2 ms·
> Microsoft’s advisory makes no mention of security researchers having told the company about the flaw, which Microsoft acknowledged was actively being exploite
by qeternity 6y ago
> Microsoft’s advisory makes no mention of security researchers having told the company about the flaw, which Microsoft acknowledged was actively being exploited.
Most likely part of an ongoing campaign by a three letter agency which would have requested the delay...
- simiones 6y agoI doubt that three-letter agencies typically attack targets whose only protection is the Windows "this file may be dangerous, are you sure you want to open it?" pop-up..
- Lammy 6y agoWho said anything about "only" protection? Besides you, I mean. Real-world attacks tend to involve simultaneous exploitation of multiple vulnerabilities, like this real iOS Safari watering-hole/drive-by attack maliciously using the same exploit chains as my favorite iOS jailbreak tool: https://googleprojectzero.blogspot.com/2019/08/a-very-deep-dive-into-ios-exploit.html https://googleprojectzero.blogspot.com/2019/08/a-very-deep-d...
- imtringued 6y agoI see. If you visit a sketchy website then it is entirely possible that you won't notice anything. If a random unsigned installer nag pops up after you clicked on an ad there is a decent chance that the user closes the dialogue and "walks" away unscathed.
- ourmandave 6y agoMaybe the three-letter agency has a guy inside to click "Ok" to the pop-up.
- AnIdiotOnTheNet 6y agoUnlikely. At the scale of three-letter agencies it isn't very difficult to get hold of valid signing certs.