Sources say Microsoft on Tuesday will fix an extraordinarily scary flaw in all Windows versions, in a core cryptographic component that could be abused to spoof the source of digitally signed software. Apparently DoD & a few others got an advance patchhttps://krebsonsecurity.com/2020/01/cryptic-rumblings-ahead-of-first-2020-patch-tuesday/ …
-
-
The NSA's Neuberger said this wasn't the first vulnerability the agency has reported to Microsoft, but it was the first one for which they accepted credit/attribution when MS asked.
Show this thread -
Microsoft has released an advisory for this vulnerability in Win10, Server 2016 and '19. It rated this as a "spoofing" flaw that is "important" in severity, but puts exploitability rating at 1, it's second most severe, i.e. "exploitation more likely." https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-0601 …
Show this thread -
NSA's advisory is here: https://twitter.com/NSAGov/status/1217152211056238593 … CERT/CC's take: https://kb.cert.org/vuls/id/849224/
Show this thread
End of conversation
New conversation -
-
-
In exchange for.......
-
It is probably a calculation. Fixing the vulnerabilities creates more defense, than using them creates offense. In other words, denying Russia, Iran, and NK access by patching is more valuable than hacking them with these vulns.
- Show replies
New conversation -
-
-
That will be a welcome change, because they've been sitting on zero days they were supposed to disclose.
Thanks. Twitter will use this info to make your timeline better. UndoUndo
-
-
-
Their honeis caught it being used by RU hence the proper disclosure?

- End of conversation
New conversation -
-
-
Aka we are done with this 0 day, feel free to patch now
Thanks. Twitter will use this info to make your timeline better. UndoUndo
-
Loading seems to be taking a while.
Twitter may be over capacity or experiencing a momentary hiccup. Try again or visit Twitter Status for more information.