5 ms·
Windows CryptoAPI Spoofing Vulnerability
- guidovranken 7y agoContext: This is an anticipated vulnerability reported to Microsoft by the NSA, patched today as part of patch Tuesday. Related thread: https://news.ycombinator.com/item?id=22039481 https://news.ycombinator.com/item?id=22039481
- K0nserv 7y agoNote that this does not seem to be limited to software signing, but affects all X.509 certificates[0]. This means it can be used for example to man in the middle HTTPS connections. 0: https://mobile.twitter.com/taviso/status/1217146026923978752 https://mobile.twitter.com/taviso/status/1217146026923978752
- CiPHPerCoder 7y agoPage isn't loading, but it was archived. https://archive.md/tykYn https://archive.md/tykYn
- Arnavion 7y agoI'm surprised to not see patches for Windows 7 and 8.1 (vuln is rated "important", 7 ends extended support today, 8.1 still has 3 years to go, so both should've qualified). I guess the vulnerability is new in Windows 10?
- danielki 7y agoWin10 added support for Brainpool and Curve25519 ECC Curves [0], so this might be where the vulnerability lies [0] https://docs.microsoft.com/en-us/windows-server/security/tls/tls-schannel-ssp-changes-in-windows-10-and-windows-server https://docs.microsoft.com/en-us/windows-server/security/tls...
- relaunched 7y agoMicrosoft ended support for Windows 7 today. The consensus is that older systems are vulnerable, but not supported by the patch. https://support.microsoft.com/en-us/help/4057281/windows-7-support-ended-on-january-14-2020 https://support.microsoft.com/en-us/help/4057281/windows-7-s...
- kjaftaedi 7y agoSpoofed code signing certificate? This sounds more like a key leak than a code exploit, no?