Maxime Nadeau

[Maxime Nadeau @m_nad0]

@codewhitesec The CTF was really awesome and as a bonus, the schwag is on point.

Thanks @codewhitesec !

Now to brush up my german before I can cook some maultaschen 😅

[Maxime Nadeau @m_nad0]

@kildonan5 @GoSecure_Inc @RCarnus (3/3)
also mentions that the Lockheed Martin Red Team did some research on this).
Details on the issue will probably come when the patching delay is over.

[Maxime Nadeau @m_nad0]

@kildonan5 @GoSecure_Inc @RCarnus (2/3)
revert back to the dangerous behavior. By adding the certificate pinning, somebody could enable it but disable the previous patch and still be somewhat protected.
The patch might also contain some other fixes and/or changes to the WSUS protocol (the acknowledgement page

[Maxime Nadeau @m_nad0]

@kildonan5 @GoSecure_Inc @RCarnus Microsoft published this article describing some of the changes: https://t.co/8fssCm1vjX

One of the changes is that you can now enforce certificate pinning to mitigate the cert store problem 👌

[Maxime Nadeau @m_nad0]

@kildonan5 @GoSecure_Inc @obilodeau Since the 30 days delay is not over yet, we cannot give that much more information. You will be able to see the details once the PoC is out.
Sorry.

[Maxime Nadeau @m_nad0]

@kildonan5 @GoSecure_Inc @obilodeau The information listed on Microsoft's CVE-2020-1013 is somewhat misleading (talks about group policies, Kerberos, LDAP, etc.) so it is hard to see what is going on there.
We did retest the PoC that supports TLS deployments, and it did not work anymore

[Maxime Nadeau @m_nad0]

@pdjstone @kildonan5 @GoSecure_Inc @CTXIS That being said though.
The 2016 post on "Hot Potato" does say `In the newest versions of Windows, it appears that Windows Update may no longer respect the proxy settings set in “Internet Options”`
Meaning that there might have been regression between then and this CVE

[Maxime Nadeau @m_nad0]

@pdjstone @kildonan5 @GoSecure_Inc @CTXIS As he said, It's indeed the exact same observation.
To be honest, I had not paid the paper the attention it deserved and completely missed this.
I should have. It's a worth-read for those who are interested by this. Also, it would have saved a lot of time and effort from our part

[Maxime Nadeau @m_nad0]

@kildonan5 @GoSecure_Inc I can't comment as to why they decided to acknowledge the vulnerability. Maybe they were unaware, maybe they have a new way of assessing risk, maybe it's just the way the info was presented this time around. All I know is: they fixed it and some companies will be safer for it