Microsoft patches serious PKI vulnerability

By Dylan Bushell-Embling
Wednesday, 15 January, 2020

Microsoft patches serious PKI vulnerability

Microsoft has released a patch for a serious vulnerability in Windows discovered by the US National Security Agency that can be exploited to undermine public key infrastructure trust.

The spoofing vulnerability in the way Windows CryptoAPI validates elliptic curve cryptography (EEC) certificates could be exploited by using a spoofed code-signing certificate to sign a malicious executable in a way that makes it appear the file was from a trusted source.

According to Microsoft, a user would have no way of knowing the file was malicious because the digital signature would appear to be from a trusted provider.

Exploiting the vulnerability could also allow attackers to conduct man in the middle attacks and decrypt user confidential information.

The security update ensures that Windows CryptoAPI completely validates ECC certificates to prevent these exploits.

According to the NSA, applying the patch is the only comprehensive means to mitigate the risk of the vulnerability.

The NSA reportedly took the unprecedented step of reporting the exploit to Microsoft rather than incorporating it into its own attack toolkit due to the potential severity of the vulnerability.

The agency has also published its own security advisory about the exploit, recommending that enterprises prioritise patching endpoints that have a high risk of exploitation, such as those directly exposed to the internet or regularly used by privileged users.

Chris Morales, head of security analytics at threat detection and response platform developer Vectra AI, said the NSA deserves kudos for reporting the vulnerability to Microsoft.

“I'd be interested to understand what makes this exploit worth reporting to Microsoft instead of keeping for their personal arsenal as they have in the past. It could be because many of those previous tools leaked and have caused widespread damage across multiple organisations,” he said.

“It could be because there was concern others would find this vulnerability themselves and it was dangerous enough to warrant remediation instead of weaponising. Or it just could be the NSA already has enough other methods for compromising a Windows system and doesn’t need it.”

Image credit: ©

Related Articles

70% of Australians rank privacy a top concern

The OAIC's Australian Community Attitudes to Privacy Survey 2020 found that Australians...

Study: Employee personal devices pose risk to corporate data

A Trend Micro survey has highlighted the risks posed by smart home devices to the corporate...

Aussie hackers targeting Facebook, Wi-Fi, says NordVPN

Research from NordVPN found that 43% of Australians looking to break into something were...

  • All content Copyright © 2020 Westwick-Farrow Pty Ltd