Do any browsers use CryptoAPI for TLS certificate validation?
I think classic IE would do so.
Patch Critical Cryptographic Vulnerability in Microsoft Windows [pdf]
31–40 of 235 posts
Re: Patch Critical Cryptographic Vulnerability in Microsoft Windows [pdf]
#32From Krebs tweets: The NSA's Neuberger said this wasn't the first vulnerability the agency has reported to Microsoft, but it was the first one for which they accepted credit/attribution when MS asked. Sources say this disclosure from NSA is planned to be the first of many as part of a new initiative at NSA dubbed "Turn a New Leaf," aimed at making more of the agency's vulnerability research available to major softwar…
more like someone with some commonsense decided to capitalize on disclosing issues when other countries get zero days. Oh well, guess we can't use this anymore Bob, china has been exploiting it over the past week. Call Microsoft lets at least get some free PR in exchange of having to give this up.
You write that like it's a bad thing.
Re: Patch Critical Cryptographic Vulnerability in Microsoft Windows [pdf]
#33Earlier quoted context omitted.
Their job is to collect signals intelligence and execute cyber warfare operations. Not whatever you think it is.
Not sure if you’re just being snarky, but the NSA’s stated mission includes helping with cyber security: https://www.nsa.gov/about/mission-values/
It also involves breaking enemy cyber security (signals intelligence).
It's actually a rather fascinating incongruity, since we live in a world where "the enemy" is more likely than not to be using the same software systems that the NSA themselves are, and that therefore any exploitable flaws they find in enemy systems are pretty likely to be just as exploitable in their own. (And that similarly, disclosing the flaw in order to fix the issue in their own systems is very likely to result in "the enemy" fixing the flaw as well.)
A couple years ago the White House released a document explaining the process they use for deciding what vulnerabilities they keep secret: https://www.cnet.com/news/white-house-trump-administration-h... noting that "In the vast majority of cases, responsibly disclosing a newly discovered vulnerability is clearly in the national interest". Though from what we've seen in past leaks, it's pretty obvious they don't reach that conclusion for all vulnerabilities they find.
Re: Patch Critical Cryptographic Vulnerability in Microsoft Windows [pdf]
#34From Krebs tweets: The NSA's Neuberger said this wasn't the first vulnerability the agency has reported to Microsoft, but it was the first one for which they accepted credit/attribution when MS asked. Sources say this disclosure from NSA is planned to be the first of many as part of a new initiative at NSA dubbed "Turn a New Leaf," aimed at making more of the agency's vulnerability research available to major softwar…
more like someone with some commonsense decided to capitalize on disclosing issues when other countries get zero days. Oh well, guess we can't use this anymore Bob, china has been exploiting it over the past week. Call Microsoft lets at least get some free PR in exchange of having to give this up.
They have probably done that for a while (this is the first public attribution, not the first disclosure); but they are now blowing their trumpet because they need some good PR. Why?
Snowden.
Re: Patch Critical Cryptographic Vulnerability in Microsoft Windows [pdf]
#35Anyone got any news on Windows 7 seeing as it's still 25% market share approx according to statcounter?
Does Windows 7 crypt32.dll support ECC?
Re: Patch Critical Cryptographic Vulnerability in Microsoft Windows [pdf]
#36Re: Patch Critical Cryptographic Vulnerability in Microsoft Windows [pdf]
#37At least this only affects Windows 10 (as far as I can tell)
Windows 7 reached EOL today so they may leave it as is if it is affected.
>This vulnerability affects all machines running 32- or 64-bit Windows 10 operating systems, including Windows Server versions 2016 and 2019
Re: Patch Critical Cryptographic Vulnerability in Microsoft Windows [pdf]
#38This is yet another illustration of why complexity is evil in cryptographic and security critical code. It's evil everywhere, but it's particularly evil there. The relationship between bugs and complexity is exponential, not linear. X.509 is an over-engineered legacy-cruft-encrusted nightmare. I've implemented stuff that uses it and I never , even after the most careful auditing by myself and peers, leave with the se…
The bug is being publicly described as specific to the implementation of a particular class of cryptographic primitives (ECC). If that's accurate, simplifying the certificate data format (unnecessarily messy though it may be) wouldn't do much to mitigate this particular issue.
To the extent it's X.509 allowing curve parameters to be specified alongside signatures and public keys, this is indeed a case where all the extra joinery in X.509 is creating exploitable complexity, and the point 'api is making is well taken.
Re: Patch Critical Cryptographic Vulnerability in Microsoft Windows [pdf]
#39Re: Patch Critical Cryptographic Vulnerability in Microsoft Windows [pdf]
#40None of these links describe how the exploit works. I found this: https://media.defense.gov/2020/Jan/14/2002234275/-1/-1/0/CSA... So based on my limited understanding: 1. The certificates have a place for defining curve parameters. 2. The attacker specifies their own parameters so that they match the start of a standard curve but choose the rest of the parameters themselves. With the right ECC math they are able to g…
"enable remote code execution." suggests it's worse than that - like the curve parameters might allow a buffer overflow, or something of that nature.
Maybe they just mean because it can sign Authenticode signatures