Microsoft Patches Major Windows 10 Vulnerability After NSA Warning (cnbc.com) 42
Microsoft on Tuesday patched an extraordinarily serious security vulnerability in a core cryptographic component present in all versions of Windows. The vulnerability was spotted and reported by the NSA. CNBC reports: The flaw affected encryption of digital signatures used to authenticate content, including software or files. If exploited, the flaw could allow criminals to send malicious content with fake signatures that make it appear safe. The finding was reported earlier by The Washington Post. It is unclear how long the NSA knew about the flaw before reporting it to Microsoft. The cooperation, however, is a departure from past interactions between the NSA and major software developers such as Microsoft. In the past, the top security agency has kept some major vulnerabilities secret in order to use them as part of the U.S. tech arsenal.
In a statement, Microsoft declined to confirm or offer further details. "We follow the principles of coordinated vulnerability disclosure as the industry best practice to protect our customers from reported security vulnerabilities. To prevent unnecessary risk to customers, security researchers and vendors do not discuss the details of reported vulnerabilities before an update is available." Jeff Jones, a senior director at Microsoft said in a statement Tuesday: "Customers who have already applied the update, or have automatic updates enabled, are already protected. As always we encourage customers to install all security updates as soon as possible." Microsoft told CNBC that it had not seen any exploitation of the flaw "in the wild," which means outside a lab testing environment.
In a statement, Microsoft declined to confirm or offer further details. "We follow the principles of coordinated vulnerability disclosure as the industry best practice to protect our customers from reported security vulnerabilities. To prevent unnecessary risk to customers, security researchers and vendors do not discuss the details of reported vulnerabilities before an update is available." Jeff Jones, a senior director at Microsoft said in a statement Tuesday: "Customers who have already applied the update, or have automatic updates enabled, are already protected. As always we encourage customers to install all security updates as soon as possible." Microsoft told CNBC that it had not seen any exploitation of the flaw "in the wild," which means outside a lab testing environment.
LOL, Golly gee whiz! (Score:3)
The NSA prefers to keep these in their pocket, but they also prefer government offices that have Windows boxes not to get p0wned by other countries.
They must not feel that they can offer any mitigations at the network level. It is probably even worse than it sounds.
Re: LOL, Golly gee whiz! (Score:2)
Yours,
The NSA
Re: (Score:2)
"Change your freaking NSAKEY already. It's been discovered by China, and we've discovered that it's been discovered by China!"
Re: LOL, Golly gee whiz! (Score:1)
Re:LOL, Golly gee whiz! (Score:4, Interesting)
The NSA prefers to keep these in their pocket, but they also prefer government offices that have Windows boxes not to get p0wned by other countries.
They must not feel that they can offer any mitigations at the network level. It is probably even worse than it sounds.
How much do you want to bet that NSA was looking for new ways of putting Trojans and Worms in systems like, say, Iranian Windows servers (as we did with their nuclear program servers) when they found this? If that's the case, then it means that the vulnerability was so bad, NSA judged the threat to western computer systems so severe that it outweighed the benefits of attacking systems in hostile countries.
Re: (Score:2)
It doesn't matter what sort of conspiracy theory you come up with. They're all correct. I mean, what other business does the NSA help out?
Facebook.
Ok, but any others?
Re: (Score:2)
Re: (Score:2)
Well, if you're going in for detailed and specific speculation involving stuff that is secret and conspiritorial, you can't even count out the possibility that there was no bug, and that the update simply contains a bug necessary to hack the Iranians.
You can make up anything, it is all equally testable.
Treated like Idiots - what comes next (Score:3, Interesting)
Re: kicked to curb: whatever the market will bear (Score:2)
Return to paid windows versions with advertising?
Win10 seems to expose users to more reliability and dead machines than any version of windows, ever. I can't remember any version of windows that has a lower uptime and reliability index than Windows 10 -- with the main reason being that MS no longer allows users to control when to download and install updates and no longer documents what is in each update -- what it fixes or changes or what files are touched and no longer allows users to cherry pick updates
Re: (Score:1)
Re: (Score:2)
I was under the impression that Home users (not using a business edition with a 5-license minimum & required annual renewal), weren't able to control what downloads they received, nor when they installed, with reboots being forced on MS's schedule.
Can you also hold off on security updates to ensure they don't brick your system as well? Of note, microsoft has put non-security updates in things labeled as cumulative security updates in the past. Given their strong-arm behaviors since introducing Win10 a
Re: (Score:1)
On Pro, you can hold off on security patches for up to 30 days - which can be taken away on a whim, they can totally ignore any user setting. I have never been bricked by a security update but it is certainly possible. I thought it had because I did drop it to zero days for t
Re: (Score:2)
It sounds like you run Win 10 Pro? It used to be that Win 10 Pro was the same as the Business version, but I had the impression they moved Pro into the consumer category w/win10 and with their required time-expiring licensing of the business edition (as well as a 5 lic min).
