{"id":17499,"date":"2020-01-21T17:40:05","date_gmt":"2020-01-22T01:40:05","guid":{"rendered":"https:\/\/www.palada.net\/index.php\/2020\/01\/21\/news-11234\/"},"modified":"2020-01-21T17:40:05","modified_gmt":"2020-01-22T01:40:05","slug":"news-11234","status":"publish","type":"post","link":"http:\/\/www.palada.net\/index.php\/2020\/01\/21\/news-11234\/","title":{"rendered":"Update: Curveball Exploit (CVE-2020-0601) Starts Making the Rounds"},"content":{"rendered":"
\n
\n

A FortiGuard Labs Threat Analysis<\/i><\/b><\/p>\n

Introduction<\/h2>\n

On patch Tuesday for January 2020, Microsoft disclosed a critical vulnerability<\/a> that had been discovered by the NSA, that has been dubbed CurveBall or ChainOfFools by the security research community. This vulnerability affects Windows 10, Windows 2016, and the 2019 version of the crypt32.dll that implements Windows\u2019 CryptoAPI.<\/p>\n

The vulnerability can be exploited by a malicious actor to spoof certificates in a way that will trick any software that leverages Windows CryptoAPI for signature validation into believing it is legitimate. For example, ransomware authors can trick Windows into believing that their samples have been signed by Microsoft.<\/p>\n

Exploit PoCs Released<\/h2>\n

Due to the severity of this issue, a lot of effort has been invested by the security community over the past few days to understand its root cause. Surprisingly, the vulnerability is very simple to exploit and there are already several public implementations that can leverage it to spoof certificates.<\/p>\n

As expected, soon after the public exploits were released, malware with spoofed Microsoft certificates were uploaded to\u00a0Virus-Total<\/a>:\u00a0 \u00a0\u00a0<\/p>\n<\/p><\/div>\n