Security researchers have released proof-of-concept (PoC) codes for exploiting CurveBall (CVE-2020-0601), the first bug that the National Security Agency (NSA) reported. Included in this year’s first cycle of Patch Tuesday updates, the vulnerability affects Windows operating systems’ CryptoAPI’s validation of Elliptic Curve Cryptography (ECC) certificates and Public Key Infrastructure (PKI) trust. Enterprises and users are advised to patch their systems immediately to prevent attacks that exploit this security flaw.
The PoCs for CurveBall, released by researchers Saleem Rashid, Kudelski Security, and Ollypwn, show how it can affect one of the cryptographic implementations of the Windows CryptoAPI (Crypt32.dll) library’s functionality to the OS and applications.
Read more…
Source: Trend Micro