotnet/aspnetcore/issues/13706 https://github.com/dotnet/aspnetcore/issues/13706 IIS crashing in crypt32.dll!CryptMsgClose() after a web request
Angostura 7y ago
Ah! - does this explain the weirdly specific message that came out from GCHQ last week? https://www.telegraph.co.uk/news/2020/01/12/gchq-warns-not-use-windows-7-computers-banking-email-tuesday/ https://www.telegraph.co.uk/news/2020/01/12/gchq-warns-not-u...
- viraptor 7y ago
  Not sure if related. Support ended, so it's a good recommendation whether some new attack is revealed or not. Especially when new patch for a newer version can reveal unpatched issues in older versions. What do you think is oddly-specific about it?
  - deleted 7y ago
    [deleted]
  - Angostura 7y ago
    Just the emphasis on banking in particular. "Don't use it" is good advice. The banking element struck me as potentially hinting at crypto in particular, though I agree they may have just chosen a particularly sensitive area as an example.

230 points by dustinmoris 7y ago

Scary, but not an RCE so threat is limited. It would mean malicious actors could possible create spoofed signatures on malware or possibly websites (EV certificates?). Am I missing something or is there a way to turn a spoofed certificate into a single-click pwn? As I understand it, users would have to download a malicious payload or click a malicious URL to be exposed. Edit: People are asking why I assume it's not an RCE. That's a good question, but I am assuming Krebs on Security wouldn't report an RCE as a potential certificate validation bug. This quote in particular: > Equally concerning, a flaw in crypt32.dll might also be abused to spoof the digital signature tied to a specific piece of software. If crypt32.dll has a memory bug that can be exploited by feeding it an ill-formed certificate, that is wormable and orders of magnitude more severe, not equally concerning. We'll know more tomorrow, however.

saagarjha 7y ago
> Equally concerning, a flaw in crypt32.dll might also be abused to spoof the digital signature tied to a specific piece of software. Such a weakness could be exploited by attackers to make malware appear to be a benign program that was produced and signed by a legitimate software company. This looks like it could be abused to lead to code execution.
resfirestar 7y ago
We’ll find out tomorrow. Even if it’s just spoofing a valid signature on a exe I’d still call that pretty serious. Might get a piece of malware masquerading as a legit background program past a lot of SOC analysts. I’d bet there’s more to it though.
- therein 7y ago
  Also kernel modules.
chrismarlow9 7y ago
If the matching of the signatures is bypassed because of the ability to manipulate the underlying control flow of the API via something like ROP, it could be used for many things. RCE in Windows Doesn't mean control over digital signature validation. But RCE in that particular API might mean both
cjbprime 7y ago
Wait, how do you know it's not an RCE? Memory safety flaws in a DLL become RCE all the time. > is there a way to turn a spoofed certificate into a single-click pwn? e.g. The victim clicks on a link to go to your website, their machine wants to validate the TLS cert you sent it, it calls into crypt32.dll to do that, it corrupts memory while handling your attacking cert, pwn? We don't know enough (anything!) about the actual bug yet other than which DLL it's in.
- vsareto 7y ago
  I'm going to be disappointed if all of this hype is for non-code execution
- bob1029 7y ago
  This would be a terrifying outcome if certificate-based RCE. Imagine an actor like google running an intentionally-compromised TLS certificate on their web servers... perhaps even targeted at specific IP addresses or on certain schedules to avoid detection. Certificates are an excellent initiation vector too. Especially, if one wanted to intentionally present a backdoor like this for national security reasons (all of the cryptographic primitives are already all right there for you to use to authenticate the cert).
  - gpm 7y ago
    I'd more more worried about either hacked sites, or a country with something like China's Great Cannon doing that than a legitimate US company like Google. Google doing that would be a great way for everyone involved to spend a long time in jail.
  - cjbprime 7y ago
    > Imagine an actor like google running an intentionally-compromised TLS certificate on their web servers... perhaps even targeted at specific IP addresses or on certain schedules to avoid detection. For what it's worth, you should read about Certificate Transparency, it tries to protect against this sort of problem. Browsers only accept certs that can prove they've been submitted to a public log, which means that their existence isn't being selectively exposed to some users only. (They mainly act as prevention against rogue certificate authorities rather than a rogue cert owner, though.)
peterwwillis 7y ago
> Am I missing something or is there a way to turn a spoofed certificate into a single-click pwn? 1) if there's a bug in the crypto library that creates RCE 2) if a mitm delivers a payload to an application (browser/plugin/etc) and that causes RCE. The former might cause NSA to get its panties in a wad. But it might be much worse than RCE. It might be like Heartbleed, where it can leak key material and memory all day (on servers and clients) and you'd never know it because the leak leaves no trace on the system and just looks like normal requests. Perfect exploit for spying. (And of course it's possible they had that exploit in their back pocket, but someone else reported it to M$, so now they're CYAing)
- atxlurker 7y ago
  This is what I’m guessing
DrJosiah 7y ago
My money is on it to disable support for sha1 in old products; maybe a bigger break than the prefix attack currently known.

