Security News > 2020 > January > Windows Vulnerability: Researchers Demonstrate Exploits
A day after the U.S. National Security Agency disclosed a vulnerability that could affect the cryptographic operations in some versions of Microsoft Windows, security researchers started releasing "Proof of concept" code to show how attackers potentially could exploit the flaw.
The vulnerability affects versions of Windows 10 as well as Windows Server 2016 and 2019.
Microsoft and the NSA warn, the vulnerability could be used by an attacker to fake digital certificates that are used as part of encrypted communications within Windows.
On Wednesday, security researcher Saleem Rashid posted on Twitter an explanation of how an attacker could use the Windows vulnerability to create phony Transport Layer Security, or TLS, certificates, which would then allow someone to spoof a legitimate website.
After Rashid's post on Twitter Wednesday, ZDNet reported that at least two other security researchers published proof-of-concept code on GitHub to demonstrate their methods of exploiting this particular vulnerability.
News URL
https://www.inforisktoday.com/windows-vulnerability-researchers-demonstrate-exploits-a-13614
Related news
- Researchers Find New Exploit Bypassing Patched NVIDIA Container Toolkit Vulnerability (source)
- LDAPNightmare PoC Exploit Crashes LSASS and Reboots Windows Domain Controllers (source)
- Researchers Uncover Nuclei Vulnerability Enabling Signature Bypass and Code Execution (source)
- Mirai Botnet Variant Exploits Four-Faith Router Vulnerability for DDoS Attacks (source)
- Security pros baited with fake Windows LDAP exploit traps (source)
- Google Project Zero Researcher Uncovers Zero-Click Exploit Targeting Samsung Devices (source)
- Hackers Exploit Aviatrix Controller Vulnerability to Deploy Backdoors and Crypto Miners (source)
- Researchers Find Exploit Allowing NTLMv1 Despite Active Directory Restrictions (source)
- CISA Warns of Active Exploits Targeting Trimble Cityworks Vulnerability (source)
- FINALDRAFT Malware Exploits Microsoft Graph API for Espionage on Windows and Linux (source)