U tweetove putem weba ili aplikacija drugih proizvođača možete dodati podatke o lokaciji, kao što su grad ili točna lokacija. Povijest lokacija tweetova uvijek možete izbrisati. Saznajte više
Okay, we have confirmed @KudelskiSec with my colleague @Pelissier_S that CVE-2020-0601 (Windows CryptoAPI Spoofing Vulnerability), aka "Chain of Fools", allows for MITM attacks and some certificate spoofing. We have a working POC and a blog post will come soonish :)
And here is the blog post and the PoC code, done with my colleague @Pelissier_Shttps://research.kudelskisecurity.com/2020/01/15/cve-2020-0601-the-chainoffools-attack-explained-with-poc/ …
“As usual in the cryptographic community, where flaws can be far-reaching, we practice full disclosure...” Errr, no. We typically practice *responsible* disclosure. (I’m not saying you’ve been irresponsible here, since CVE was already out. Just pointing out common practice.)
This was a reference to the Real World Crypto conferences where the topic came out multiple times. The idea is that crypto flaws can be present in other libs than the one directly affected and having an embargo on them is a bad idea.
Thanks for the writeup! Minor formatting issue herepic.twitter.com/SHdPKBnW3K
Thanks! I don't get it, though... From where does CryptoAPI read the rogue generator? Is the server configured to send the CA certificate too (when it normally doesn't), and CryptoAPI gets the parameters from it? (also, https://chainoffools.wouaib.ch/ seems to be down)
Twitter je možda preopterećen ili ima kratkotrajnih poteškoća u radu. Pokušajte ponovno ili potražite dodatne informacije u odjeljku Status Twittera.
