Quote:In a shift toward transparency, the National Security Agency announced a bug that could have left over 900 million PCs vulnerable to attack.

Quote:NSA has discovered a critical vulnerability (CVE-2020-0601) affecting Microsoft Windows®1 cryptographic functionality.
The certificate validation vulnerability allows an attacker to undermine how Windows verifies cryptographic trust and can
enable remote code execution. The vulnerability affects Windows 10 and Windows Server 2016/2019 as well as
applications that rely on Windows for trust functionality. Exploitation of the vulnerability allows attackers to defeat trusted
network connections and deliver executable code while appearing as legitimately trusted entities. Examples where
validation of trust may be impacted include

Quote:CVE-2020-0601 is a serious vulnerability, because it can be exploited to undermine Public Key Infrastructure (PKI) trust. PKI is a set of mechanisms that home users, businesses, and governments rely upon in a wide variety of ways. The vulnerability permits an attacker to craft PKI certificates to spoof trusted identifies, such as individuals, web sites, software companies, service providers, or others. Using a forged certificate, the attacker can (under certain conditions) gain the trust of users or services on vulnerable systems, and leverage that trust to compromise them.  

Quote:I'm not quite sure how this would play out yet as I assume most paths are clearly patched.

Say a program like Chrome is installed and we can see that through a man in the middle attack (headers).

We see an update for the browser has been released or just about to be released that day.

What if we grab that certificate for the browser update and craft a malicious replacement for the man in the middle attack.

Same would apply for Windows or Adobe applications - surely there must be something that's vulnerable through that. I haven't personally seen anyone doing network exploitation through application updates before.

(Jan 15, 2020 06:50 PM)Charger Wrote:  Tbh I don’t believe anything unless a PoC is provided. Probably just me.

(Jan 16, 2020 06:45 AM)LoremIpsum Wrote:  Isn't it true that the NSA itself installed some 'files' at our computers in order to monitor it?
I heard about such release a few years ago at a different forum, claiming to have found the weird file extensions of the NSA 'spyware'. Just rumours, I can't verify anything.

(Jan 16, 2020 06:51 AM)Mr. Robot Wrote:  Yeah like notepad++ they had backdoors for. Heaps of Clay Davis.

(Jan 16, 2020 06:52 AM)LoremIpsum Wrote:  I used Notepad++ in the past for HTML editing. Glad I switched to Mac OS although I use Windows occasionally too.
What is the best anti-virus software in your opinion? Or how do you protect yourself against the Windows 10 'flaws'.

Btw, pretty ironic. First disabling Windows XP from updates, then making Windows 8 and free update to Windows 10 and now they figured out it has flaws? Sounds weird to me.

(Jan 16, 2020 06:56 AM)Mr. Robot Wrote:  Well yes and no but overall it's important to remember exploits will always be found - whether intentional or not, not all of them were intended.

Honestly you don't. You just do whatever you can network side and then keep track of incoming and outgoing connections. You will never have time to analyze every single packet of data that leaves but you can learn to identify the interesting ones.

When it comes to the NSA, any data that microsoft sees will go there so it's like w/e - the main issue is the people on HF talking Clay Davis about how their system is running linux or some Clay Davis then realize oh wait people who use the same network as me use windows...

Stoopd af

(Jan 16, 2020 06:59 AM)LoremIpsum Wrote:  I think the majority of people, not only at HF, but in general, feel 'safe' while browsing online without having any clue why they aren't safe.
The privacy of online usage isn't what it was, nor will it ever become any better I think. Just trying to stay as safe as possible here.  🤝

(Jan 16, 2020 07:00 AM)Mr. Robot Wrote:  One day we will have AI hacking and AI defense. Battling it out, making us more secure.

(Jan 16, 2020 08:01 AM)hayesh Wrote:  Since when has the NSA cared about protecting peoples privacy