Sources: Microsoft to push a fix for a critical flaw in a cryptographic component present in all versions of Windows; NSA says it alerted Microsoft to the bug
Sources tell KrebsOnSecurity that Microsoft Corp. is slated to release a software update on Tuesday to fix an extraordinarily …
Krebs on SecurityBrian Krebs
Context & Ripple Effects
The NSA publicly crediting itself with the find is the notable part of this story: an intelligence agency choosing disclosure over stockpiling a flaw in the cryptographic trust layer of every Windows machine. It echoes an earlier pattern where an outside party's disclosure forced Microsoft's hand, as with the vulnerability Google disclosed ahead of the January 2015 patch batch.
IT administrators across every Windows version face an out-of-band patch cycle on a cryptographic component, since a flaw in the trust layer undermines certificate validation everywhere rather than in one app.
Microsoft must ship and defend an emergency fix while confirming the NSA's account, putting its vulnerability-response process under public scrutiny at disclosure time.
Second-order effects
Other intelligence agencies and large-scale finders now have a demonstrated template — hand a critical find to the vendor and take public credit — which pressures peers to disclose rather than retain exploits.
Rival platforms and cloud providers inherit the comparison: customers weigh whether their vendors get equivalent nation-state pre-notification, making disclosure relationships a competitive trust signal.
Third-order effects
If intel-agency disclosure becomes routine, the economics of government stockpiling shift — the default path for a critical find in widely deployed software bends toward vendor notification, reshaping how states treat offensive cyber capabilities.
A standing NSA-to-Microsoft pipeline points toward patching as the primary defense against nation-grade threats, raising the operational burden on enterprises that must treat every Patch Tuesday as incident response.
The trend: Intelligence agencies are shifting from stockpiling critical software flaws to disclosing them to vendors, making government-as-bug-finder a recurring feature of the patch cycle.
I get the impression that people should perhaps pay very close attention to installing tomorrow's Microsoft Patch Tuesday updates in a timely manner. Even more so than others. I don't know... just call it a hunch? ¯\_(ツ)_/¯
@briankrebs
@briankrebs on x
Sources say Microsoft on Tuesday will fix an extraordinarily scary flaw in all Windows versions, in a core cryptographic component that could be abused to spoof the source of digitally signed software. Apparently DoD & a few others got an advance patch https://krebsonsecurity.com…
@briankrebs
@briankrebs on x
NSA says they discovered the flaw on their own and that Microsoft will report that MS has seen no active exploitation of this vulnerability so far.
@briankrebs
@briankrebs on x
Not a coincidence. NSA says in their call with media this morning this vulnerability is one they reported to Microsoft.
@briankrebs
@briankrebs on x
NSA's dir. of cybersecurity Anne Neuberger says the critical cryptographic vulnerability resides in Windows 10 and Windows Server 2016, and that the concern about this particular flaw is that it “makes trust vulnerable.”
@briankrebs
@briankrebs on x
NSA: If enterprise-wide patching of this vuln not possible we recommend prioritize patching systems that perform TLS validation, or host critical infrastructure like domain controllers, DNS servers, VPN servers, etc.
@dinodaizovi
Dino A. Dai Zovi on x
Where even the NSA is prioritizing defending against exploitation of vulnerabilities over offensive use of them... https://twitter.com/...
@ericgeller
Eric Geller on x
Today's major Windows 10 flaw that the NSA found and disclosed to Microsoft relates to signature verification and could have let hackers sneak malware past verification, per @nakashimae. https://www.washingtonpost.com/ ... https://twitter.com/...
@gossithedog
Kevin Beaumont on x
Don't panic re this one. https://twitter.com/...
@gossithedog
Kevin Beaumont on x
Hey at least you're getting patches before Win7 and 2008 go out of support next week. https://twitter.com/...
@kimzetter
Kim Zetter on x
“According to sources, the vulnerability in question resides in a Windows component known as crypt32.dll, a Windows module that Microsoft says handles ‘certificate and cryptographic messaging functions in the CryptoAPI.’” https://twitter.com/...
@x0rz
@x0rz on x
I wonder if the Iranian CERT got an early warning as well as the DoD. Probably not. https://twitter.com/...
@paul_pearce
Paul Pearce on x
Looks like it's an ancient issue in crypt32.dll. I'm preemptively naming this vuln CRYPTKEEPER. Logo imminent. https://twitter.com/...
@kennwhite
Kenn White on x
Hearing the same thing all day. This should be big folks. https://twitter.com/...
@donie
Donie O'Sullivan on x
“..an extraordinarily serious security vulnerability... sources say Microsoft has quietly shipped a patch for the bug to branches of the U.S. military and to other high-value customers/targets that manage key Internet infrastructure...” https://krebsonsecurity.com/ ...
@julian_plummer
Julian Plummer on x
URGENT msg for planners & firms who manage their IT infrastructure. Microsoft are releasing an update this weekend to fix an apparently “scary” bug to do with the way your computer encrypts your client's info. Make it YOUR business to ensure that your IT person does this ASAP. ht…
@malwaretechblog
@malwaretechblog on x
I'm super excited to see if this Crypt32.dll vulnerability lives up to the hype. Crypt32 is used by pretty much all Windows apps for crypto, even 3rd party web browsers like Chrome and Firefox implicitly utilize it for SSL/TLS. https://krebsonsecurity.com/ ...