You know a security issue is going to be a big problem when the National Security Agency is posting an APB for people to update their computers as soon as possible.
The United States Department of Defense has issued a critical security warning advising users of Windows 10 to ensure that their operating systems are up to date. The NSA identified a vulnerability that will allow malicious software to be installed on a machine by fooling Windows into thinking that it is an official update. The most up to date versions of Windows have allegedly patched this bug, and the department warns that it expects exploits to start cropping up in the very near future.
NSA has discovered a critical vulnerability (CVE-2020-0601) affecting Microsoft Windows®1 cryptographic functionality. The certificate validation vulnerability allows an attacker to undermine how Windows verifies cryptographic trust and can enable remote code execution. The vulnerability affects Windows 10 and Windows Server 2016/2019 as well as applications that rely on Windows for trust functionality. Exploitation of the vulnerability allows attackers to defeat trusted network connections and deliver executable code while appearing as legitimately trusted entities. Examples where validation of trust may be impacted include:
- HTTPS connections
- Signed files and emails
- Signed executable code launched as user-mode processes
The vulnerability places Windows endpoints at risk to a broad range of exploitation vectors. NSA assesses the vulnerability to be severe and that sophisticated cyber actors will understand the underlying flaw very quickly and, if exploited, would render the previously mentioned platforms as fundamentally vulnerable. The consequences of not patching the vulnerability are severe and widespread. Remote exploitation tools will likely be made quickly and widely available. Rapid adoption of the patch is the only known mitigation at this time and should be the primary focus for all network owners.
Source: NSA
MMO Fallout 