The FAQ section of CVE-2020-0601 includes the following:
How can I tell is someone is attempting to use a forged certificate to exploit this vulnerability?
NB: Once patched, events are generated after a reboot.
It appears you can also rely on Windows Defender to answer this question: exploit attempts are detected as Exploit:Win32/CVE-2020-0601.A and Exploit:Win32/CVE-2020-0601.B
- Is my system patched against CVE-2020-0601 exploits?
# Updated against CVE-2020-0601 exploits?
if ($updated =Get-Item C:\Windows\System32\crypt32.dll |
Select-String '\[CVE-2020-0601\]' -Encoding unicode) {
'Already Updated against CVE-2020-0601'
} else {
'Protection against CVE-2020-0601 missing'
}
If your system is patched, you get:
If it’s not, you get:
- Any exploit attempt detected?
There’s a provider named Microsoft-Windows-Audit-CVE that can generate 2 events:
# What kind of events we get from this provider (Get-WinEvent -ListProvider 'Microsoft-Windows-Audit-CVE').Events
Once patched, you could know if an attempt to exploit this CVE has been made
# Anything that would require investigation
$HT = @{
FilterHashTable = @{ProviderName ='Microsoft-Windows-Audit-CVE'}
ErrorAction = 'SilentlyContinue'
Verbose = [switch]::Present
}
if ($events = Get-WinEvent @HT) {
$events.Message
} else {
'No CVE exploit detected'
}
# Display more properties
if ($events) {
$events |
Select -Property * -Exclude MachineName,UserId
}
NB: The above query allows to find both events id 1 and 2 from the Application and System log.
There no known attempt to exploit it yet, according to this MSRC blog post.
This vulnerability is classed Important and we have not seen it used in active attacks.
Let’s say that there’s an exploit in the wild.
You can follow this guide to analyze the para field of Audit-CVE event ID 1 (mentioned in the FAQ of CVE-2020-0601):
Credit: Matt Graeber
Other links:
- https://twitter.com/mattifestation/status/1217490544773009409
- https://medium.com/zengo/win10-crypto-vulnerability-cheating-in-elliptic-curve-billiards-2-69b45f2dcab6
- https://blog.lessonslearned.org/chain-of-fools/
- https://research.kudelskisecurity.com/2020/01/15/cve-2020-0601-the-chainoffools-attack-explained-with-poc/
(40c is French, 409 is English US,…)
