[New critical Windows vulnerability] Great example of the dangers of not knowing crypto!_亚博娱乐官网_亚博pt手机客户端登录

haakja
2020-09-20T15:24:42.470Z
type:structured-message
www.uio.no

Recently, a new highly critical Windows vulnerability was discovered which affects the Active Directory domain controller (essentially the main "gatekeeper" to access a Windows network). The fun part about this vulnerability is that it is solely due to the bad/wrong usage of cryptography. In fact, it goes straight to what we have talked about in lectures 3 and 4:

Using encryption instead of MACs in order to achieve integrity/authentication.

Misusing the requirements of the chosen encryption primitives (using all-zero IVs when a new random IV is required for each encryption).

Exploitation of the malleability of an encryption scheme not designed for integrity.

In particular, the exploit targets a mode-of-operation which we did not cover in class called Cipher feecback (CFB) mode. However, it share...