The United States National Security Agency (NSA) has discovered a serious flaw in Windows 10 that can be used by computer intruders to create malicious software or malware that appears legitimate.
What is the problem?
The vulnerability is in a decades-old cryptographic component of Windows, known as CryptoAPI . This component has a wide range of functions and one of them allows developers to digitally sign their software, which shows that it has not been tampered with. However, this newly detected bug can allow attackers to spoof legitimate software, which could make it easier for malicious software, such as ransomware , to run on a vulnerable computer.
“The user would have no way of knowing that the file is malicious, because the digital signature would appear to be from a trusted provider,” Microsoft said.
CERT-CC, Carnegie Mellon University’s Vulnerability Disclosure Center, said the bug can also be used to intercept and modify HTTPS (or TLS) communications.
According to the technology giant, they have found no evidence to show that such security vulnerability has been actively exploited by attackers, classifying the matter as “important.”
What versions of Windows does it affect?
The bug is a problem for environments that rely on digital certificates to validate the software that machines are running, and of course it’s a potentially far-reaching security issue if left unrepaired.
The affected operating systems are: Windows 10, Windows Server 2016 and Windows Server 2019 . The fact that it is a “significant” but not “critical” vulnerability is no reason to delay patching, as potential hackers will inevitably reverse engineer the solution to discover the flaw and use it on systems. not updated or patched with this bug.
“The vulnerability puts Windows endpoints at risk for a wide range of exploitation vectors,” the NSA said in a statement. “The NSA assesses that the vulnerability is severe and that more sophisticated cyber actors will understand the underlying flaw very quickly and, if exploited, will render the aforementioned platforms fundamentally vulnerable.”
Is the patch available now?
Microsoft has already released the patch that fixes this security flaw . Some computers will receive the solution automatically, if they have the automatic update option enabled. Others can get it manually by going to Windows Update in their computer settings.
“We recommend that users install the patch immediately,” said Anne Neuberger, head of the NSA’s cybersecurity directorate. The agency alerted Microsoft as soon as it discovered the bug.
“Customers who have already applied the update, or have automatic updates enabled, are already protected,” said Jeff Jones, Microsoft’s senior director, in a statement. “As always, we encourage users to install all security updates as soon as possible.”
It is unusual to see the NSA reporting these types of vulnerabilities directly to Microsoft, but it is not the first time the government agency has done so.
