[New critical Windows vulnerability] Great example of the dangers of not knowing crypto!

Recently, a new highly critical Windows vulnerability was discovered which affects the Active Directory domain controller (essentially the main "gatekeeper" to access a Windows network). The fun part about this vulnerability is that it is solely due to the bad/wrong usage of cryptography. In fact, it goes straight to what we have talked about in lectures 3 and 4:

• Using encryption instead of MACs in order to achieve integrity/authentication.
• Misusing the requirements of the chosen encryption primitives (using all-zero IVs when a new random IV is required for each encryption).
• Exploitation of the malleability of an encryption scheme not designed for integrity.

In particular, the exploit targets a mode-of-operation which we did not cover in class called Cipher feecback (CFB) mode. However, it shares many of the same dangers as found in, e.g., CBC and CTR. There is a great write-up of the vulnerability and exploit by the researcher who found it (Tom Tervoort) in this whitepaper, and which i highly recommend you to read. The paper is only 7 pages long and easy to understand for anyone who has followed the first 4 lectures of TEK4500.