CiPHPerCoder 7y ago

Prediction: whatever this is will end up in pen-test reports for many years to come. Even if it's not a worthy successor to MS08-067.

zrth 7y ago
Not only obvious to me how 067’ and this is connected. Yet to save you a few sec: https://en.m.wikipedia.org/wiki/Conficker https://en.m.wikipedia.org/wiki/Conficker
- acqq 7y ago
  "This is probably one of the easiest ways into a network if not the easiest way. Simply starting [xxxx] loading the module and giving it an IP address of a vulnerable Windows host will get you full administrative access to that system." "I myself have performed penetration tests in other countries such as China, and Russia where I was able to use MS08-067 to exploit systems running Windows systems with language packs that I was unable to actually read." https://blog.rapid7.com/2014/02/03/new-ms08-067/ https://blog.rapid7.com/2014/02/03/new-ms08-067/

JackRabbitSlim 7y ago

The NSA prepping PR damage control already? "Finally removed all totally inactive and harmless old _NSAKEY references." I wouldn't bet against something along those lines.

zrth 7y ago
What is the nsa’s role in this and what kind of key reference do you mean?
- di 7y ago
  https://en.wikipedia.org/wiki/NSAKEY https://en.wikipedia.org/wiki/NSAKEY

James-primitive 7y ago

Equally concerning, a flaw in crypt32.dll might also be abused to spoof the digital signature tied to a specific piece of software. --yes, I am attempting to disassociate myself from these people

annoyingnoob 7y ago

I know what I'll be doing tomorrow evening...

computator 7y ago

It's a shame that mathematically proving correctness of code, even for extremely important code, is never done. I wonder how many lines of code in crypt32.dll. Is it on the order of 7500 lines? If Microsoft spent a few man-years mathematically proving the correctness of that code, they could have the saved the world about 10,000 man-years. Windows has a user base of 1 billion[1]. A ballpark figure for proving the correctness of 7500 lines of very complex code[2] is about 30 man years[3]. If even 1% of the 1 billion Windows users and sysadmins has to spend a couple hours on things related to this patch, it works out to 9615 man-years of worldwide waste (based on an 8 hour workday and 260 workdays a year). Had there been a wide-spread exploit, it could have cost the world millions of man-years. [1] https://en.wikipedia.org/wiki/Usage_share_of_operating_systems https://en.wikipedia.org/wiki/Usage_share_of_operating_syste... [2] https://www.schneier.com/blog/archives/2009/10/proving_a_compu.html https://www.schneier.com/blog/archives/2009/10/proving_a_com... [3] Professor Gernot Heiser, the John Lions Chair in Computer Science in the School of Computer Science and Engineering and a senior principal researcher with NICTA, said for the first time a team had been able to prove with mathematical rigour that an operating-system kernel—the code at the heart of any computer or microprocessor—was 100 per cent bug-free and therefore immune to crashes and failures. Verifying the kernel—known as the seL4 microkernel—involved mathematically proving the correctness of about 7,500 lines of computer code in a project taking an average of six people more than five years.

