|
@wdormann | |||||
|
Indeed I am.
|
||||||
|
||||||
|
Kenn White
@kennwhite
|
14. sij |
|
“The NSA discovered an error in the Microsoft code that verifies those signatures, potentially enabling a hacker to forge the signature”
washingtonpost.com/national-secur…
|
||
|
||
|
Filippo Valsorda
@FiloSottile
|
14. sij |
|
So just an Authenticode bypass? Meh. As @taviso said, nothing like an RCE in PE parsing, not even sure what the NSA would do with this.
It might be a fun crypto vuln though!
|
||
|
|
||
|
|
Kenn White
@kennwhite
|
14. sij |
|
if it requires privileged network active intercept and DNS spoofing for updates, it would be overblown. But as the Zen master said, We'll see...
|
||
|
|
||
|
|
Filippo Valsorda
@FiloSottile
|
14. sij |
|
Oh is Authenticode literally the only thing standing between the network and installing updates? Surely they connect via TLS to Microsoft or private network to corporate servers?
|
||
|
|
||
|
|
Will Dormann
@wdormann
|
14. sij |
|
Connected via TLS that is validated how exactly?
|
||
|
|
||
|
|
Filippo Valsorda
@FiloSottile
|
14. sij |
|
Are you saying this affects X.509 validation?
|
||
|
|
||
|
|
Filippo Valsorda
@FiloSottile
|
14. sij |
|
Oooh, now, that's fun.
|
||
|
|
||
|
Aaron Grattafiori
@dyn___
|
14. sij |
|
Client cert or similar auth could make this very bad(tm) too....
|
||
|
|
||
|
Nick Neumann
@aggieNick02
|
15. sij |
|
A big thing I've not found in any writeup is a list of which major browsers use the affected windows crypto libraries and are therefore also vulnerable to MITM attacks until you update windows. Firefox uses NSS - does that mean it is not susceptible? What about Chrome, Edge, etc?
|
||
|
|
||
|
|
Will Dormann
@wdormann
|
15. sij |
|
Chrome uses the affected library. As do Edge and IE. To be honest, Firefox is the only Windows browser I'm aware of at the moment that rolls their own crypto.
|
||
|
|
||
|
Simon Waters
@SimonRWaters
|
16. sij |
|
Microsoft's documentation also says TLS; everyone reads these, right?
|
||
|
|
||
|
Enigma Bridge
@enigmabridge
|
15. sij |
|
Could this be close to truth? keychest.net/stories/massiv…
|
||
|
|
||