---
id: 1889
title: "Exploiting the Windows CryptoAPI Vulnerability"
source_domain: blog.trailofbits.com
source_url: "https://blog.trailofbits.com/2020/01/16/exploiting-the-windows-cryptoapi-vulnerability/"
published_at: "2020-01-16T16:28:34Z"
tags: ["windows", "cryptography", "trail-of-bits", "code-signing", "cryptoapi", "spoofing", "ecc", "certificate-validation", "cve-2020-0601", "certificate-forgery"]
phying_url: "https://phying.com/item/1889"
lang: en
---

# Exploiting the Windows CryptoAPI Vulnerability

## Summary

Trail of Bits dissects the NSA-discovered Windows CryptoAPI flaw in Crypt32.dll, where improper ECC curve parameter validation lets attackers forge HTTPS and code-signing certificates.

## Intelligence Metadata

- **Sources:** blog.trailofbits.com
- **Published:** 2020-01-16T16:28:34Z
- **Original:** https://blog.trailofbits.com/2020/01/16/exploiting-the-windows-cryptoapi-vulnerability/
- **Phying News:** https://phying.com/item/1889