13 ms·

Microsoft Says Russian Hackers Exploited Flaw in Windows

dovdov 10y ago
How naive one government agency has to be to think backdoors are for them only. How pissed was the FBI when the learned that now the Russians also have access to the voting machines. They're using next decade technology with a 60 year old mindset.
aluhut 10y ago
First link that came up at google WITHOUT A PAYWALL: http://betanews.com/2016/11/02/russian-hackers-exploit-windows-security-flaw/ http://betanews.com/2016/11/02/russian-hackers-exploit-windo... And the Microsoft blog post: https://blogs.technet.microsoft.com/mmpc/2016/11/01/our-commitment-to-our-customers-security/ https://blogs.technet.microsoft.com/mmpc/2016/11/01/our-comm...
- acqq 10y ago
  And Microsoft's post doesn't seem to mention "Russian" anything. Compare that with the coverage in the style of "Microsoft CONFIRMED Russians help HIM" Edit: The titles of the articles and the coverage make a logical jump that the authors of the texts took care to avoid. The jump is only to be explained by the need of the influence of the perception of the readers shortly before the elections.
  - r721 10y ago
    They state that STRONTIUM is likely APT28/Sofacy in linked PDF: "STRONTIUM has been active since at least 2007. Whereas most modern untargeted malware is ultimately profit-oriented, STRONTIUM mainly seeks sensitive information. Its primary institutional targets have included government bodies, diplomatic institutions, and military forces and installations in NATO member states and certain Eastern European countries. Additional targets have included journalists, political advisors, and organizations associated with political activism in central Asia. STRONTIUM is Microsoft’s code name for this group, following its internal practice of assigning chemical element names to activity groups; other researchers have used code names such as APT28, Sednit, Sofacy, and Fancy Bear as labels for a group or groups that have displayed activity similar to the activity observed from STRONTIUM. The group’s persistent use of spear phishing tactics and access to previously undiscovered zero-day exploits have made it a highly resilient threat." http://download.microsoft.com/download/4/4/C/44CDEF0E-7924-4787-A56A-16261691ACE3/Microsoft_Security_Intelligence_Report_Volume_19_A_Profile_Of_A_Persistent_Adversary_English.pdf http://download.microsoft.com/download/4/4/C/44CDEF0E-7924-4...
- aembleton 10y ago
  Alternatively, get this addon: https://addons.mozilla.org/en-GB/firefox/addon/refcontrol/ https://addons.mozilla.org/en-GB/firefox/addon/refcontrol/ or an equivalent for Chrome. Then add www.ft.com and www.wsj.com sites with the Action of https://www.google.com https://www.google.com
  - aluhut 10y ago
    Thank you but I just don't click them at all any more.
  - blahi 10y ago
    Hey, come work for me. I have an addon on Outlook that blocks emails where employees demand their salary.
    - dvtv75 10y ago
      ...I think my boss uses that.
  - kzisme 10y ago
    This is nice - but...I'd rather not read/support paywalls by reading their content.
Jedd 10y ago
> Microsoft Says Russian Hackers Exploited Flaw In Windows > (And Blames Google) Jedd Says Microsoft Should Have Fixed The Exploit Yes, it sounds like a short notice period (5 days or so?). But ... from the chronology it's sounding like this particular exploit was performed long before Google revealed the vulnerability, and indeed a goodly time before Google reported that vulnerability on the hush to Microsoft, so I can't see how it's Google's fault. EDIT: And, as per sentiment expressed by world+dog in previous threads about this particular event, Google's observation that exploits were already in the wild is the most important aspect of this story. If a vulnerability exists for some software I'm using, and I don't know about it but the bad guys do ... I want to be told. I may not be able to patch, but I can mitigate.
- mordocai 10y ago
  > Yes, it sounds like a short notice period (5 days or so?). 7 day notice period as per google's usual policy.
  - celticninja 10y ago
    I imagine that applies if there is no evidence that the bug is being exploited. When evidence exists that it is being exploited perhaps it doesn't apply.
    - CiPHPerCoder 10y ago
      Other way around. Actively exploited: 7 days. Generally: 90 days. There are probably other caveats, but they're not interesting here.
  - mtgx 10y ago
    And Google actually revealed it 10 days later (after the weekend, I guess).
- cm2187 10y ago
  So you think you are safer now that every single bad guy knows about it instead of one bad guy?
acqq 10y ago
