安全研究
CVE-2020-0601 CurveBall：Windows CryptoAPI 的 ECC 椭圆曲线欺骗
Thinking
2020-01-14
2 分钟阅读
研究档案
#漏洞分析#代码审计#供应链攻击
CurveBall 让攻击者用伪造的椭圆曲线证书直接绕过 Windows 的整个信任链——只要你能算出一对「同形但不同」的椭圆曲线密钥对，你签出的证书 Windows 就认。
Unlock to view this content.
ad8d9422966c73fee42096dad808c6448a272095349f41facc28f3d18d1ee66a0726fb5aaffd9271b6702e0ae53f6961031443030e63d37842b7356b4a67d1f44b648f709f84d99b1640e6f7a87a3d44129b61502fc0c5c728a88c67798e6cfb7bcb30fe880464fad1a2cf9635735fbd6e964b402ea4ed27e494f7c87c72f1c586b333a47062292625ea7240d146fb061f3975a6253d117e97272d7df5aa897fb9fe2c09034f658aae2645a68076992d7d9de07ae63e2fac88f85e475412988dfbc9277685c98a2b78cabe692479ceb11a0a20876d05908c70d57a70a152c6f1ee40838cf65cf46a4165da5ef79e958b32ad1082852be303c1f9200fc317e2fb8918ee63617c38e5ed684f2c6020ef3161f6dc80ee89d9a201af2ca4ef69f4477e365aa037d5b25dfd2f9285bb9ac5f3965295a7e653a68d8f9b42bdad14672bf8b2095463e4cf1bdd77242a827eb064503d0468b34b412a14d1be163d9241c5a6d11fedd9ff9444d95c1bed650a79df8d9986c75035150075863a1d43feae6c4339dcf5c740be3a57964a9db717128c2140518341be588796de5019e646cdff096f2ac6c0131dccb9a543ab6ae823d022783983ae03a82edb3c34422baab6f8ea8eaaf3a7060f18139691b90641b9b19d00c0f262622ab1c738a535e8c6f76c556b79ffa13116d9d0975ac12b0ea4a9c86501013181d86b80f4b33b34fff645d4345904eecad62c5b00fff1b7df7c047e362c20dd8fa30e5ca4fe0c467ab39fd5acd9b5651ba9ad5fc636815c3a8b9c1806c4653ad14c6a64d1b7474dee94bf34571748e799c5d0e396aa198a7f98452a4dd81ef1e0781f3eb1ec8bb6a289697e60d27345c6c2ba2bd990165d3fa92f17643e7595811f776309c7d5dbca8b535d2aa44de324d0bc41cd9d07904427d0225424be03e4eaf9743a2701cf29653ee987a869b6a90080cfb911f382ddb81f45bb957e27347a0b3d4707289370321eaf0a6991f33bb2dd66b7707b7046827f682acb3ffd09ebb1e8ba08ef9fe58503ebba4a6446478464390417c26a2456daa05b8ad12ffb231dfe72ebf9853947324133842f646c5975a0d2faeb182af6f4c4e8682e2a0947c3e2761308f2463581d1276813f629a2a0e09012d025c35f1b7935b86674987210b3714b9026ed54888499935342394668ad58f79dcb63979ec647fa941a7c1d6cdb590c2f38ff819b4f46784a0a87054b71712f025cbbc0a4cc052554498febe66b574e934f698ff3443c1ce72b3c1890c807f3d8448523fb07e2973592efe090c4fc689ce6582a13f6f30770989749484d9ddcdb46bbede86b262e00bdfeec04e91dbe564e2a3bbf2feb3a7f02c07b458b1a0fd5d3141106a4e0f34914fef7bcae4860fd32438e66de849da2da0ed0110fca8e3262194f4100c0f91a253879d36f7b1fafe25e3c7e85cabaca4824d093fa0c18166bf5c0e2dcdec9925edb1879a5af465800e928d61edcfe2882af469351196c6c1ad7d6ab2a746ee70f67afd1ff7e7f5a67e34ed54462741d0e6d7d8aba1355d82db8613a325e0996f1fd02025bc2429d5111d060f53fc0d38acdad70695b8a369afbfb