Skip to main content

CurveBall Windows Spoofing Vulnerability

Microsoft has released details of a cryptographic vulnerability in Windows 10 and Windows Server 2016 or 2019 that allows a threat actor to impersonate trusted providers.

Threat ID:
CC-3343
Category:
Exploit
Threat Severity:
Medium
Threat Vector:
Vulnerability
Published:
16 January 2020 12:00 AM
Report a cyber attack: call 0300 303 5222 or email [email protected]

Summary

Microsoft has released details of a cryptographic vulnerability in Windows 10 and Windows Server 2016 or 2019 that allows a threat actor to impersonate trusted providers.

Affected platforms

The following platforms are known to be affected:

  • Microsoft Windows 10
  • Microsoft Windows Server 2016 & 2019

Threat details

The vulnerability is caused by incorrect validation of Elliptic Curve Cryptography (ECC) certificates. An attacker can exploit this flaw to sign a trojan or other malware executable, with users being told by Windows that it is from a legitimate source. A threat actor with network infrastructure access could also conduct a Man-in-the-Middle (MitM) attack to redirect HTTPS connections to a spoof website.

Multiple proof-of-concept exploits have been released that demonstrate how this vulnerability can be misused. At the time of publication, there are no known attacks that have exploited this vulnerability.

For further information:

Remediation steps

Type Step

Users and administrators are encouraged to review the following Microsoft update advisories and apply the necessary updates as soon as possible:

Additionally, to prevent and detect an infection, ensure that:

  • A robust program of education and awareness training is delivered to users to ensure they don’t open attachments or follow links within unsolicited emails.
  • All operating systems, anti-virus and other security products are kept up-to-date.
  • Regular anti-virus and security scans are performed on your organisation’s estate.
  • All day-to-day computer activities such as email and internet are performed using non-administrative accounts.
  • Strong password policies are in place.
  • Network, proxy and firewall logs should be monitored for suspicious activity.
  • User accounts accessed from affected devices should be reset on a clean computer.
  • Your organisation adopts a holistic all-round approach to Cyber Security as advocated by the 10 Steps to Cyber Security.

CVE Vulnerabilities

Status

CVE-2020-0601

Last edited: 29 June 2021 12:00 pm