FWIW, someone on one of the opensuse lists had their linux boot disabled as windows installed some new boot loader. They had to boot from an optical disc to reinstall the boot loader.
My Win7 installation has been 'limping' long before W
Maybe not useful to NSA anymore? (Score:4, Insightful)
If NSA has newer, better exploit, or simply an ability to force Microsoft to sign their payloads with a key trusted by Windows, it makes sense they would prefer the vulnerability patched to prevent malicious actors from hacking the assets they already have other ways to access.
Re: (Score:2)
Re: (Score:3)
Re: (Score:2)
If NSA has newer, better exploit, or simply an ability to force Microsoft to sign their payloads with a key trusted by Windows, it makes sense they would prefer the vulnerability patched to prevent malicious actors from hacking the assets they already have other ways to access.
NSA is themselves a heavy Windows 10 user.
Re: (Score:1)
Will Wonders Never Cease (Score:3)
Holy Carp, the NSA actually did something useful for once. Must have been by accident.
Re:Will Wonders Never Cease (Score:5, Insightful)
Holy Carp, the NSA actually did something useful for once. Must have been by accident.
Their mandate is to BOTH:
- crack foreign communications for US spying.
- protect US communications - including the civilian sector - from foreign other bad-actor (e.g. crooks) spying.
Unfortunately, they seem to give the first precedence - to the point of working to weaken civilian encryption, to make it easier for THEM to crack when it carries anything of interest to the spook community.
Re: (Score:2)
Re: (Score:2)
They probably found out that someone else discovered the exploit that they've been using for months or years
Re: (Score:2)
That'd be my guess. They've discovered one of the other state level actors has been using it, and have decided its time to close the hole.
Fix for Windows 7? (Score:3)
Is there a fix available for Windows 7, or is it a day late, and a dollar short?
Re: (Score:2)
If Microsoft issued this patch today then they must have been preparing it for a few days. So they would have known about it before support for Win 7 expired - but they don't want to push out a patch - that would just reduce the number who think that they really do need to move on from MS Win 7.
Re: (Score:2)
Is there a fix available for Windows 7, or is it a day late, and a dollar short?
Is Windows 7 vulnerable?
Re: (Score:3)
The story says:
Microsoft on Tuesday patched an extraordinarily serious security vulnerability in a core cryptographic component present in all versions of Windows.
Re: (Score:2)
Microsoft doesn't list anything before Windows 10 / Server 2016 on their security bulletin: https://portal.msrc.microsoft.... [microsoft.com]
However, it is unclear to me if that is due to Windows 7 dropping out of support.
The headlines make it seem like this vulnerability only affects Windows 10... but earlier notices mentioned all versions of Windows.... so I am confused too.
Re:Fix for Windows 7? (Score:4, Insightful)
https://msrc-blog.microsoft.co... [microsoft.com]
Re: (Score:3)
https://microsoft.com/en-US/se... [microsoft.com]
Re: (Score:3)
This is the "new backdoor" that was created when the "old backdoor" was closed. This is how government spy agency backdoors in software work. When control is lost of the "old backdoor" a "new backdoor" is put in place until they lose control of that one too. Then the "new backdoor" will be closed with the claim that it is a whoopsie and an even newer backdoor deliberately written into the code.
This process can be carried on forever. The interesting fact is that the time between the government having Mic
Re: (Score:2)
No patch for Windows 8 either.
Your link didn't work for me, this one does: https://portal.msrc.microsoft.... [microsoft.com]
Most likely (Score:3)
The real question is how long did they know about it? Answer is "Until someone else figured it out and started using it."
Read: NSA ask Microsoft for "FIX". yeah right! (Score:2)
Careful (Score:2)
Deja Vue (Score:2)
And so here we have yet again (this is the sixth or seventh time, at least) that Microsoft has closed a backdoor into the Windows Operating System that they initially created at the behest of the US three-letter-agencies, because the "behester" lost control of access to the backdoor. Expect the release in a couple of weeks or months of the "behesters" toolset for exploiting their behested backdoor.
This should serve as a warning about government mandated backdoors (whether paid, extorted, or arranged with a
If one were to put on a tinfoil hat and be cynical (Score:2)
NSA Marketing dept.: Hey guys, our brand is not doing too well recently, could you guys throw us a bone?
NSA Skynet dept: Well, yeah - we don't usually do this, but we currently have so many exploits going we don't even bother using them all - we'll send you one of the less useful ones.
... departure ? no, just pragmatism (Score:2)