Mihai mieitza

CVE-2020-0601 AKA ChainOfFools OR CurveBall

Microsoft disclosed a vulnerability in their monthly Patch Tuesday referenced under CVE-2020-0601.
The vulnerability was discovered by the U.S. National Security Agency, anounced today (2020-01-14) in their press conference, followed by a blog post and an official security advisory.
The flaw is located in the "CRYPT32.DLL" file under the C:\Windows\System32\ directory.

NSA description:
NSA has discovered a critical vulnerability (CVE-2020-0601) affecting Microsoft Windows® cryptographic functionality.

	package main

	/*
	$ gcloud compute instances create vm1 --shielded-secure-boot --scopes=cloud-platform --zone=us-central1-a --shielded-vtpm --shielded-integrity-monitoring
	NAME ZONE MACHINE_TYPE PREEMPTIBLE INTERNAL_IP EXTERNAL_IP STATUS
	vm1 us-central1-a n1-standard-1 10.128.0.104 35.224.160.133 RUNNING



	$ gcloud compute instances describe vm1 --format="value(id)"

	#!/usr/bin/env bash

	# set vars
	export PROJECT_ID=$(gcloud config get-value project)
	export PROJECT_USER=$(gcloud config get-value core/account) # set current user
	export PROJECT_NUMBER=$(gcloud projects describe $PROJECT_ID --format="value(projectNumber)")
	export IDNS=${PROJECT_ID}.svc.id.goog # workflow identity domain

	export REGION="us-central1"
	export ZONE="us-central1-a"