Re:Patch Critical Cryptographic Vulnerability in Microsoft W...
by tptacek on Tuesday January 14, 2020 @03:24PM
(#22048890)
This attack targets the nuts and bolts of how the Windows platform actually implements TLS; a vulnerability in CryptoAPI that allowed you spoof any ECC certificate would presumably break all of TLS. What might mitigate this in Windows Software Update would be some kind of key pinning that prevented arbitrary certificates from being used.
Later
Dmitri Alperovitch at Crowdstrike says this doesn't impact Windows Update.
Re:Patch Critical Cryptographic Vulnerability in Microsoft W...
by mike_d on Tuesday January 14, 2020 @03:19PM
(#22048856)
It does allow you to modify TLS streams (the WU downloads), and code signing (checking that a binary can run), but it is unclear if any of the trusted WU validation keys (confirming the update is from a signed manifest) are ECC.
So: maybe.
Re:Patch Critical Cryptographic Vulnerability in Microsoft W...
by munchbunny on Tuesday January 14, 2020 @03:31PM
(#22048952)
Only if Microsoft is using ECC for its Windows Update certificates. I would guess not given how many past OS versions Windows Update has to support.
I would expect all connections to the Windows Update servers to be protected with TLS, and as a second layer the updates themselves to be signed, but if this vulnerability allows bypassing both signatures, this could be really bad.