Google's behavior seems strange: http://www.theverge.com/2016/10/31/13481502/windows-vulnerability-sandbox-google-microsoft-disclosure http://www.theverge.com/2016/10/31/13481502/windows-vulnerab... "Google went public just 10 days after reporting the bug to Microsoft, before a patch could be coded and deployed. The result is that, while Google has already deployed a fix to protect Chrome users, Windows itself is still vulnerable — and now, everybody knows it."
- DrewHintz 10y ago
  https://security.googleblog.com/2013/05/disclosure-timeline-for-vulnerabilities.html https://security.googleblog.com/2013/05/disclosure-timeline-...
  - acqq 10y ago
    I know about that post from 2013 and I still don't agree. Just like I don't agree with how Google implemented AMP, making google.com a link redirector that didn't exist before and was actually used in the fishing campaign, specifically: http://seclists.org/bugtraq/2016/Apr/70 http://seclists.org/bugtraq/2016/Apr/70 That is what was actively used to fish the logins from Podesta et al. Google's response: https://sites.google.com/site/bughunteruniversity/nonvuln/open-redirect https://sites.google.com/site/bughunteruniversity/nonvuln/op... "tooltips are not a reliable security indicator" Translation: "we don't look at that sh.t" "poses very little practical risk." See how Podesta et al. were tricked. "offers fairly clear benefits" Translation: "For us. Muahhaha."
- kbenson 10y ago
  IIRC from when this was originally reported, this was already being exploited in the wild prior to release. The only reason to not go public is to give the vendor a chance to patch it prior to general exploits being available. If exploits are already happening, waiting only endangers more people as they can't take actions to mitigate a danger themselves if they don't know about it.
  - acqq 10y ago
tomp 10y ago
So this is how rumour becomes truth - the US government accuses Russia of hacking the DNC, either because they have some kind of proof (unlikely) or because it serves their global interests (likely), media publishes articles of this myth, and then completely unrelated articles embed this "truth" in the title, even though the content doesn't really require it. Abhorent!
- throwawayIndian 10y ago
  ha!… and some defenseless individual from eastern Europe gets incarcerated while a joker security consultant gets federal protection in exchange for deleting 30k mails… only to find out that a superset of those mails is available on another dicks' machine elsewhere… Propaganda machine can be hilarious at times!
  - sctb 10y ago
    We've asked you already to please not comment like this, and we have to ban accounts that continue. Please comment civilly and substantively on Hacker News or not at all.
- joshmaker 10y ago
  > the US government accuses Russia of hacking the DNC, either because they have some kind of proof (unlikely) "two competing cybersecurity companies, Mandiant (part of FireEye) and Fidelis, confirmed CrowdStrike’s initial findings that Russian intelligence indeed hacked the DNC. The forensic evidence that links network breaches to known groups is solid... etc etc" http://motherboard.vice.com/read/all-signs-point-to-russia-being-behind-the-dnc-hack http://motherboard.vice.com/read/all-signs-point-to-russia-b...
  - mtgx 10y ago
    Attribution is hard. The NSA likely never hacks someone's systems from US IPs. They hack Russian and Chinese computers first, from where they launch their exploits. I would imagine the NSA is not the only country that does this. I don't know how good the two security firms are and whether they could actually identify something like this, though.
anc84 10y ago
"New Shadow Brokers dump contains list of servers compromised by the NSA to use as exploit staging servers." -> https://twitter.com/musalbas/status/793001139310559232 https://twitter.com/musalbas/status/793001139310559232 Lots of .ru domains in that list. Attribution is hard if you care about being correct.
my123 10y ago
On Microsoft Edge and Google Chrome, it can't be exploited because of win32k lockdown.
deleted 10y ago
[deleted]
mikebay 10y ago
Microsoft is joined to Hillary's supporters and they are sure Bad hackers from Russia is true as media keep saying ? Oh my.. what a shiate.
- sctb 10y ago
  Please stop posting unsubstantive comments like this.
mikebay 10y ago
Russia has been so so bad again. Bla bla.
jszymborski 10y ago
Ok, I'm only going off the extremely limited information in this article, but this attack phishes users, gets them on a malicious webpage and then uses Flash as a vector to exploit an MS Windows vuln, right? If that's the case, haven't Chrome and Firefox been blocking Flash for over a year now[0]? Considering the MS Edge is apparently not vulnerable (according to the article), that doesn't leave much market share left. If all of the above is correct, I'd say the surface area of this attack is pretty low. [0] https://archive.fo/oxlmT https://archive.fo/oxlmT
kutkloon7 10y ago
Why would you submit an article that requires an account to read it?

