Microsoft says you'll have to wait another week for critical Windows zero-day patch

[Batu69]

Says Russian-linked Fancy Bear hacking group is exploiting flaw in targeted attacks.

 

 

As I wrote earlier today, there's a kerfuffle between the rival security teams at Google and Microsoft.

Google went public with details of a zero-day (in other words, unpatched) flaw in the Windows kernel that is being exploited by hackers. Microsoft moaned that Google had only told it privately about the vulnerability a little over a week ago and that it wasn't reasonable to have expected it to take action yet.

 

In fact, in Microsoft's opinion, Google's public disclosure puts Windows users at "potential risk", as a patch is not yet available.

Now Microsoft has said that it will be releasing a patch for the flaw (on Tuesday 8 November, as part of its regular round of monthly security updates), and reassured users of the Microsoft Edge browser on Windows 10 Anniversary Update that they are not at risk from the versions of the attack currently being seen in the wild.

 

In a blog post, Microsoft has also shared more details of who it believes is exploiting the flaw - the notorious Fancy Bear hacking gang (who Microsoft chooses to call by another name, Strontium):

Recently, the activity group that Microsoft Threat Intelligence calls STRONTIUM conducted a low-volume spear-phishing campaign. Customers using Microsoft Edge on Windows 10 Anniversary Update are known to be protected from versions of this attack observed in the wild. This attack campaign, originally identified by Google’s Threat Analysis Group, used two zero-day vulnerabilities in Adobe Flash and the down-level Windows kernel to target a specific set of customers.

We have coordinated with Google and Adobe to investigate this malicious campaign and to create a patch for down-level versions of Windows. Along these lines, patches for all versions of Windows are now being tested by many industry participants, and we plan to release them publicly on the next Update Tuesday, Nov 8.

Microsoft didn't miss the chance to take an additional potshot at Google:

We believe responsible technology industry participation puts the customer first, and requires coordinated vulnerability disclosure. Google’s decision to disclose these vulnerabilities before patches are broadly available and tested is disappointing, and puts customers at increased risk.

Indeed, Microsoft says that it has attributed more zero-day exploits to Fancy Bear / Strontium than any other hacking group it has tracked this year.

The Russian-linked Fancy Bear group (also known as APT28, Sednit or Sofacy) has been linked to a series of high profile attacks, including the embarrassing leak of the email archive of John Podesta, Hillary Clinton's presidential campaign chief.

 

Make sure that your defences are in place - not just keeping your anti-virus and operating systems updated, alongside patching additional software such as Adobe Flash (or removing it entirely), but also taking care to not click on unsolicited links or launch potentially dangerous email attachments.

 

It only takes a moment's loss of focus and a misplaced click for an online criminal to compromise your computer.

While you're waiting for Microsoft to issue its patch, be sure to read their blog for further details.

 

Article source

[straycat19]

I am still waiting for Microsoft to patch an exploit that has existed since Windows 3.1 and still exists today, that I haven't even seen mentioned by anyone in all these years but still exists in the OS.  It is actively being used by the NSA and GCHQ.