Collection of CVE-2020-0601 (#ChainOfFools | #CurveBall) resources
A summary from the NSA advisory states.
NSA has discovered a critical vulnerability (CVE-2020-0601) affecting Microsoft Windows®1 cryptographic functionality. The certificate validation vulnerability allows an attacker to undermine how Windows verifies cryptographic trust and can enable remote code execution. The vulnerability affects Windows 10 and Windows Server 2016/2019 as well as applications that rely on Windows for trust functionality. Exploitation of the vulnerability allows attackers to defeat trusted network connections and deliver executable code while appearing as legitimately trusted entities. Examples where validation of trust may be impacted include:
- HTTPS connections
- Signed files and emails
- Signed executable code launched as user-mode processes
Walkthough and PoC demo from Kudelski Security
In depth blog from Ken Whyte
Hacker News discussion
Tal Be'ery commentary
Kudelski Securitry python PoC
Ollypwn ruby PoC
Example fake github cert for MitM or phishing
Example signed malware reducing AV detections
3rd CurveBall blog from Tal Be'ery describing Wireshark network detections
Microsoft have released an event log message when suspected exploitation is attempted via the CveEventWrite function
Matt Graeber has produced a powershell oneliner for host EDR detection
Get-WinEvent -FilterHashtable @{ LogName = 'Application'; Id = 1; ProviderName = 'Microsoft-Windows-Audit-CVE' } | select -Property * -ExcludeProperty MachineName, UserId
A Sigma SIEM rule from Florian Roth for us in multiple SIEM tools and based off the Microsoft event log
A detection by 0xxon for Zeekurity network morning tool to alert when custom ECC generators are observed within certificates
- https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-0601
- https://www.cisecurity.org/advisory/a-vulnerability-in-the-microsoft-cryptographic-library-crypt32dll-could-allow-for-remote-code-execution_2020-005/
- https://www.us-cert.gov/ncas/alerts/aa20-014a
- https://www.cisa.gov/blog/2020/01/14/windows-vulnerabilities-require-immediate-attention
- https://kb.cert.org/vuls/id/849224/
- https://cyber.dhs.gov/ed/20-02/
- https://media.defense.gov/2020/Jan/14/2002234275/-1/-1/0/CSA-WINDOWS-10-CRYPT-LIB-20190114.PDF