Windows bug exploited by hackers tied to Russia

[Galdorf]

http://money.cnn.com/2016/11/01/tec...icrosoft/index.html?iid=ob_homepage_tech_pool

The bug is being used in the wild and confirmed by 4 security agencies yet Microsoft said there is no cause for concern because it is not being used LOL.

 

[kpk1]

Microsoft have an answer for everything....

Sent from my SM-G935F using Tapatalk

 

[phaZed]

CNN drops the ball, better check up on their lack of reporting/sensationalism/Russia war drum beating before sounding any alarms here.

The group, which was previously tied to Russia's best intelligence agency by other cybersecurity firms, were exploiting a bug recently discovered by Google, Microsoft said.

If you follow the 'said' link it goes here:
https://blogs.technet.microsoft.com/mmpc/2016/11/01/our-commitment-to-our-customers-security/

Of which does not mention Russia less a citation to https://www2.fireeye.com/apt28.html which again does not tie Russia to this and is largely irrelevant to today's discussion. Do a search in the PDF and see for yourself.

Microsoft said the bug was never effective in its Windows 10 Anniversary Update, which launched in August, due to security enhancements.

Google gave MS 7 days to patch Adobe (Not they they even could - not their source code), Adobe did it in 5.

It wasn't a MS bug, either.. it's ANOTHER Adobe Flash issue - and it's been patched/mitigated for some time... so same old story.. people using outdated and unpatched software and IE/Edge are vulnerable... gee, who wooda thunk it?

Also, when CNN writes:

Adobe addressed the bug with an update to its Adobe Flash Player on October 26, five days after it was first notified by Google. Microsoft, however, had yet to issue a fix, so Google(GOOG)went public with the bug on Monday.

So why the F*** does CNN think MS is responsible for Adobe software? Freaking retards. Also, why would MS issue a patch when the following is true (In the same freaking article BTW):

Microsoft said the bug was never effective in its Windows 10 Anniversary Update, which launched in August

That sounds more or less like a 'patch' in August, so wtf is CNN talking about?

This is a fluff piece based on nothing, written by someone that knows dick about squat. Sara Ashley O'Brien should stick with what she knows, which is Business startups and the money side of things.. leave the tech stuff to others.

 

[Galdorf]

CNN drops the ball, better check up on their lack of reporting/sensationalism/Russia war drum beating before sounding any alarms here.


If you follow the 'said' link it goes here:
https://blogs.technet.microsoft.com/mmpc/2016/11/01/our-commitment-to-our-customers-security/

Of which does not mention Russia less a citation to https://www2.fireeye.com/apt28.html which again does not tie Russia to this and is largely irrelevant to today's discussion. Do a search in the PDF and see for yourself.



Google gave MS 7 days to patch Adobe (Not they they even could - not their source code), Adobe did it in 5.

It wasn't a MS bug, either.. it's ANOTHER Adobe Flash issue - and it's been patched/mitigated for some time... so same old story.. people using outdated and unpatched software and IE/Edge are vulnerable... gee, who wooda thunk it?

Also, when CNN writes:


So why the F*** does CNN think MS is responsible for Adobe software? Freaking retards. Also, why would MS issue a patch when the following is true (In the same freaking article BTW):


That sounds more or less like a 'patch' in August, so wtf is CNN talking about?

This is a fluff piece based on nothing, written by someone that knows dick about squat. Sara Ashley O'Brien should stick with what she knows, which is Business startups and the money side of things.. leave the tech stuff to others.

More info on the bug from a more reliable source:
http://thehackernews.com/2016/11/windows-zeroday-exploit.html

 

[phaZed]

They keep calling it a "Windows Bug" - yet, it's a Adobe Flash bug in the beginning which allows machine code execution. Without flash, arbitrary remote code execution of the/any exploit is not possible. The 'bug' in Windows could be implemented in something like an executable, however, which is where Microsoft needs to patch (and the hubub with MS).

So to be clear:

The vulnerability affects Windows, Linux and Mac desktop versions of Flash 23.0.0.185 and earlier, as well as Flash Player for Google Chrome, and Microsoft Edge and Internet Explorer on Windows 10 and 8.1.

https://threatpost.com/adobe-patches-flash-zero-day-under-attack/121567/

Adobe said the flaw is a use-after-free vulnerability, and that users should update to version 23.0.0.205 on all platforms. Use-after-free vulnerabilities are memory corruption issues that expose systems to code execution.

So, no, it IS an "everyone bug" due to privileged code execution due to Adobe Flash. It looks like the exploit being run by Adobe is likely just another Atom Bomb(old hat stuff):

while on Linux and (possibly) OSX the code execution could be using the Dirty Cow exploit:

[/QUOTE]


So, I see where MS is coming from in the sense that you must have the Adobe Flash vulnerability to run the exploit - since that's been patched, the problem is largely mitigated and they can 'take their time' patching and testing said patch dealing with win32k.sys system call to NTSetWindowLongPtr() as detailed here:
http://thehackernews.com/2016/10/google-windows-zero-day.html

That being said, the actual STRONTIUM exploit dealing with win32k.sys IS being detected generally with Windows Defender(!) ATP already(and has been for some time) - it was the arbitrary code execution within Adobe Flash that allowed it to go unnoticed and fly under the radar since Flash, by it's nature, is trusted to call screen draw commands via Sys32 calls. So, it has been largely mitigated by MS unless another 3rd party (eg, Adobe) hack is found that can execute machine code AND be 'trusted' by Defender/AV.

Whew!

 

[Kirby]

Microsoft have an answer for everything....

Yeah, they do, and it's usually a stupid answer. Like when people were saying, "I don't like Windows Vista." The Microsoft answer for that was essentially, "Yes you do, it's better!"

 

[Galdorf]

The problem is users see the adobe flash update 3 out of 4 will close it and not update flash or java there lies the problem most systems i get have outdated flash i ask customer why don't you let it update they say they are not sure if it was safe and just hit the X and cancel them.

 

[Galdorf]

https://technet.microsoft.com/en-us/library/security/ms16-135.aspx

Not just flash...

 

[fencepost]

Part of the MS side of it may be on Windows 10, which I believe now bundles flash in some way similar to what Chrome was doing - but I haven't paid a lot of attention to it.