CurveBall – An Unimaginative Pun but a Devastating Bug

This McAfee technical write-up analyzes Microsoft CVE-2020-0601 (“Curveball”), an ECC certificate-validation flaw that allows attackers to forge trusted certificates by supplying malicious curve parameters and generator values; the authors detail how they produced a working proof-of-concept that signs binaries appearing to be validly signed, demonstrate the vulnerability on unpatched systems, and describe McAfee mitigations and industry coordination around patching.