Yet Another Security Flaw - Microsoft Windows 10

Good evening and welcome back to another post from ToBeSecured. As you all know, a couple of months ago I started creating vlogs via Instagram that get uploaded every Tuesday. If you haven't already, go and check out yesterday's video that covers the topic of a flaw in the Tik Tok application as millions of you use this app every day. I hope your Wednesday has been prosperous and that you're following through on your goals. Remember 2020 is about prosperity and manifesting your greatness!

So let's jump right into today's topic: Microsoft Windows 10 vulnerability. Microsoft usually release a monthly "Patch Tuesday" to give users the ability to update their operating system as well as fix any vulnerabilities or bugs that may have occurred during the previous version. What initially started as a "could be" was later confirmed as we received some news that an "extraordinarily serious" security vulnerability in a core cryptographic component of Windows 10 exists.

Now earlier, it was stated that, from Windows 7 and up were affected, but now it seems there isn't much clarity on which versions of Windows are affected by the vulnerability within the crypt32.dll component that. This component is associated with Windows security certificates and cryptographic messaging functions. Brian Krebbs, who was the first to report on the rumored flaw, stated the problem only exists within Windows 10 and Windows Server 2016.

The NSA's director of cybersecurity, Anne Neuberger confirmed a flaw exists and it was reported to Microsoft by the NSA itself. Microsoft also confirmed by releasing this statement: "A spoofing vulnerability exists in the way Windows CryptoAPI (Crypt32.dll) validates Elliptic Curve Cryptography (ECC) certificates."

Here's what this means:

1. An attacker could be able to exploit this, in a way that the NSA said "makes trust vulnerable," by using a spoofed code-signing certificate.

2. By so doing, a malicious file could appear to come from a legitimate and trusted source.

3. A successful exploit could also allow the attacker to conduct man-in-the-middle attacks and decrypt confidential information on user connections to the affected software

Here's what you need to do:

1. Do not trust websites or emails that contain links offering patches for the crypto32.dll

2. It's important to use the official channels to update operating systems, in this case, the Update and Security section in Windows 10 settings.

3. All Windows 10 users are advised to apply the Patch Tuesday update as soon as it becomes available to them.

It has been rumored that U.S. military and high-value internet infrastructure targets have been shipped the fix already, under strict non-disclosure agreements. I have gathered this information from Forbes and will keep you all updated with more information as it is released. Be patient and understand this is being taken very seriously as hundreds of millions of users are affected by this.

What are your thoughts on this topic? Subscribe to my blog if you haven't already and follow my Instagram - ToBeSecured for CyberTuesday vlogs. I will be launching my YouTube channel soon so be on the lookout for that as well. Thank you for tuning in and remember ToBeSecured!