News for hackers. Stuff that matters.

A comment on Patch Critical Cryptographic Vulnerability in Microsoft Windows [pdf]. Parent comment

Re:Patch Critical Cryptographic Vulnerability in Microsoft W... by rasz on Tuesday January 14, 2020 @06:06PM (#22050171)
>The old crypto API -didn't- check that certificates were signed from a fixed set of valid parameters. It would just check for sig validity allowing for spoofing of the cert.

This sounds exactly how pdf signatures were attacked and successfully defeated https://media.ccc.de/v/36c3-10832-how_to_break_pdfs https://www.youtube.com/watch?v=k8FIDGmmYvs

[ Parent | on HN ]

There are no comments on this comment yet.