Microsoft is rolling out a security fix to Windows 10 after the US National Security Agency (NSA) warned the popular operating system contained a highly dangerous flaw that could be used by hackers. Reporting the vulnerability represents a departure for the NSA from its past strategy of keeping security flaws under wraps to exploit for its own intelligence needs.
The NSA revealed during a press conference on Tuesday that the “serious vulnerability” could be used to create malicious software that appeared to be legitimate. The flaw “makes trust vulnerable”, the NSA director of cybersecurity, Anne Neuberger, said in a briefing call to media on Tuesday.
If the vulnerability had been successfully exploited, an attacker would have been able to conduct “man-in-the-middle attacks” and decrypt confidential information on user connections to the affected software, Microsoft said.
Microsoft said it had not seen any evidence that hackers had used the technique discovered by the NSA.
“Customers who have already applied the update, or have automatic updates enabled, are already protected,” said Jeff Jones, a senior director at Microsoft, in a statement.
The vulnerability has a broad reach: as of 2017, Windows 10 was used on 400m computers.
The Washington Post reported on Tuesday that the NSA had discovered the flaw in recent weeks and alerted Microsoft to the problem. The issue was announced on Microsoft’s January “Patch Tuesday”, the second Tuesday of each month, when the company typically releases security improvements for operating systems and other software.
Priscilla Moriuchi, who retired from the NSA in 2017 after running its east Asia and Pacific operations, said this was a good example of the “constructive role” that the NSA could play in improving global information security.
Moriuchi, now an analyst at the US cybersecurity firm Recorded Future, said it was probably a reflection of changes made in 2017 to how the US determines whether to disclose a major vulnerability or exploit it for intelligence purposes.
The revamping of what’s known as the “vulnerability equities process” put more emphasis on disclosing unpatched vulnerabilities whenever possible to protect core internet systems and the US economy and general public.
The NSA has previously been criticized after it took advantage of vulnerabilities in Microsoft products to deploy hacking tools against adversaries and kept the technology multinational in the dark about it for years.
When one of those tools was dramatically leaked to the internet by a group calling itself ShadowBrokers, it was deployed against targets around the globe by hackers of all stripes.
In the most dramatic case, a group used the tool to unleash a huge malware outbreak dubbed WannaCry in 2017. The data-wiping worm wrought global havoc, affecting what Europol estimated was 200,000 computers in more than 150 countries.
Disclosing the vulnerability to Microsoft was “a significant step for the National Security Agency”, said Rick Holland, chief information security officer at Digital Shadows, a San Francisco-based provider of digital risk protection solutions.
“Make no mistake, though; the NSA will continue to hoard zero-days and leverage them as required to accomplish their objectives,” he said, referencing the agency’s previous policy of not alerting the public to potential vulnerabilities.
Source: The Guardian
