News for hackers. Stuff that matters.

A comment on Patch Critical Cryptographic Vulnerability in Microsoft Windows [pdf]. Parent comment

Re:Patch Critical Cryptographic Vulnerability in Microsoft W... by ynik on Tuesday January 14, 2020 @03:09PM (#22048740)
The attack allows faking https certs as well as code signing certs; so it seems plausible that a MitM attacker could trick Windows Update (or other auto-updaters) into executing malicious code.
[ Parent | on HN ]
Re:Patch Critical Cryptographic Vulnerability in Microsoft W... by heartbreak on Tuesday January 14, 2020 @03:16PM (#22048808)
That this exploit can be used to spoof the Windows Update system is a big yikes. You can’t necessarily trust today’s update itself.
[ Parent | on HN ]
Re:Patch Critical Cryptographic Vulnerability in Microsoft W... by munchbunny on Tuesday January 14, 2020 @03:41PM (#22049028)
That depends on whether Windows Update is using ECC certificates. A quick scan of my Windows 10 trusted root certificate store shows almost exclusively RSA based certificates, so I’d guess 80% odds that Windows Update itself isn’t affected.
[ Parent | on HN ]
Re:Patch Critical Cryptographic Vulnerability in Microsoft W... by shakna on Tuesday January 14, 2020 @04:56PM (#22049651)
It may still be affected, the system may accept a bad ECC cert and override the RSA cert.
[ Parent | on HN ]
Re:Patch Critical Cryptographic Vulnerability in Microsoft W... by atxlurker on Tuesday January 14, 2020 @10:29PM (#22051537)
What about user certs. Some windows systems allow for authenticating with a user cert. depending on how bad the validation bug is, seems like spoofing a user certificate could be a valid attack vector.
[ Parent | on HN ]