Sources say Microsoft on Tuesday will fix an extraordinarily scary flaw in all Windows versions, in a core cryptographic component that could be abused to spoof the source of digitally signed software. Apparently DoD & a few others got an advance patch https://krebsonsecurity.com/2020/01/cryptic-rumblings-ahead-of-first-2020-patch-tuesday/ …
-
-
NSA's dir. of cybersecurity Anne Neuberger says the critical cryptographic vulnerability resides in Windows 10 and Windows Server 2016, and that the concern about this particular flaw is that it "makes trust vulnerable."
Prikaži ovu nit -
NSA: If enterprise-wide patching of this vuln not possible we recommend prioritize patching systems that perform TLS validation, or host critical infrastructure like domain controllers, DNS servers, VPN servers, etc.
Prikaži ovu nit -
This particular flaw is assigned as CVE-2020-0601. NSA says it exists in Win10 systems from July 2015 onward and Win Server 2016. My read on that is it's "critical" in those OSes, but may be present and less of a concern in older versions of Windows but we'll know more soon.
Prikaži ovu nit -
Sources say this disclosure from NSA is planned to be the first of many as part of a new initiative at NSA dubbed "Turn a New Leaf," aimed at making more of the agency's vulnerability research available to major software vendors and ultimately to the public.
Prikaži ovu nit -
The NSA's Neuberger said this wasn't the first vulnerability the agency has reported to Microsoft, but it was the first one for which they accepted credit/attribution when MS asked.
Prikaži ovu nit -
Microsoft has released an advisory for this vulnerability in Win10, Server 2016 and '19. It rated this as a "spoofing" flaw that is "important" in severity, but puts exploitability rating at 1, it's second most severe, i.e. "exploitation more likely." https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-0601 …
Prikaži ovu nit -
NSA's advisory is here: https://twitter.com/NSAGov/status/1217152211056238593 … CERT/CC's take: https://kb.cert.org/vuls/id/849224/
Prikaži ovu nit
Kraj razgovora
Novi razgovor -
-
-
Did they happen to say what year they discovered the flaw?
-
They were asked this direct question but their answer didn't provide much info about the when.
Kraj razgovora
Novi razgovor -
-
-
And what they actually mean to say is: 'we used this flaw ourselves for a long time, but we now see our adversaries use it to. Let's close this door'.
Hvala. Twitter će to iskoristiti za poboljšanje vaše vremenske crte. PoništiPoništi
-
Čini se da učitavanje traje već neko vrijeme.
Twitter je možda preopterećen ili ima kratkotrajnih poteškoća u radu. Pokušajte ponovno ili potražite dodatne informacije u odjeljku Status Twittera.