NSA discovers huge security flaw in Microsoft’s Windows 10

[Black Phoenix]

https://nypost.com/2020/01/15/nsa-discovers-huge-security-flaw-in-microsofts-windows-10/

The National Security Agency has discovered a major security flaw in Microsoft’s Windows 10 operating system that could let hackers intercept seemingly secure communications.

But rather than exploit the flaw for its own intelligence needs, the NSA tipped off Microsoft so that it can fix the system for everyone.

Microsoft typically releases security and other updates once a month and waited until Tuesday to disclose the flaw and the NSA’s involvement. Microsoft and the NSA both declined to say when the agency privately notified the company.

The agency shared the vulnerability with Microsoft “quickly and responsibly,” Neal Ziring, technical director of the NSA’s cybersecurity directorate, said in a blog post on Tuesday.

Yes I totally believe in you NSA...

[ataradov]

NSA was using this for ages, and then they probably realized that some other nation is aware of the issue too, so time to report.

[Stray Electron]

  I don't know who I trust less, MicroSoft or the NSA.

[Black Phoenix]

NSA was using this for ages, and then they probably realized that some other nation is aware of the issue too, so time to report.

Or being someone in the Conspiracy theory field, they found a way of using it even while patch, so let's give some sense of security while we keep doing what we do...

[Berni]

Microsoft said an attacker could exploit the vulnerability by spoofing a code-signing certificate so it looked like a file came from a trusted source.

“The user would have no way of knowing the file was malicious, because the digital signature would appear to be from a trusted provider,” the company said.

If successfully exploited, attackers would have been able to conduct “man-in-the-middle attacks” and decrypt confidential information they intercept on user connections, the company said.

This does not make any sense. So the exploit is to do with being able to code sign an executable without having the appropriate keys. Not too worried about that since how many people look at the thing anyway.

But how do you go from that to "man in the middle attacks" and "decrypting confidential information"? Are they just making things up or is this another case of the press having no idea what they are talking about and just throwing technical sounding words.

[Electro Detective]

another publicity stunt..??   

but wait, aren't both groups Linux users? 

 

[bd139]

This does not make any sense. So the exploit is to do with being able to code sign an executable without having the appropriate keys. Not too worried about that since how many people look at the thing anyway.

But how do you go from that to "man in the middle attacks" and "decrypting confidential information"? Are they just making things up or is this another case of the press having no idea what they are talking about and just throwing technical sounding words.

No it is exactly right. It's the crypto library that is flawed. This is used for both code signing and TLS negotiation. Thus you can forge a certificate and leverage an existing trust relationship easily. That can be used to set up an insecure TLS connection to MITM and obtain data or generated a code signing certificate that bypasses prompts.

With these things you have to ignore the dumbed down press and go straight to the source:

https://media.defense.gov/2020/Jan/14/2002234275/-1/-1/0/CSA-WINDOWS-10-CRYPT-LIB-20190114.PDF

From my understanding what they discovered was elliptic curve parameters could be specified in the certificate which were not validated against standard curves. That allows intentionally weak parameters to be injected into the certificate to decrease certificate generation effort to something reasonable (seconds instead of billions of years).

And yes NSA have probably been using this for months. It probably only got released after it was no longer useful against their adversaries or they have another set of exploits lined up.

[Berni]

Ah yeah makes more sense now.

But yeah im pretty sure the NSA has been exploiting this for a while before revealing it. Released it probably because they noticed someone else using it.

Also the fact that this cypto library vulnerability suddenly appeared in Win 10 and does not affect older ones makes it seam like it might have been introduced on purpose.

Do web browsers also use this library or bring there own?

[bd139]

Chrome and firefox bring their own. IE and Edge reuse Windows CryptoAPI. I'm not sure what the new Edge version (based on Chrome) uses

[Berni]

Chrome and firefox bring their own. IE and Edge reuse Windows CryptoAPI. I'm not sure what the new Edge version (based on Chrome) uses

Ah yes that is a BIG issue then. I thought that crypto library was mostly used to encrypt the win 10 telemetry crap and other built in things.

[tombi]

Kind-of - I think it is basically the Vaudenay attack.
https://lasec.epfl.ch/pub/lasec/doc/Vau04b.pdf

I think you can include curve parameters in the signature algorithm identifier. It stupidly doesn't check these match the curve specified in the issuer cert's public key. It happily verifies the signature using the specified parameters and if it checks out the code is happy. It should be checking they match the curve specified in the algorithm identifier of the issuer's public key.

The thing is you can find a set of parameters that matches the issuer public key and the signature without knowing the issuer's private key. Hence you can make your own certificate that will checkout as signed by something trustworthy.

Forgive me if I have mangled this a bit but this is my understanding at the moment.

[GeorgeOfTheJungle]

NSA was using this for ages, and then they probably realized that some other nation is aware of the issue too, so time to report.

Vladimir Putin!

"Microsoft Wins $10 Billion Department of Defense Cloud Contract"
https://nypost.com/2019/10/28/pentagon-hands-microsoft-10b-war-cloud-deal-snubs-amazon/

No worries!

[bd139]

Technical information on the vulnerability https://blog.trailofbits.com/2020/01/16/exploiting-the-windows-cryptoapi-vulnerability/