If it’s a zero day then Microsoft didn’t know about it. If Microsoft knew about the exploit for a year it was not a zero day.
Threat actors exploited Windows 0-day for more than a year before Microsoft fixed it
Submitted 4 months ago by jeffw@lemmy.world to technology@lemmy.world
Comments
BigDanishGuy@sh.itjust.works 4 months ago
echodot@feddit.uk 4 months ago
Zero Day just means that you have zero days to fix it before it becomes a problem. Doesn’t mean that you actually take zero days to fix it.
BigDanishGuy@sh.itjust.works 4 months ago
What? No it doesn’t, it means that the exploit has been known for zero days, aka it’s an unknown exploit.
reddig33@lemmy.world 4 months ago
Well by all means then, let’s run our governments and banks on Windows!
Wooki@lemmy.world 4 months ago
Microsoft has proven time ABs time again security is not a priority. Cloud profit mattered more than the security of the public as sunburst proved.
This should not come as a surprise.
Treczoks@lemmy.world 4 months ago
The three letter agencies probably knew about this, too, but either didn’t tell Microsoft, or forbid them to fix it.
autotldr@lemmings.world [bot] 4 months ago
This is the best summary I could come up with:
Threat actors carried out zero-day attacks that targeted Windows users with malware for more than a year before Microsoft fixed the vulnerability that made them possible, researchers said Tuesday.
The vulnerability, present in both Windows 10 and 11, causes devices to open Internet Explorer, a legacy browser that Microsoft decommissioned in 2022 after its aging code base made it increasingly susceptible to exploits.
The company fixed the vulnerability, tracked as CVE-2024-CVE-38112, on Tuesday as part of its monthly patch release program.
The link, however, incorporated two attributes—mhtml: and !x-usc:—an “old trick” threat actors have been using for years to cause Windows to open applications such as MS Word.
“From there (the website being opened with IE), the attacker could do many bad things because IE is insecure and outdated,” Haifei Li, the Check Point researcher who discovered the vulnerability, wrote.
“The second technique is an IE trick to make the victim believe they are opening a PDF file, while in fact, they are downloading and executing a dangerous .hta application.
The original article contains 616 words, the summary contains 170 words. Saved 72%. I’m a bot and I’m open source!
EpicFailGuy@lemmy.world 4 months ago
Yall remember eternal blue? no? only me?
Yeah … im never putting any of Micro$oft products on anything I need to be secure … ever
lud@lemm.ee 4 months ago
Remember regreSSHion?
All software has serious security vulnerabilities.
EpicFailGuy@lemmy.world 4 months ago
RegreSSHion is overblown … it was quickly patched and it was not reliably reproducible every time. It depended on “Luck” to have pointer fall on the right memory space in order to allow the code execution.
I think Terrapin was much much worse … and log4j … log4j was a DISASTER … but point taken.
I wasn’t shrilling my choice of OS tho, I think eternal blue is a lot worse than those other CVEs because the NSA KNEW about it and did not disclose it, and because Windows has a much wider user base of clueless users that easily fooled.
conciselyverbose@sh.itjust.works 4 months ago
The fact that Windows hasn’t solved the “fake extension” scam is wild. You can’t make people not click stuff, obviously. But you absolutely could identify double extensions clearly intended to confuse people and give some kind of “this isn’t a PDF” warning.
01189998819991197253@infosec.pub 4 months ago
They’re to busy finding new ways to inject telemetry and ads into your os, and degrade your experience. It takes a lot of resources to do this.
mememuseum@lemmy.world 4 months ago
It’s so dumb that Windows hides file extensions by default. They could just flip a toggle.
Plopp@lemmy.world 4 months ago
But don’t you understand how confusing and scary those cryptic three letter strings are to normal people?? 😱
sturmblast@lemmy.world 4 months ago
When MS chose to hide file extensions by default I fucking lost my mind because of the malware\virus implications… idiots.
LodeMike@lemmy.today 4 months ago
They’re incompetent
lazynooblet@lazysoci.al 4 months ago
I don’t think it would help. Even without the extension it would still say:
not-malicious.pdf (Application)
We are trained to see file extensions and understand them, but the masses aren’t. There is a column that translates the hidden extension into its corresponding type already.
conciselyverbose@sh.itjust.works 4 months ago
I’m suggesting an actual popup on double extensioned files that forces you to acknowledge that you know it’s lying about the file type.
The only legitimate use for multiple extensions is compression, pretty much, and it’s easy enough to distinguish those.
MonkderDritte@feddit.de 4 months ago
My computer-iliterate dad is on Debian XFCE since 2 years now. The first year, he thought it was the new Windows. File extensions didn’t bother him in the slightest.
DaneGerous@lemmy.world 4 months ago
Wouldn’t it show not-malicious.pdf.exe?