CryptoAPI bug makes 99% of Windows servers vulnerable

[Alfonso Maruccia]

WTF?! Akamai has unveiled a new security threat to Windows-based servers and data center machines based on a dangerous bug Microsoft fixed months ago. However, it seems almost no one bothered to install the much-needed patch.

When it comes to dangerous cryptographic bugs on Windows, CryptoAPI is the gift that keeps on giving. The interface can be used by Win32 programs to manage security and cryptographic practices, like validating certificates or verifying identities. But CryptoAPI can also bring potentially critical security flaws to the aforementioned Windows platform, making identity and certificate spoofing easier.

According to Akamai Security analysts, that's exactly what happened with the vulnerability known as CVE-2022-34689. Disclosed by the US NSA and the UK National Cyber Security Center (NCSC), the "Windows CryptoAPI Spoofing Vulnerability" was patched by Microsoft in August 2022 but was publicly announced only in October 2022.

According to Redmond's security bulletin, CVE-2022-34689 can be exploited to spoof an attacker's true identity and perform actions "such as authentication or code signing as the targeted certificate."

As explained by Akamai, the gist of the issue is that CryptoAPI makes the assumption that "the certificate cache index key, which is MD5-based, is collision-free." MD5 has been known for being vulnerable to collision issues – two chunks of data which happen to have the very same MD5 hash – for a long time now, but old software versions using CryptoAPI are still vulnerable to the flaw.

CVE-2022-34689 can be exploited by cyber-criminals to digitally sign malicious executables and make them appear as they were coming from trusted and secure sources, or to create a TLS certificate that appears to belong to another (legit) organization and trick an application (ie a web browser) into trusting said malicious certificate. The bug was classified as "critical" and given a CVSS severity score of 7.5 out of 10, with Microsoft saying that exploitation was "most likely" albeit the bug couldn't be used for remote code execution.

Now Akamai has published proof-of-concept (PoC) code that shows how exploitation works, employing an old version of the Chrome web browser (v48) which uses CryptoAPI to check certificate legitimacy. With a man-in-the-middle attack, Akamai researchers were able to use a malicious certificate to break HTTPS security.

Akamai said that, besides Chrome 48, there are many other vulnerable targets "in the wild" which are still using the flawed CryptoAPI feature. The worst thing about CVE-2022-34689, however, is that the overwhelming majority of system administrators and professional users didn't care to install a patch which has been available for six months.

According to the security enterprise, "fewer than 1% of visible devices" in data centers are protected, which means that 99% of Windows-based servers visible to the Internet are vulnerable right now.

Permalink to story.

https://www.techspot.com/news/97394-cryptoapi-bug-makes-99-windows-servers-vulnerable.html

 

[brucek]

I don't manage any Windows server infrastructure so not my scene, but a great follow up article would be why have so few production systems been patched. Is the issue like with home windows editions where admins are too afraid that each patch will break things? Or that the patch is only available as part of other "upgrades" that are generally seen as downgrades by the user community?

 

[Theinsanegamer]

I don't manage any Windows server infrastructure so not my scene, but a great follow up article would be why have so few production systems been patched. Is the issue like with home windows editions where admins are too afraid that each patch will break things? Or that the patch is only available as part of other "upgrades" that are generally seen as downgrades by the user community?

windows 10 forces updates and 99% are not smart enough to figure out how to delay them. How on earth has this patch not been applied?

 

[envirovore]

windows 10 forces updates and 99% are not smart enough to figure out how to delay them. How on earth has this patch not been applied?

Because corporate/enterprise environments have to account for other systems reliance to continue to function and/or usually incorporate some sort of legacy software.
Generally not wise to install an update to your servers without first verifying there isn't a change that breaks another production environment, especially if you're a business that has thousands of machines deployed. Testing takes time.

That said, generally calls like that come down from management and it's not the IT department not wanting to install updates, but being told they can't. Management is dumb, and if it seems like everything is just fine the way it is then they're not going to approve system downtime for updating or want to pay IT overtime to install an update during 'off peak' hours.

 

[SilentMajority]

I don't manage any Windows server infrastructure so not my scene, but a great follow up article would be why have so few production systems been patched. Is the issue like with home windows editions where admins are too afraid that each patch will break things? Or that the patch is only available as part of other "upgrades" that are generally seen as downgrades by the user community?

we used to delay windows updates by a month but then post pandemic, risks seem to have increased at least in my work type's environment that we bumped the updates to only 2 weeks delay.

at home though my computers' windows updates are delayed by two months

this is all because it usually takes microsoft a month to fix their bugs. so I dont really feel the majority of their screw ups with my setup. but of course I also have other layers of security set as well.

 

[Theinsanegamer]

Because corporate/enterprise environments have to account for other systems reliance to continue to function and/or usually incorporate some sort of legacy software.
Generally not wise to install an update to your servers without first verifying there isn't a change that breaks another production environment, especially if you're a business that has thousands of machines deployed. Testing takes time.

That said, generally calls like that come down from management and it's not the IT department not wanting to install updates, but being told they can't. Management is dumb, and if it seems like everything is just fine the way it is then they're not going to approve system downtime for updating or want to pay IT overtime to install an update during 'off peak' hours.

Which I get, but to be missing updates from 3+ months ago is sheer negligence.

 

[envirovore]

Which I get, but to be missing updates from 3+ months ago is sheer negligence.

Oh, I absolutely agree.
I've read about how some companies are well more than 6 months behind on updates on other forums from IT heads complaining about issues like this and how they constantly tell management they need to update and are constantly shot down.

 

[antiproduct]

I get delaying server patching for a couple days to make sure nothing majorly stupid will break the server/services (which seems somewhat common these days), but this was patched in October. How is it that people wouldn't have patched a server since then?? That seems to be just a neglectful sysadmin... or maybe no sysadmin I guess.