CurveBall: the Windows bug the NSA reported
A flaw in how Windows checks certificates could let fake software and websites look trusted. Patch it this week.
Last Tuesday’s Windows updates fixed CVE-2020-0601, nicknamed CurveBall. The NSA found it and reported it to Microsoft, which is unusual by itself.
The bug is in how Windows 10 and Server 2016/2019 check certain certificates. An attacker could make a fake certificate that Windows accepts as genuine. That means malware signed to look like it came from Microsoft, or a fake HTTPS website that shows no warning.
What to do:
- Install the January updates on Windows 10 and Windows Server 2016 and 2019, starting with servers that handle TLS and machines that browse the web.
- Don’t forget proxies and appliances running Windows underneath.
- Check your antivirus has updates that detect files signed with spoofed certificates.
Trust in certificates holds up the whole internet. When the checker has a bug, patching is not optional.