How naive one government agency has to be to think backdoors are for them only. How pissed was the FBI when the learned that now the Russians also have access to the voting machines. They're using next decade technology with a 60 year old mindset.

aluhut 10y ago

First link that came up at google WITHOUT A PAYWALL: http://betanews.com/2016/11/02/russian-hackers-exploit-windows-security-flaw/ http://betanews.com/2016/11/02/russian-hackers-exploit-windo... And the Microsoft blog post: https://blogs.technet.microsoft.com/mmpc/2016/11/01/our-commitment-to-our-customers-security/ https://blogs.technet.microsoft.com/mmpc/2016/11/01/our-comm...

acqq 10y ago
And Microsoft's post doesn't seem to mention "Russian" anything. Compare that with the coverage in the style of "Microsoft CONFIRMED Russians help HIM" Edit: The titles of the articles and the coverage make a logical jump that the authors of the texts took care to avoid. The jump is only to be explained by the need of the influence of the perception of the readers shortly before the elections.
- r721 10y ago
  They state that STRONTIUM is likely APT28/Sofacy in linked PDF: "STRONTIUM has been active since at least 2007. Whereas most modern untargeted malware is ultimately profit-oriented, STRONTIUM mainly seeks sensitive information. Its primary institutional targets have included government bodies, diplomatic institutions, and military forces and installations in NATO member states and certain Eastern European countries. Additional targets have included journalists, political advisors, and organizations associated with political activism in central Asia. STRONTIUM is Microsoft’s code name for this group, following its internal practice of assigning chemical element names to activity groups; other researchers have used code names such as APT28, Sednit, Sofacy, and Fancy Bear as labels for a group or groups that have displayed activity similar to the activity observed from STRONTIUM. The group’s persistent use of spear phishing tactics and access to previously undiscovered zero-day exploits have made it a highly resilient threat." http://download.microsoft.com/download/4/4/C/44CDEF0E-7924-4787-A56A-16261691ACE3/Microsoft_Security_Intelligence_Report_Volume_19_A_Profile_Of_A_Persistent_Adversary_English.pdf http://download.microsoft.com/download/4/4/C/44CDEF0E-7924-4...
aembleton 10y ago
Alternatively, get this addon: https://addons.mozilla.org/en-GB/firefox/addon/refcontrol/ https://addons.mozilla.org/en-GB/firefox/addon/refcontrol/ or an equivalent for Chrome. Then add www.ft.com and www.wsj.com sites with the Action of https://www.google.com https://www.google.com
- aluhut 10y ago
  Thank you but I just don't click them at all any more.
- blahi 10y ago
  Hey, come work for me. I have an addon on Outlook that blocks emails where employees demand their salary.
  - dvtv75 10y ago
    ...I think my boss uses that.
- kzisme 10y ago
  This is nice - but...I'd rather not read/support paywalls by reading their content.

Jedd 10y ago

> Microsoft Says Russian Hackers Exploited Flaw In Windows > (And Blames Google) Jedd Says Microsoft Should Have Fixed The Exploit Yes, it sounds like a short notice period (5 days or so?). But ... from the chronology it's sounding like this particular exploit was performed long before Google revealed the vulnerability, and indeed a goodly time before Google reported that vulnerability on the hush to Microsoft, so I can't see how it's Google's fault. EDIT: And, as per sentiment expressed by world+dog in previous threads about this particular event, Google's observation that exploits were already in the wild is the most important aspect of this story. If a vulnerability exists for some software I'm using, and I don't know about it but the bad guys do ... I want to be told. I may not be able to patch, but I can mitigate.

mordocai 10y ago
> Yes, it sounds like a short notice period (5 days or so?). 7 day notice period as per google's usual policy.
- celticninja 10y ago
  I imagine that applies if there is no evidence that the bug is being exploited. When evidence exists that it is being exploited perhaps it doesn't apply.
  - CiPHPerCoder 10y ago
    Other way around. Actively exploited: 7 days. Generally: 90 days. There are probably other caveats, but they're not interesting here.
- mtgx 10y ago
  And Google actually revealed it 10 days later (after the weekend, I guess).
cm2187 10y ago
So you think you are safer now that every single bad guy knows about it instead of one bad guy?

acqq 10y ago

Google's behavior seems strange: http://www.theverge.com/2016/10/31/13481502/windows-vulnerability-sandbox-google-microsoft-disclosure http://www.theverge.com/2016/10/31/13481502/windows-vulnerab... "Google went public just 10 days after reporting the bug to Microsoft, before a patch could be coded and deployed. The result is that, while Google has already deployed a fix to protect Chrome users, Windows itself is still vulnerable — and now, everybody knows it."