3b691a38b2ba995d2318ab633caa05c151ca6353a7162b0436b68d1529fa8c25a98dc0b58bfc931720b0c07eee770210ed03a5b3467b237e3067de89da2531d91218e9e26847a4effc4fea6efa3e2ae7e70a2dd8283628856b1a30bb503893826922aa2a770d780ff7d1205e927d8d1d70e7d12442a7fc9c0fe861795f29c61f5970c223013d3fc8ca68f385c760506d6645148d01dbc117248534e88a583275e649405aa94266b45337079b6af7f5578f79b16b6a422a4fd115442084da5005983d3948377da53d84841b1ff62ff01ffeda9f1001851c48a0a7731d993e8777a9e076f0da7ac23396f24da89e46725461162f78ac212821d90de3279495ab347223bff489b41c2740736bff524e77fd977bd3a5154fe7d2fdb6fa948099d2d417ccd4f96d15e0ec2edcfd3c1131c07edfb25446ad5bc9003aba54f2fe2fd82b1740598ab6ce57b263584519671b6ecdb5066b67bf4d20143a3f7e3e43c3fda2a1f20ed657bf5dfb16e2e16f510453ad21c29c890f888f2325cc99d5843244ed7f9d80df9df4be4641da228bc02c42a3838769bb09552a62d997ce32906ef07688b0839e2276f0dd9ebe009b9051509e29255a7d6311b879b17ee9d2764a8d8c194f518834d4b0c829231e2b6d94c7c390c0b61b2b5e8b8a067f47335d7998d210023959ab8bd22d972b6705138f0976b3cb5a3bed1e6a22178c644d575297ecb76485e4d50af38a4972bbffffc397dd6a86e4f50ec157cc4c369443b08cf90152cf5ee9e226334350489163414760de0f998c2d83cacf08d3aebc52b308e6f1c28f94b03d21432c66665e8079980337763e0f8359f83c4c705a9b73dafc943e156682895e04083220db41e96247eee42b7cefd486ae50032e438051a9892f707e383a6494bd6861feef28f4b13b85642e503a02c504fbf520e65fd07dbcbdb82ee33b87e77005307f06d0906c3accafb362c48fa25f75bdb2c1ee6956b562b062224d9c57f1edec61d0348c89e4fc684868be951a5958240284fd9dad9066898260c93c98c5ca4bc034e9710f138f77e28d306f67b0e583f303b7d78ad5f0689d37e9ac8271f1d9dad175bb68e581c17317388d21e68bc303c7efedbe3d7c99bb5aaacb4be7e69a447a28213bf3c049ce44db28e07c6807f267df2ce19b9dcd35bc720915b61123d2fd19302ca4fc7813f44e2f034cb583951bc41a80ab59849a8ac6dcef3336610ca76158a8fa3e11a47a49d0840c0f8f63cebc4c334bbcc157191f00116dc87da5c5cbe1dd9b7b05eb7df456ee7f86c46ddd426cd80d37344c04f1a47b285b578ff04b7d7130d0e7cbdce16f0e80cbf960427c3619c7811af61a6df3758f139910a6d3c7db92419ab97778de46179da905114ea3704306d825009be39dfd53a9c107b153dd5845d5d8993d743d64560cd8c91e80aedd66cca712cdf281e9240f84f5e04296bf39e06949831f9e5cf0569b0f44943186bb0499c38c6294590161b03541e8d904fdaf673835e50da08225e952e7d18e3ec7890c73a8797c36c6a0b647a99178eace5557c573f42292a963755fcbef8c3a3a5db143f0bb34008e960b16275b3c77e8ecce38f5829c99200d50be219357b54265a1bb8dbb0e51bef6358f506d12082c1208c5eadca9d1a665fa5de708ca37db60ad1be55cfb872abf3c712fe488f199852bc0b4d358712187f80710dc15fb7a2b13dd2fa1208d719fa77114acc6c122f375f103bfcacc1bd1d79890a60e1250fefd1e1606b6be608162f2fffec06038e20af561d8cadc5c16978110294f6e5a83a6ca2a09a33bf2aaf85f3d141bc19385ba1920bfc644c39afe01e093c9bade3214d4cf40ef18b064293102ea28ad7645235d82942a239e2553692d9f444cd08607ef5ab80fa125145fabc70185dcfc780ff30edeecaec7bbe7e0911add6d4ffcb3157ea325dea68f3398c0fec1b09067546d46a0d7c77137ddf83f54364f4701c5de93dab6f8a6bf28080f1e07239e28703e51b904a9e7b026e18aefbeb3195171694485707380f3a7096b081ef42fab852443d3fd124925aff932e122192a4eb11895b605d6299db176e72333c22776fcc9f1e1286c378a72d0dbd3078c1eb3888179775f14e017107da675075bb8c2b54aa2e0e9843837c7f9fe244e574786939ad07b3e4ccc087e470f3552e565946144289444cb57f200882f1759156eb56f75c8282dff955272356e5d7d1ad5a406d9b13987427633d8a4c128c8410ab8302f51eeb6d81a2f0631e9867d26b7c88cc53b3974b56913dbc4dec21e7e26f60a15fcd5ceb76dd2db85f8d157fb650759446471bb640797333357ddbfd476277f4d50bb3224595b659d0e77ddf7983780f84308ea3fcd6654efb5bd25a417e9bda0b09e549988e8e4ec4e8de3d1c81907bd834a4ed6bdd087099b594bed5c0e3da36baf45e503208b4c4f9b9289e8bcf0ca11871ec928b4f28a2dc05c7058084d5ee1a069a632d275bfdde51774a3dd310b706564f2e955e1b36590ebc769f29cfd93b80b891997db008f5454bb5683352bdb8f24873dde203a27b33ae7cb879a292591f5aa097e2c8f52014e4066ab9e5e44de7d1d2fdf22cb447e5518f571f9cbd9764e8c4b65f12f2961ba930777074cb630692a10496081dc827bbc308c80454f913768be75dedc0b93f564d4e4fd0a706a71b3da4ddc45742b489264e442e3351ab84781af8f9d294ec1c4cac273121ad5181d14bf960df25c6ec8185ad733dc6504ffe591cfd58babbe910aa5948e75f72ca191b13e3f52c293c351fc8b624710ec29f3be45bb2b778000bda9e0bb5ca1923785644d678e36903432a3482ff1129df5cfe7fb2637547f62af897dc3344f3106432cbf8386b172c18f8c594d628d2444a6fc1524afb2499b6e80cc559a53ad1e55e379716f007c0f6f8d0f94a6797384229b1a305268ee28cfd43039217ee0e3e9ec52ba8d0fc86f3d9a56f021dcca82d0d4b26e4c16aea3205b3a6884a74a362ece196216355fd10969e1bb7e81d8e89e470fd6179cc7cf55ef1f782b4b74e2ff38559b5766f947bcd2c5b7570f3d1a4725b63334e7cb61f2db7df705b42aa1bbbfdc7e9b3d1e14742c6b1067a317c4f6bed373e7b9cf6b32027028511aea06a65d6693347c97e1d1eaa4e2c37f1cc03a2a2f24256623f074991b6e0dbe18928e4823c1b38e002944d9c4c49d76b9cb4b83090263f6a152521561b4775b2aafa48422afaa9db78c4b890023af106234a2045afcccbae17b24196e6685a0eb07054aec4e1329dfbe3848b9ae8167d8e3aa08f3b47cfada64aab8d96a86c09fc1416cd8650fb5f390c7110c49dd2d617f6ce7d74c64e5e115159849bee4a90508ef2241f73423d67a829e2dd792d4bab5e9b590b4ae3b2f1aff8e855a2bc51513330f389cf2b22ec46198608cbab6cef916b88148be22d50fd4d5bf365e79dc8c5a59f75dd9e3699b6c221c4a20ba3649aa96da3284c75c390e5d0e00b286feac687f14293eb3cc42434