Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Cryptic Rumblings Ahead of First 2020 Patch Tuesday

krebsonsecurity.com

Post reply on HN
Print view View original

1–10 of 96 posts

Re: Cryptic Rumblings Ahead of First 2020 Patch Tuesday

#2

Post by AaronFriel »

Scary, but not an RCE so threat is limited. It would mean malicious actors could possible create spoofed signatures on malware or possibly websites (EV certificates?). Am I missing something or is there a way to turn a spoofed certificate into a single-click pwn? As I understand it, users would have to download a malicious payload or click a malicious URL to be exposed.

Edit: People are asking why I assume it's not an RCE. That's a good question, but I am assuming Krebs on Security wouldn't report an RCE as a potential certificate validation bug. This quote in particular:

> Equally concerning, a flaw in crypt32.dll might also be abused to spoof the digital signature tied to a specific piece of software.

If crypt32.dll has a memory bug that can be exploited by feeding it an ill-formed certificate, that is wormable and orders of magnitude more severe, not equally concerning.

We'll know more tomorrow, however.

Re: Cryptic Rumblings Ahead of First 2020 Patch Tuesday

#3

Post by saagarjha »

AaronFriel wrote: post #2

Scary, but not an RCE so threat is limited. It would mean malicious actors could possible create spoofed signatures on malware or possibly websites (EV certificates?). Am I missing something or is there a way to turn a spoofed certificate into a single-click pwn? As I understand it, users would have to download a malicious payload or click a malicious URL to be exposed. Edit: People are asking why I assume it's not a…

> Equally concerning, a flaw in crypt32.dll might also be abused to spoof the digital signature tied to a specific piece of software. Such a weakness could be exploited by attackers to make malware appear to be a benign program that was produced and signed by a legitimate software company.

This looks like it could be abused to lead to code execution.

Re: Cryptic Rumblings Ahead of First 2020 Patch Tuesday

#6

Post by _23sd »

AaronFriel wrote: post #2

Scary, but not an RCE so threat is limited. It would mean malicious actors could possible create spoofed signatures on malware or possibly websites (EV certificates?). Am I missing something or is there a way to turn a spoofed certificate into a single-click pwn? As I understand it, users would have to download a malicious payload or click a malicious URL to be exposed. Edit: People are asking why I assume it's not a…

We’ll find out tomorrow. Even if it’s just spoofing a valid signature on a exe I’d still call that pretty serious. Might get a piece of malware masquerading as a legit background program past a lot of SOC analysts. I’d bet there’s more to it though.

Re: Cryptic Rumblings Ahead of First 2020 Patch Tuesday

#7

Post by chrismarlow9 »

AaronFriel wrote: post #2

Scary, but not an RCE so threat is limited. It would mean malicious actors could possible create spoofed signatures on malware or possibly websites (EV certificates?). Am I missing something or is there a way to turn a spoofed certificate into a single-click pwn? As I understand it, users would have to download a malicious payload or click a malicious URL to be exposed. Edit: People are asking why I assume it's not a…

If the matching of the signatures is bypassed because of the ability to manipulate the underlying control flow of the API via something like ROP, it could be used for many things.

RCE in Windows Doesn't mean control over digital signature validation. But RCE in that particular API might mean both

Re: Cryptic Rumblings Ahead of First 2020 Patch Tuesday

#9

Post by cjbprime »

AaronFriel wrote: post #2

Scary, but not an RCE so threat is limited. It would mean malicious actors could possible create spoofed signatures on malware or possibly websites (EV certificates?). Am I missing something or is there a way to turn a spoofed certificate into a single-click pwn? As I understand it, users would have to download a malicious payload or click a malicious URL to be exposed. Edit: People are asking why I assume it's not a…

Wait, how do you know it's not an RCE? Memory safety flaws in a DLL become RCE all the time.

> is there a way to turn a spoofed certificate into a single-click pwn?

e.g. The victim clicks on a link to go to your website, their machine wants to validate the TLS cert you sent it, it calls into crypt32.dll to do that, it corrupts memory while handling your attacking cert, pwn?

We don't know enough (anything!) about the actual bug yet other than which DLL it's in.

Post reply on HN