<!-- WP QUADS Content Ad Plugin v. 2.0.92 -->
<div class="quads-location quads-ad2528 " id="quads-ad2528" style="float:none;margin:0px 3px 3px 3px;padding:0px 0px 0px 0px;" data-lazydelay="0">

</div>
<h2>Windows 10 Crypto API Spoofing</h2>
<p>Microsoft has released a new security patch for a vulnerability that could affect millions of Windows 10 Users world wide.</p>
<!-- WP QUADS Content Ad Plugin v. 2.0.92 -->
<div class="quads-location quads-ad2530 " id="quads-ad2530" style="float:none;margin:0px 3px 3px 3px;padding:0px 0px 0px 0px;" data-lazydelay="0">

</div>

<!-- WP QUADS Content Ad Plugin v. 2.0.92 -->
<div class="quads-location quads-ad2523 " id="quads-ad2523" style="float:none;margin:0px 3px 3px 3px;padding:0px 0px 0px 0px;" data-lazydelay="0">

</div>

<!-- WP QUADS Content Ad Plugin v. 2.0.92 -->
<div class="quads-location quads-ad2531 " id="quads-ad2531" style="float:none;margin:0px 3px 3px 3px;padding:0px 0px 0px 0px;" data-lazydelay="0">

</div>

<h2>A decades old API</h2>
<p>The decades old CryptoAPI tool validates and signs packages/software which could be utilized by hackers/developers to sign and execute illegitimate software thus would allow users to run anything without user’s nor Antivirus/Internet Security software’s notice.</p>
<p>Microsoft mentioned that the vulnerability could also allow hackers to change or modify encrypted communications.</p>
<p>It’s important to mention that CryptoAPI is a legacy API that’s being replaced by a new CNG (Cryptography Next Generation API) which also supports CryptoAPI.</p>
<h2>CryptoAPI Key Storage Architecture</h2>
<p><img src="https://docs.microsoft.com/en-us/windows/win32/seccrypto/images/cryparch.png" alt="cryptoapi architecture" /> 

<!-- WP QUADS Content Ad Plugin v. 2.0.92 -->
<div class="quads-location quads-ad2529 " id="quads-ad2529" style="float:none;margin:0px 3px 3px 3px;padding:0px 0px 0px 0px;" data-lazydelay="0">

</div>
 
</p>
<h2>Download Patch</h2>
<h4>Direct Download</h4>
<p><a href="https://www.catalog.update.microsoft.com/Search.aspx?q=KB4528760">https://www.catalog.update.microsoft.com/Search.aspx?q=KB4528760</a></p>
<h4>CVE</h4>
<p><a href="https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-0601">https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-0601</a></p>
<h2>Windows 2008 R2, Windows 7 RDP</h2>
<p>A day ago Microsoft released two very important security patches on May 14, 2019.</p>
<p>One of these patches has been detected in the RDP service (CVE-2019-0708) which affects Windows 7 and Windows 2008 R2.</p>
<!-- WP QUADS Content Ad Plugin v. 2.0.92 -->
<div class="quads-location quads-ad2524 " id="quads-ad2524" style="float:none;margin:0px 3px 3px 3px;padding:0px 0px 0px 0px;" data-lazydelay="0">

</div>

<p>According to MS’s Article a remote code execution vulnerability exists in Remote Desktop Services – formerly known as Terminal Services – when an unauthenticated attacker connects to the target system using RDP and sends specially crafted requests.</p>
<h2>No Authentication or Interaction needed</h2>
<p>This vulnerability is pre-authentication and requires no user interaction. An attacker who successfully exploited this vulnerability could execute arbitrary code on the target system.</p>
<p>An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights.</p>
<p>When look at CVE-2019-0708, which is related to the RDP service, we see that attackers are able to run code on systems by sending specially produced packages without any user interaction and authentication and manage to install malware like Ransomware or other execution files.</p>
<h2>Download Patch</h2>
<p><a href="https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0708">https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0708</a></p>
<h2>Windows 2008R2, 2012R2, 2016 and 2019 DHCP</h2>
<p>The other one is in the DHCP service (CVE-2019-0725), and both vulnerabilities are very critical.</p>
<p>A memory corruption vulnerability exists in the Windows Server DHCP service when processing specially crafted packets. An attacker who successfully exploited the vulnerability could run arbitrary code on the DHCP server.</p>
<h2>Download Patch</h2>
<p><a href="https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0725">https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0725</a></p>
<!-- WP QUADS Content Ad Plugin v. 2.0.92 -->
<div class="quads-location quads-ad2526 " id="quads-ad2526" style="float:none;margin:0px 3px 3px 3px;padding:0px 0px 0px 0px;" data-lazydelay="0">

</div>

<h2>Sources:</h2>
<p>Microsoft, NSA, Other Security Researchers</p>

<!-- WP QUADS Content Ad Plugin v. 2.0.92 -->
<div class="quads-location quads-ad2522 " id="quads-ad2522" style="float:none;margin:0px 3px 3px 3px;padding:0px 0px 0px 0px;" data-lazydelay="0">

</div>


Reset and manage your Active Directory users' Passwords Active Directory is one of the most…
Finding Exchange Database hidden mailboxes. Story:Maybe you have been in this situation before, trying to…
If you're using a Proxy server in your firewall or in your network and have…
Story:I got some clients that have reported some of their users being locked out and…
Delegate Permissions This is a code that I have wrote recently to check if an…
Story: I got a request from a client who constantly gets CVs and have to…