382b6d6aecf59976f51dbcad65e46116831a2c027804d375b44fa50c7688b479e11a73dc99414ae356feee6d1268b57089803d24bf3e46da8740cd35f499433ced08522f443521ecf6b0cb8fd08693dcf932f92a3eb54f475640a31d319cd6a3d153695ad347e187e122aaced17c561f5128519e6923fb059f77cd8bd8e47c866b56ad8f3cc61bd747272aaa026558aa022f6b24048c43191fec535268f9c6d6579e3e001a3c310460bd0958ee7f8a7fbdb5e5b56727bd23f7bced425aba6efae2a5f11dbb0fc6ab9af15e43b4eb2441a3eb1bb5805a8c1b97f15584b98f4d5b9068efedd354090628b740b6e68d79f058e7d15d522858a050d9047fa90bec6419e73b338386c3f7eea13352c1546fbba0a28ab1c640e486c1c5b2533327788389a1ad6c387437fe7c9fbf4b05bba4d0bb55435441708262da99365b6fb037d95d99dc3d800032851e84aefcca87942e0238b12f5bd9a79e77708476f66adab2d067798b3d97a63cacf5b5e96ec89474e83e4a0754a3cf0b790d097b0ccbcbf860e6b0e6d4573e722f301648f827d600b3a67675d20d0761c5a4aabf34208dc47c48d43e99c210ae1467c64a7ddd275b191fea3d0d5d036e63b2ab01b0ca962825754c15949be50fc9e2af55dc697dab74a1a6be696f2c6431f3dba880338da643f1146bdfa2ccceacf00926edee22f0c03e577290a99d70a26b775bc8c310760294bfb1dd79e1c694d4bccd46095e92ff112a72ffba98c9e231bbdb51daec14e5cb4a1f93e2e2761bbd3309c248236e60fef2097fe0653033f4b450708f973da71d3a41d27b9c8e2b4c7638425bc28224b06640d2de57cb704b8d724cf85ab2b221ff924a493c4bcdca87b3eda3e1783ddbb378f953cc6c69581709f713d16131cb6490732a5a48c85ccbb7221736bf46ff201cf8d5b7fac54c14cba5347d0ef13c1d3edff838b4fcd0458de72122a3128211a5f00e962e11d86528730ea32394de55b342506e690b6836072ad1c1cab0905dbebf10b1abe7dc030417a3857ce1933915e9bc25c0ac5b70f6d4014e37fd9f1df006d11e461d37db2ad52541c40accf747242509bb4f5a9aa361fc935480af5c017eb021eea43a115b8913330ee5ff7a4e8f9ad0239891bdec52ddd7cb72a016e8148632b3d1d670813a13785397b72365090698bfade90dcbd2ada94de861a956688f044311764697fabcccc6442e961815f62030cc3dd0dd6d744b36d46bdee04597a491c933aadb63fbbd128dfec8c5fbd5981a878761ca245660dda2d9e0259643aa99b5b00ba4c5497c9fac10125bb6202e256b19b4956b8051f7e39098deec54be5ee4d6a12d8c98ae839a2730948038a93f6331b790f3bac42c92279c1ea024ec86d7174309676a7b733a825a28147a98f5b41da5e46f9b2fb88a6717849d516e26783f551b24cd08e1b1e6cf5778814b84d4215b69b6822d0548108aff0a9f619e3fabad5613b3c619597bb06826ea5c6bd0e3c4855c638a13d8c8604cdaaa48216c79b03905234ef5849050ba04d27b06bca93540cd09423b6ed352a85ada8b383eb50b498044fcf23351a058aedeae29826c9c75f1532ad0d17d7ccf251a195039e740295b1d6f8c1a7307e27c7dfa2b3625c78c1f7b7a5fce8ae3a6563f60fdbf3bfc269ba77033d248e5537aad82915cfa86bfa7c9967a58f89437179451be23941cd24693e09aaa551cef44c51d51aa68b952d80cf196613f958745da84f3e0672ec1cdbe227