Hello, welcome to the Thursday, January 16th, 2020 edition of the Sandcent Storm Center's Stormcast.

My name is Johannes Ulrich.

And today I'm recording from Jacksonville, Florida.

Quick follow up on the CVE 2020-601 vulnerability.

That's the Crypto API Elliptic Curve Certificate issue. CVE 2000, 2010-601 vulnerability.

That's the Crypto API Elliptic Curve Certificate issue.

Now, we had a webcast today with Jake Williams, just summarizing some of the issues here.

Since I spoke yesterday, there's sort of a couple things that came up. First of all, there are a number of researchers

that have produced sort of proof of concept exploits, but none of them has published them so far as

I'm aware. There is one blog post that really goes over all the details and what's going on here.

The vulnerability is subtle, I would call it.

It's not one of those things like the famous Apple go-to-fail vulnerability from a couple

years ago where part of the verification code just wasn't run.

I think the big question that everybody is sort of waiting for, how would an attacker

actually practically weaponize this vulnerability? In the end, the attacker still essentially has to

get you to go to a website, has to get you to download some binary and execute it. So that's a bit the hard part here. And probably one of the big things that I think I mentioned yesterday, but Windows update is not vulnerable here. Also, a lot of the other update processes, but it's a little bit hit and miss, may or may not be vulnerable depending on whether

they do certificate pinning or not. Given that this is not terribly difficult to exploit, I would

definitely still recommend that you should expedite patching and hopefully have things patched by

the end of this week. I know this is aggressive for a lot of enterprises.

I published a little follow-up diary today with an answer to many of the questions we got during

the webcast. I'll probably actually meant that a little bit tomorrow. I still haven't gotten all

the questions from the webcast already together and integrated.

...