Windows Bug Exploited For Six Months

A Windows bug patched last month had been exploited for six months by hackers linked to North Korea. Microsoft reportedly knew about it and the delay in fixing it may have been down to internal bureaucracy.

Security company Avast found the bug last August and reported it to Microsoft. At the time it was already a zero-day bug, meaning there was evidence hackers not only knew about the bug but where taking advantage of it. That meant Microsoft had "zero days" head start in coming up with a fix and rolling it out before hackers exploited it.

Microsoft released a fix in the February "Patch Tuesday" update but didn't publicly confirm it had been exploited until the end of the month.

North Korea Behind Attacks

According to Avast, members of the Lazarus hacking group were exploiting the bug. They are thought to be backed by North Korea and their purpose is to cause trouble for other countries and raise funds for the totalitarian state, which is subject to severe restrictions on international trade.

Microsoft has said the risk is that attackers could get "system" level access in limited circumstances, but would need to be logged on to the system in the first place. In simple terms, system level access, also called kernel-level access, means having the same access to the computer that Windows itself has. (Source: bleepingcomputer.com)

Avast says the big problem is Microsoft doesn't consider the move from having administrator access to Windows to having kernel access to be a "security boundary" and thus doesn't treat such bugs as the highest priority.

Hackers Disable Security Tools

According to Avast, that's led to a major problem because the Lazarus hackers are able to use the kernel access to disable security software. They can then install malware known as rootkits which not only have the potential to control the operating system itself, but could do so undetected. (Source: arstechnica.com)

Ultimately, the dispute comes down to a simple difference in views: Avast says hackers able to go from administrator access to kernel access is a major danger, while Microsoft says its not a priority problem because it's so difficult to get administrator access remotely in the first place. Avast's revelations about the hackers extended period exploiting this bug suggests its viewpoint has proven more relevant.

What's Your Opinion?

Should Microsoft warn the public as soon as it knows a bug is being exploited? Which should software firms prioritize: bugs that are easier to exploit or bugs that could cause more damage when exploited? Are manufacturers of security software a trustworthy source on the level of risk?