Security News > 2020 > January > Windows Vulnerability: Researchers Demonstrate Exploits
A day after the U.S. National Security Agency disclosed a vulnerability that could affect the cryptographic operations in some versions of Microsoft Windows, security researchers started releasing "Proof of concept" code to show how attackers potentially could exploit the flaw.
The vulnerability affects versions of Windows 10 as well as Windows Server 2016 and 2019.
Microsoft and the NSA warn, the vulnerability could be used by an attacker to fake digital certificates that are used as part of encrypted communications within Windows.
On Wednesday, security researcher Saleem Rashid posted on Twitter an explanation of how an attacker could use the Windows vulnerability to create phony Transport Layer Security, or TLS, certificates, which would then allow someone to spoof a legitimate website.
After Rashid's post on Twitter Wednesday, ZDNet reported that at least two other security researchers published proof-of-concept code on GitHub to demonstrate their methods of exploiting this particular vulnerability.
News URL
https://www.inforisktoday.com/windows-vulnerability-researchers-demonstrate-exploits-a-13614
Related news
- APT group exploits WPS Office for Windows RCE vulnerability (CVE-2024-7262) (source)
- New Linux Kernel Exploit Technique 'SLUBStick' Discovered by Researchers (source)
- New Windows IPv6 Zero-Click Vulnerability (source)
- Hackers Exploit PHP Vulnerability to Deploy Stealthy Msupedge Backdoor (source)
- Hackers use PHP exploit to backdoor Windows systems with new malware (source)
- Volt Typhoon Hackers Exploit Zero-Day Vulnerability in Versa Director Servers Used by MSPs, ISPs (source)
- Week in review: SonicWall critical firewalls flaw fixed, APT exploits WPS Office for Windows RCE (source)
- Hacktivists Exploits WinRAR Vulnerability in Attacks Against Russia and Belarus (source)
- Cisco fixes root escalation vulnerability with public exploit code (source)
- Windows vulnerability abused braille “spaces” in zero-day attacks (source)