Advisory: Windows CryptoAPI Spoofing Vulnerability
Our blog post on CVE-2020-0601 and the PoC.
Our demo website to test if you have the patch installed. (Linux & MacOS users were never impacted.)
Advisory: Windows CryptoAPI Spoofing Vulnerability
Initial blog post by Akamai Research.
Coming soon.
Slides are in presentation folder.
After the vulnerability, the usage of explicit parameters have been removed from Openssl:
$ openssl verify -verbose -CAfile ca-rogue.pem client-cert.pem
C = CH, ST = Vaud, L = Lausanne, O = Kudelski Security PoC, OU = Research Team, CN = github.com
error 94 at 1 depth lookup: Certificate public key has explicit ECC parameters
error client-cert.pem: verification failed
See https://lightshipsec.com/explicitly-parameterized-ecdsa-x-509-certificates/ and openssl/openssl#12139.