a71d4e35da0e195955f90541bc9bbf44f212aaff15aead0b18de7ac47e6599f314285fb1f12983805b10166f4802f0fc679c09085ff3286c8d3a07865d7ae233ed97e40092d19b27f3b8f524cc9b6b22fbfacbf268b00982f41dab04250dcf3d5683f500486bf80c0f55def8b33863557d88063dd6c55a4ae55eeb28928f3e6f5dce4bda39c170313b932a28a9aebaf1cd5429785b09aff2daf4f05194e33adac41c3965ccffe671ac36e66a0d3c8ee7198158051685de169e029fc574b786c902a3457f723f3f44eeb095f26c1024aabd9221ae7ff977ae0d78914e37d398ead317404b741379c5d928bdd49312a02783f786c625717db24229e00e51bad7e6f2fee388ea9df4f497c25679f604e40ba172fcd91859759c29625931066e2ed4a5ca62aaa9287e615108f7f429906878d91ca8350fc3be18cdc67fdd7013c3d83d8216d612569d1421765cbab6cbc5f833f1f267ce09f55ddd2f5cdb45586c225f91c59ce5cfb714fb15190d7f4511ba4784e252fd1fa2dad6ed6a2021b35fcd5a7b13c724fc43edf8529a762539f1052ff1c801de9c26d15c1bbd41de902ef7b20a6846a6f9bf2ee60bc9ae541fa1b947d932af7c0fd07fec5be28852b43b4eff80b3b7711a356eb71d86865cc434f2881c3656c1270c482ac9f1662e6c4b1b38f3c38f09c2c9623a50a3b5226e4cae186993520bae5606d033c160633468e4f217fb9b42143917a8132ffec2107b5aa76b97463e3368183e464f8230ef5c62b0e9b4626f3654037a55b72ebc59d0f881373308e83470c97a69b387550ee413e08666a2e02390aaa9498f53e6e3421b9dc120ec7ce22e457a368a067804e19a6eb23be8ced98201220af1b6e7a6b859970aa6fca9856c8a2a4a0cb196b61b3b1b4c18dc231c7784dcce5bc4c0af7db78337c97778b223f8caf0f8b9edda1a4c39e3ecd38b4a9e807a24efa80202ad95cdde65bae4581e50b159a3143e00cf630d957abc11084b7f3d6795cf257493630631dc3e35c3939cb5b36e1cb65967b418bf56ee7a28ccebaf7f56439eb9fe73f68a0ce03812744fddf224f7de8608d5d77f32c86747539d5217acab28e6b5d7abc363acb1de85ba0d770c2d5d10b127905747ce534b18f457e8ca0bf3505b0f1164cb12abe59b1e444663340bdb399a792a122b8bdf90bd90384e5efa82f5cfc56430a654551503919bd633d288cb98364d29141bac4a4accddcbe303f333b675262ea5a7e43fb7842ed85eaf3bb455b7e1470e41fe36ccc7cfe51bc0192bffc9ff624547df25ab16a314047beb1fa85253c781c4b43d80268a5c8f7b9b347d311c66381ea1d9e72f752fb44c403b3ee9a6cfb0694368ad065ebbc80cce4f4868255802440ce073cec1eb5b36040ef5e6b4e70d91342b6e361162e83faa9dbb26aec764c9794d89f93bc6fc757a178235f05a364905bc5dfba6be98f768820a6ef73bb4d91d8a80599e9e3551a368f87273fa525b30045122a9ea112c18d19adbff2cbd7dadc6757e4587ed92a4d22bf564279f7f6701409143861d2e237cee7f6639d0680a9ae6a84968279a8e0191fa0f143fea6f0ae4d35165b837b43b8bce78a42692faaa220571b63e8ccad7d78f21ef0e5cee830da77e135e3fad32ccf08ee0df5fd84c0754fb7584cb6049c10182877361e681059a0295d24fdfbfe95062bf945135763cf832e78ae1315381e00827c12b890a0f32383ad53f6d629f6cfb146ce7753b78a15d5b7717b8022d