Just recently Microsoft discovered that it had an issue with API cryptography.
Now most of us know that Microsoft puts out patches every Tuesday. this is why we call it "patch Tuesday". But just the other day some reps from the company said to pay very close attention to updating your systems on the 14th of January, and it solely has to deal with CVE-2020-0601.
Curveball is a spoofing vulnerability within crypt32.dll. This is a core cryptographic module in Microsoft Windows that is responsible for implementing certificate and cryptographic message functions in Microsoft’s CryptoAPI.
Now most of us know that Microsoft puts out patches every Tuesday. this is why we call it "patch Tuesday". But just the other day some reps from the company said to pay very close attention to updating your systems on the 14th of January, and it solely has to deal with CVE-2020-0601.
Curveball is a spoofing vulnerability within crypt32.dll. This is a core cryptographic module in Microsoft Windows that is responsible for implementing certificate and cryptographic message functions in Microsoft’s CryptoAPI.
Successful exploitation of this vulnerability would allow attackers to deliver malicious code that appears to be from a trusted entity. The analysis notes some examples of where validation of trust would be impacted:
- HTTPs connections
- Signed files and emails
- Signed executable code launched as user-mode processes
Curveball bypasses Windows’ capability to verify the cryptographic trust. This would allow the attacker to pass malicious applications off as legitimate, trusted code, putting Windows PC's at risk. The attacker would need to get into a system in another fashion to deploy malware that exploits this vulnerability. They would more than likely either use common phishing tactics to trick a trusted user into interacting with a malicious application or use a man-in-the-middle attack through another compromised device in the environment to spoof an intercepted update and replace it with malware.
How do you fix your system you ask?
"Microsoft has released software updates to address CVE-2020-0601. If patching the vulnerability enterprise-wide is not possible, the NSA has advised “prioritizing patching systems that perform Transport Layer Security validation, or host critical infrastructure like domain controllers, Domain Name System servers, Virtual Private Network servers, etc.” Additionally, Tenable suggests patching endpoints directly exposed to the internet or systems regularly used by privileged users."
In short, download and install the patch from: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-0601
This will keep your system safe from this particular vulnerability.
