News for hackers. Stuff that matters.

A comment on Patch Critical Cryptographic Vulnerability in Microsoft Windows [pdf]. Parent comment

Re:Patch Critical Cryptographic Vulnerability in Microsoft W... by heartbreak on Tuesday January 14, 2020 @03:16PM (#22048808)
That this exploit can be used to spoof the Windows Update system is a big yikes. You can’t necessarily trust today’s update itself.
[ Parent | on HN ]
Re:Patch Critical Cryptographic Vulnerability in Microsoft W... by munchbunny on Tuesday January 14, 2020 @03:41PM (#22049028)
That depends on whether Windows Update is using ECC certificates. A quick scan of my Windows 10 trusted root certificate store shows almost exclusively RSA based certificates, so I’d guess 80% odds that Windows Update itself isn’t affected.
[ Parent | on HN ]
Re:Patch Critical Cryptographic Vulnerability in Microsoft W... by shakna on Tuesday January 14, 2020 @04:56PM (#22049651)
It may still be affected, the system may accept a bad ECC cert and override the RSA cert.
[ Parent | on HN ]