January 16, 2020 By Shane Schick 2 min read

Microsoft used its first Patch Tuesday update of the new decade to address a critical vulnerability in its CryptoAPI library.

A default feature within Windows that’s also known as Crypt32.dll, the CryptoAPI patch addresses a bug that could allow rogue actors to fake signatures on encrypted HTTPS communications and launch man-in-the-middle (MitM) attacks. By spoofing Elliptic Curve Cryptography (ECC) certificates, hackers could also make malicious files appear like they were coming from a legitimate source.

The U.S. National Security Agency (NSA) first discovered and informed Microsoft about the vulnerability, the company said.

‘Severe And Widespread’ Risks

Though neither organization has reported any cyberattacks that make use of the bug, CVE-2020-0601, it affects several Windows operating systems. These include Windows 10, Windows Server 2016 and Windows Server 2019.

In its advisory, the NSA said the CryptoAPI vulnerability could lead to remote code execution and the ability to defeat trusted network connections. It also predicted cybercriminals would quickly recognize the opportunity in front of them.

“Remote exploitation tools will likely be made quickly and widely available,” it said, adding that the consequences of not patching CVE-2020-0601 could be “severe and widespread.”

In an interview with security researcher Brian Krebs, Matthew Green, a computer science professor from Johns Hopkins University, said cybercriminals could be creative in their use of the Crypt32 flaw. Users might be fooled into downloading malware disguised as software updates, for instance, or clicking on a website that appears trustworthy.

Besides the CryptoAPI/Crypt32 vulnerability, Microsoft’s Patch Tuesday update dealt with 49 other security gaps in Windows and related applications. It was also a significant milestone in that the update officially ended mainstream support for Windows 7.

Apply Patches to Maintain a Solid Security Posture

While the NSA’s advisory will probably lead organizations to prioritize the CryptoAPI patch, the IT security best practice approach is to patch early, often and extensively. In other words, all the necessary patches should be applied.

Security experts have noted that issues like technical debt and “patch fatigue” can sometimes prevent this from happening. Overcome that by making sure your patch management tools are up to date and by conducting a vulnerability assessment to make sure nothing is overlooked.

More from

Generative AI security requires a solid framework

4 min read - How many companies intentionally refuse to use AI to get their work done faster and more efficiently? Probably none: the advantages of AI are too great to deny.The benefits AI models offer to organizations are undeniable, especially for optimizing critical operations and outputs. However, generative AI also comes with risk. According to the IBM Institute for Business Value, 96% of executives say adopting generative AI makes a security breach likely in their organization within the next three years.CISA Director Jen…

Q&A with Valentina Palmiotti, aka chompie

4 min read - The Pwn2Own computer hacking contest has been around since 2007, and during that time, there has never been a female to score a full win — until now.This milestone was reached at Pwn2Own 2024 in Vancouver, where two women, Valentina Palmiotti and Emma Kirkpatrick, each secured full wins by exploiting kernel vulnerabilities in Microsoft Windows 11. Prior to this year, only Amy Burnett and Alisa Esage had competed in the contest's 17-year history, with Esage achieving a partial win in…

Self-replicating Morris II worm targets AI email assistants

4 min read - The proliferation of generative artificial intelligence (gen AI) email assistants such as OpenAI’s GPT-3 and Google’s Smart Compose has revolutionized communication workflows. Unfortunately, it has also introduced novel attack vectors for cyber criminals. Leveraging recent advancements in AI and natural language processing, malicious actors can exploit vulnerabilities in gen AI systems to orchestrate sophisticated cyberattacks with far-reaching consequences. Recent studies have uncovered the insidious capabilities of self-replicating malware, exemplified by the “Morris II” strain created by researchers. How the Morris…

Topic updates

Get email updates and stay ahead of the latest threats to the security landscape, thought leadership and research.
Subscribe today