saagarjha 7y ago
Usually you don't really verify the correctness of existing code; you rewrite it in a language that makes it possible to make guarantees that you care about. In addition, Microsoft needs to allocate their time: which components should be verified? Not all of them can be verified practically yet.
- chabad360 7y ago
  Keep in mind that we are discussing code meant to run cryptography operations, I'm pretty sure that kind of stuff should be high up on the priority list.
- erk__ 7y ago

sys32768 7y ago

I wonder if Windows 7 will get this on its end of support day tomorrow.

kijin 7y ago
I'm sure they set the EOL date to a Patch Tuesday for a reason. :) Besides, end of support is not a hard deadline. Microsoft needs to produce patches for Extended Security Updates (ESU) customers anyway, and some of that can trickle down to ordinary users. Windows XP got an unexpected patch to fix a particularly serious vulnerability several weeks after the official EOL.
Silhouette 7y ago
Presumably it will. It would be remarkably convenient if Microsoft, having turned off support for Windows 7 and advocated an upgrade to Windows 10 that a lot of the hold-outs don't want because of the user-hostile changes, then mysteriously discovered a serious security flaw within hours of the cut-off. The optics would be terrible.
pnako 7y ago
It most certainly will. They released a security patch for XP last year. The reason they won't support they systems forever is the cost of doing so (and of course they want people to upgrade), but the cost of fixing a really bad security issue in an otherwise unsupported system every other year is probably fine.

jorblumesea 7y ago

Do I understand it right that the implication is that NSA helped find or patch bugs in MS crypto libraries? If so that's incredibly useful.

gruturo 7y ago
It's part of their mission. Back in the day they helped make DES stronger against differential cryptanalysis, which was unknown at the time.
- syshum 7y ago
  When they feel like, most of the time however they hold back vunerablities so they can exploit them for their own purposes. Modern NSA is more Black Hat than white Hat sadly
  - skyyler 7y ago
    >When they feel like, most of the time however they hold back vunerablities so they can exploit them for their own purposes. You have no idea if that's true or not. It's probably true, but neither of us have the information required to assert our opinions on the matter as fact.
    - syshum 7y ago
      Pretty sure several leaks, and their own admissions have confirmed they do in fact hold back most of the time
heartbreak 7y ago
That has been confirmed this morning in the linked article.

hoseja 7y ago

It's an "airtight hatchway", guys!

throwaheyy 7y ago
No, crypt32 runs in user mode too.

jqueryin 7y ago

Isn't the timing of this a bit of a coincidence with the announcement of the new SHA1 collision exploit?

yread 7y ago

Perhaps it's related to this? https://github.com/dotnet/aspnetcore/issues/13706 https://github.com/dotnet/aspnetcore/issues/13706 IIS crashing in crypt32.dll!CryptMsgClose() after a web request

Angostura 7y ago

Ah! - does this explain the weirdly specific message that came out from GCHQ last week? https://www.telegraph.co.uk/news/2020/01/12/gchq-warns-not-use-windows-7-computers-banking-email-tuesday/ https://www.telegraph.co.uk/news/2020/01/12/gchq-warns-not-u...

viraptor 7y ago
Not sure if related. Support ended, so it's a good recommendation whether some new attack is revealed or not. Especially when new patch for a newer version can reveal unpatched issues in older versions. What do you think is oddly-specific about it?
- deleted 7y ago
  [deleted]
- Angostura 7y ago
  Just the emphasis on banking in particular. "Don't use it" is good advice. The banking element struck me as potentially hinting at crypto in particular, though I agree they may have just chosen a particularly sensitive area as an example.