After
Adobe today releases
its first Patch Tuesday updates for 2020, Microsoft has now also published its January security advisories warning billions of users of a total of 100 new vulnerabilities in various of its products.
What’s special about today is that one of the updates fixes a serious flaw in the core cryptographic component of widely used Windows 10, Server 2016 and 2019 editions that was discovered and reported to the company by the National Security Agency’s (NSA) of the United States.
What’s more interesting is that this is the first security flaw in Windows OS that the NSA reported responsibly to the Microsoft, unlike Eternalblue SMB flaw that the agency kept secret for at least five years, and then was leaked to the public by a mysterious group and caused WannaCry menace in 2017.
CVE-2020-0601: Windows CryptoAPI Spoofing Vulnerability
According to an advisory released by Microsoft, the flaw, dubbed ‘NSACrypt’ and tracked s
CVE-2020-0601
, resides in the Crypt32.dll module that contains various ‘Certificate and Cryptographic Messaging functions’ used by the Windows Crypto API for handling encryption and decryption of data.
The issue resides in the way Crypt32.dll module validates Elliptic Curve Cryptography (ECC) certificates that are currently the industry standard for public-key cryptography and is used in the majority of SSL/TLS certificates.
In a
press release
published by the NSA, “the certificate validation vulnerability allows an attacker to undermine how Windows verifies cryptographic trust and can enable remote code execution.”
Exploitation of the vulnerability allows attackers to:
- HTTPS connections
- Signed files and emails
- Signed executable code launched as user-mode processes
Though technical details of the flaw are not yet available to the public, Microsoft confirms the flaw, which if exploited successfully, could allow attackers to spoof digital signatures on software, tricking the operating system into installing malicious software while impersonating the identity of any legitimate software—without users’ knowledge.
“A spoofing vulnerability exists in the way Windows CryptoAPI (Crypt32.dll) validates Elliptic Curve Cryptography (ECC) certificates,” the microsoft advisory says.
“An attacker could exploit the vulnerability by using a spoofed code-signing certificate to sign a malicious executable, making it appear the file was from a trusted, legitimate source. The user would have no way of knowing the file was malicious because the digital signature would appear to be from a trusted provider.”
Besides this, the flaw in CryptoAPI could also make it easy for remote man-in-the-middle attackers to impersonate websites or decrypt confidential information on user connections to the affected software.
“This vulnerability is classed Important and we have not seen it used in active attacks,” the microsoft said in a separate
blog post
.
“This vulnerability is one example of our partnership with the security research community where a vulnerability was privately disclosed and an update released to ensure customers were not put at risk.”
“The consequences of not patching the vulnerability are severe and widespread. Remote exploitation tools will likely be made quickly and widely available,” the NSA said.
There is no mitigating or workaround available for this vulnerability, so you’re highly recommended to install the latest software updates by heading on to your Windows Settings → Update & Security → Windows Update → clicking ‘Check for updates on your PC.’
Tech4Work 