DrewHintz 10y ago
https://security.googleblog.com/2013/05/disclosure-timeline-for-vulnerabilities.html https://security.googleblog.com/2013/05/disclosure-timeline-...
- acqq 10y ago
  I know about that post from 2013 and I still don't agree. Just like I don't agree with how Google implemented AMP, making google.com a link redirector that didn't exist before and was actually used in the fishing campaign, specifically: http://seclists.org/bugtraq/2016/Apr/70 http://seclists.org/bugtraq/2016/Apr/70 That is what was actively used to fish the logins from Podesta et al. Google's response: https://sites.google.com/site/bughunteruniversity/nonvuln/open-redirect https://sites.google.com/site/bughunteruniversity/nonvuln/op... "tooltips are not a reliable security indicator" Translation: "we don't look at that sh.t" "poses very little practical risk." See how Podesta et al. were tricked. "offers fairly clear benefits" Translation: "For us. Muahhaha."
kbenson 10y ago
IIRC from when this was originally reported, this was already being exploited in the wild prior to release. The only reason to not go public is to give the vendor a chance to patch it prior to general exploits being available. If exploits are already happening, waiting only endangers more people as they can't take actions to mitigate a danger themselves if they don't know about it.
- acqq 10y ago

tomp 10y ago

So this is how rumour becomes truth - the US government accuses Russia of hacking the DNC, either because they have some kind of proof (unlikely) or because it serves their global interests (likely), media publishes articles of this myth, and then completely unrelated articles embed this "truth" in the title, even though the content doesn't really require it. Abhorent!

throwawayIndian 10y ago
ha!… and some defenseless individual from eastern Europe gets incarcerated while a joker security consultant gets federal protection in exchange for deleting 30k mails… only to find out that a superset of those mails is available on another dicks' machine elsewhere… Propaganda machine can be hilarious at times!
- sctb 10y ago
  We've asked you already to please not comment like this, and we have to ban accounts that continue. Please comment civilly and substantively on Hacker News or not at all.
joshmaker 10y ago
> the US government accuses Russia of hacking the DNC, either because they have some kind of proof (unlikely) "two competing cybersecurity companies, Mandiant (part of FireEye) and Fidelis, confirmed CrowdStrike’s initial findings that Russian intelligence indeed hacked the DNC. The forensic evidence that links network breaches to known groups is solid... etc etc" http://motherboard.vice.com/read/all-signs-point-to-russia-being-behind-the-dnc-hack http://motherboard.vice.com/read/all-signs-point-to-russia-b...
- mtgx 10y ago
  Attribution is hard. The NSA likely never hacks someone's systems from US IPs. They hack Russian and Chinese computers first, from where they launch their exploits. I would imagine the NSA is not the only country that does this. I don't know how good the two security firms are and whether they could actually identify something like this, though.

anc84 10y ago

"New Shadow Brokers dump contains list of servers compromised by the NSA to use as exploit staging servers." -> https://twitter.com/musalbas/status/793001139310559232 https://twitter.com/musalbas/status/793001139310559232 Lots of .ru domains in that list. Attribution is hard if you care about being correct.

my123 10y ago

On Microsoft Edge and Google Chrome, it can't be exploited because of win32k lockdown.

deleted 10y ago

[deleted]

mikebay 10y ago

Microsoft is joined to Hillary's supporters and they are sure Bad hackers from Russia is true as media keep saying ? Oh my.. what a shiate.

sctb 10y ago
Please stop posting unsubstantive comments like this.

mikebay 10y ago

Russia has been so so bad again. Bla bla.

jszymborski 10y ago

Ok, I'm only going off the extremely limited information in this article, but this attack phishes users, gets them on a malicious webpage and then uses Flash as a vector to exploit an MS Windows vuln, right? If that's the case, haven't Chrome and Firefox been blocking Flash for over a year now[0]? Considering the MS Edge is apparently not vulnerable (according to the article), that doesn't leave much market share left. If all of the above is correct, I'd say the surface area of this attack is pretty low. [0] https://archive.fo/oxlmT https://archive.fo/oxlmT

kutkloon7 10y ago

Why would you submit an article that requires an account to read it?