But maybe they\u2019ve had a change of heart. (If you truly\nbelieve that, I have a bridge to sell you.)<\/p>\n\n\n\n
The NSA, in an uncharacteristic show of transparency, recently announced a major public key infrastructure (PKI) security issue<\/a> that exists in Microsoft Windows operating systems that\u2019s left more than 900 million PCs and servers worldwide vulnerable to spoofing cyberattacks. This vulnerability is one of many vulnerabilities Microsoft released as part of their January 2020 security updates<\/a>. Maybe they didn\u2019t want a repeat of the last incident. Whatever the reason, we\u2019re just glad they decided to disclose the potential exploit. <\/p>\n\n\n\n This risk of this vulnerability boils down to a weakness in\nthe application programming interface of Microsoft\u2019s widely used operating\nsystems. But what exactly is this Windows 10 vulnerability? How does it affect\nyour organization? And what can you do to fix it?<\/p>\n\n\n\n Let\u2019s hash it out.<\/p>\n\n\n\n Windows 10 has been having a rough go of things these past several months in terms of vulnerabilities. In the latest Window 10 vulnerability news, the NSA discovered a vulnerability (CVE-2020-0601<\/a>) that affects the cryptographic functionality of Microsoft Windows 32- and 64-bit Windows 10 operating systems and specific versions of Windows Server. Basically, the vulnerability exists within the Windows 10 cryptographic application programming interface \u2014 what\u2019s also known as CryptoAPI (or what you may know as the good ol\u2019 Crypt32.dll module) \u2014 and affects how it validates elliptic curve cryptography (ECC) certificates. <\/p>\n\n\n\n What it does, in a nutshell, is allow users to create websites and software that masquerade as the \u201creal deals\u201d through the use of spoofed digital certificates. A great example of how it works was created by a security researcher, Saleem Rashid, who tweeted images of NSA.com and Github.com getting \u201cRickrolled.\u201d<\/a> Essentially, what he did was cause both the Edge and Chrome browsers to spoof the HTTPS verified websites.<\/p>\n\n\n\n Although humorous, Rashid\u2019s simulated attacks are a great\ndemonstration of how serious the security flaw is. By spoofing a digital\ncertificate to exploit the security flaw in CryptoAPI, it means that anyone can\npretend to be anyone \u2014 even official authorities. <\/p>\n\n\n\n CryptoAPI is a critical component of Microsoft Windows operating systems. It\u2019s what allows developers to secure their software applications through cryptographic solutions. It\u2019s also what validates the legitimacy of software and secure website connections through the use of X.509 digital certificates (SSL\/TLS certificates, code signing certificates, email signing certificates, etc.). So, basically, the vulnerability\u2019s a bug in the OS\u2019s appliance for determining whether software applications and emails are secure, and whether secure website connections are legitimate. <\/p>\n\n\n\n So, what the vulnerability does is allow actors to bypass\nthe trust store by using malicious software that are signed by forged\/spoofed ECC\ncertificates (doing so makes them look like they\u2019re signed by a trusted\norganization). This means that users would unknowingly download malicious or\ncompromised software because the digital signature would appear to be from a\nlegitimate source. <\/p>\n\n\n\n This vulnerability can cause other issues as well, according to the Department of Homeland Security\u2019s Cybersecurity and Infrastructure Security Agency<\/a> (CISA): <\/p>\n\n\n\n This could deceive users or thwart malware detection methods such as antivirus. Additionally, a maliciously crafted certificate could be issued for a hostname that did not authorize it, and a browser that relies on Windows CryptoAPI would not issue a warning, allowing an attacker to decrypt, modify, or inject data on user connections without detection.\u201d<\/em><\/p><\/blockquote>\n\n\n\n No. This flaw in no way, shape, or form affects the\nintegrity of ECC certificates. It does, however, cast a negative light on\nWindows\u2019 cryptographic application programming interface by shining a spotlight\non the shortcomings of its validation process.<\/p>\n\n\n\n Let me reiterate: This is a flaw concerning Windows\nCryptoAPI and does not affect the integrity of the ECC certificates themselves.<\/strong>\nIf you\u2019re one of the few using ECC certificates (you know, since RSA is still\nthe more commonly used than ECC), this doesn\u2019t impact the security of your certificates.\n<\/p>\n\n\n\n The patch from Microsoft addresses the vulnerability to\nensure that Windows CryptoAPI fully validates ECC certificates. <\/p>\n\n\n\n Basically, this cryptographic validation security flaw\nimpacts both the SSL\/TLS communication stream encryption and Windows\nAuthenticode file validation. Malicious actors who decide to exploit the CryptoAPI\nvulnerability could use it to: <\/p>\n\n\n\n The NSA press release states:<\/p>\n\n\n\n NSA assesses the vulnerability to be severe and that sophisticated cyber actors will understand the underlying flaw very quickly and, if exploited, would render the previously mentioned platforms as fundamentally vulnerable. The consequences of not patching the vulnerability are severe and widespread. Remote exploitation tools will likely be made quickly and widely available. Rapid adoption of the patch is the only known mitigation at this time and should be the primary focus for all network owners.\u201d<\/em> <\/p><\/blockquote>\n\n\n\n Wondering what you should do to mitigate the threat on your\nnetwork and devices? The NSA has a few recommendations:<\/p>\n\n\n\n The NSA recommends installing a newly-released patch from Microsoft<\/a> for Windows 10 operating systems and Windows Server (versions 2016 and 2019) as soon as possible on all endpoints and systems. Like, right now. Get to it! As a best practice, you also can turn on automatic updates to ensure that you don\u2019t miss key updates in the future.<\/p>\n\n\n\nWhat\u2019s the Situation with This Windows 10 Vulnerability?<\/h2>\n\n\n\n
![\"Graphic:](\"https:\/\/www.thesslstore.com\/blog\/wp-content\/uploads\/2020\/01\/rickrolled-windows-vulnerability.png\")
Does This Mean ECC Is Not Secure?<\/h2>\n\n\n\n
What This Windows 10 Vulnerability Means for Your Organization<\/h2>\n\n\n\n
![\"spoofing](\"https:\/\/www.thesslstore.com\/blog\/wp-content\/uploads\/2019\/03\/bigstock-Certificate-Medal-Line-Icon-D-280986157.jpg\"){kind=icon}
<\/figure><\/div>\n\n\n\nSteps to Take to Mitigate This Bug<\/h2>\n\n\n\n
Get to Patchin\u2019 ASAP<\/h3>\n\n\n\n