Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Cryptic Rumblings Ahead of First 2020 Patch Tuesday

krebsonsecurity.com

Post reply on HN
Print view View original

61–70 of 96 posts

Re: Cryptic Rumblings Ahead of First 2020 Patch Tuesday

#61

Post by cjbprime »

fulafel wrote: post #56
tialaramex wrote: post #39

Earlier quoted context omitted.

Certificates in the Web PKI (so they'd be trusted) aren't likely to be a good basis for an exploit. You aren't supposed to get to pick very much of the document in the Web PKI. Rules forbid CAs from letting you write nonsense you made up into most places - they themselves get slightly more opportunity but "Let's attack a windows zero day" doesn't feel like a good use of control over a trusted CA. The biggest contiguo…

Do we know that MS TLS implementation parses self-signed certs only after successful validation? Many implementations offer an option of showing their contents (eg to see what CA it claims to be signed by), or offer the user a choice to accept it, or log identifying fields from the cert for diagnostic purpouses. Same for the CA server offered CA chain. I'm also not convinced that the fields-allowed-by-CAs set is safe…

> Do we know that MS TLS implementation parses self-signed certs only after successful validation?

It would be a contradiction in terms. You can't validate the semantic content of a file before you've parsed it!

Re: Cryptic Rumblings Ahead of First 2020 Patch Tuesday

#62

Post by acqq »

zrth wrote: post #14
CiPHPerCoder wrote: post #4

Prediction: whatever this is will end up in pen-test reports for many years to come. Even if it's not a worthy successor to MS08-067.

Not only obvious to me how 067’ and this is connected. Yet to save you a few sec: https://en.m.wikipedia.org/wiki/Conficker

"This is probably one of the easiest ways into a network if not the easiest way. Simply starting [xxxx] loading the module and giving it an IP address of a vulnerable Windows host will get you full administrative access to that system."

"I myself have performed penetration tests in other countries such as China, and Russia where I was able to use MS08-067 to exploit systems running Windows systems with language packs that I was unable to actually read."

https://blog.rapid7.com/2014/02/03/new-ms08-067/

Re: Cryptic Rumblings Ahead of First 2020 Patch Tuesday

#64

Post by kijin »

sys32768 wrote: post #16

I wonder if Windows 7 will get this on its end of support day tomorrow.

I'm sure they set the EOL date to a Patch Tuesday for a reason. :)

Besides, end of support is not a hard deadline. Microsoft needs to produce patches for Extended Security Updates (ESU) customers anyway, and some of that can trickle down to ordinary users. Windows XP got an unexpected patch to fix a particularly serious vulnerability several weeks after the official EOL.

Re: Cryptic Rumblings Ahead of First 2020 Patch Tuesday

#65

Post by dmichulke »

mcguire wrote: post #36
AnimalMuppet wrote: post #29

Earlier quoted context omitted.

Define "proving correctness". Proving that it does what it's supposed to? You need a formal spec as the starting point for that; how do you prove that the formal spec correctly describes what the software's supposed to do? Proving that it has no bugs? That only works for the kinds of bugs covered by the proof. Your proof that it has no null pointer crashes tells us nothing about whether it has off-by-one errors. For…

One might hope you have a formal spec of a cryptographic library.

Given the current state of security practices, I'd say we're lucky if they have unit tests.

Re: Cryptic Rumblings Ahead of First 2020 Patch Tuesday

#66

Post by fulafel »

cjbprime wrote: post #61
fulafel wrote: post #56

Earlier quoted context omitted.

Do we know that MS TLS implementation parses self-signed certs only after successful validation? Many implementations offer an option of showing their contents (eg to see what CA it claims to be signed by), or offer the user a choice to accept it, or log identifying fields from the cert for diagnostic purpouses. Same for the CA server offered CA chain. I'm also not convinced that the fields-allowed-by-CAs set is safe…

> Do we know that MS TLS implementation parses self-signed certs only after successful validation? It would be a contradiction in terms. You can't validate the semantic content of a file before you've parsed it!

Yeah, I should have said "before it processes any other fields". The ASN.1 parse of course comes first.

Re: Cryptic Rumblings Ahead of First 2020 Patch Tuesday

#69

Post by therein »

_23sd wrote: post #6
AaronFriel wrote: post #2

Scary, but not an RCE so threat is limited. It would mean malicious actors could possible create spoofed signatures on malware or possibly websites (EV certificates?). Am I missing something or is there a way to turn a spoofed certificate into a single-click pwn? As I understand it, users would have to download a malicious payload or click a malicious URL to be exposed. Edit: People are asking why I assume it's not a…

We’ll find out tomorrow. Even if it’s just spoofing a valid signature on a exe I’d still call that pretty serious. Might get a piece of malware masquerading as a legit background program past a lot of SOC analysts. I’d bet there’s more to it though.

Also kernel modules.
Post reply on HN