Windows 10 Has a Security Flaw So Severe the NSA Disclosed It

#News(Security) [ via IoTGroup ]

Microsoft released a patch for Windows 10 and Server 2016 today after the National Security Agency found and disclosed a serious vulnerability.
“It will be a long day for a lot of Windows administrators around the world.” Kenn White, Open Crypto Audit Project
The flaw is specifically in Microsoft’s CryptoAPI service, which helps developers cryptographically “sign” software and data or generate digital certificates used in authentication—all to prove trustworthiness and validity when Windows checks for it on users’ devices.
“Think of signing malware as if it’s trusted by Microsoft or intercepting encrypted web traffic,” says David Kennedy, CEO of the corporate security evaluation firm TrustedSec, who formerly worked at the NSA.
“This is a core, low-level piece of the Windows operating system and one that establishes trust between administrators, regular users, and other computers on both the local network and the internet,” says Kenn White, security principal at MongoDB and director of the Open Crypto Audit Project.
It will be a long day for a lot of Windows administrators around the world.”
The NSA’s decision to share the vulnerability brings to mind the NSA hacking tool known as Eternal Blue, which exploited a Windows bug patched in early 2017.
That flaw was present in all versions of Windows available at the time, and the NSA had known about the bug—and exploited it for digital espionage—for more than five years.
Eventually, the NSA lost control of Eternal Blue; a few weeks after Microsoft issued a fix, a mysterious hacking group known as the Shadow Brokers leaked the tool online.
Criminals and nation state hackers alike had a field day with the tool, as Windows machines around the world slowly got around to patching.
The Windows 10 validation bug may be the NSA’s attempt to avoid a similar debacle.

Read More..
AutoTextExtraction by Working BoT using SmartNews 1.02976805238 Build 26 Aug 2019