SoylentNews is people
SoylentNews
Microsoft Put Off Fixing Zero Day for 2 Years:
One of the 120 security holes Microsoft fixed on Aug. 11's Patch Tuesday was CVE-2020-1464, a problem with the way every supported version of Windows validates digital signatures for computer programs.
Code signing is the method of using a certificate-based digital signature to sign executable files and scripts in order to verify the author's identity and ensure that the code has not been changed or corrupted since it was signed by the author.
Microsoft said an attacker could use this "spoofing vulnerability" to bypass security features intended to prevent improperly signed files from being loaded. Microsoft's advisory makes no mention of security researchers having told the company about the flaw, which Microsoft acknowledged was actively being exploited.
In fact, CVE-2020-1464 was first spotted in attacks used in the wild back in August 2018. And several researchers informed Microsoft about the weakness over the past 18 months.
Bernardo Quintero is the manager at VirusTotal, a service owned by Google that scans any submitted files against dozens of antivirus services and displays the results. On Jan. 15, 2019, Quintero published a blog post outlining how Windows keeps the Authenticode signature valid after appending any content to the end of Windows Installer files (those ending in .MSI) signed by any software developer.
[...] "In short, an attacker can append a malicious JAR to a MSI file signed by a trusted software developer (like Microsoft Corporation, Google Inc. or any other well-known developer), and the resulting file can be renamed with the .jar extension and will have a valid signature according Microsoft Windows," Quintero wrote.
[Emphasis from original retained.]
(Score: 5, Interesting) by canopic jug on Monday August 24 2020, @07:18AM (1 child)
Furthermore, it gives all appearance of having been a bugdoor for those 540+ to 730+ days. Bugdoors are bugs known to the vendor but kept open, unpatched while various agencies get informed of their existence -- for a fee [tweaktown.com]. That's on top of PRISM [cnet.com] and worse ones like UPSTREAM [mashable.com] and the others. Only when there start to be too many exploits outside of those agencies does M$ actually get around to trying to patch them. Then, as usual, it takes a few tries to get it rightish. For PR purposes they like to try to act all surpised and caught off guard about it.
Money is not free speech. Elections should not be auctions.
(Score: 0) by Anonymous Coward on Monday August 24 2020, @04:57PM
this is what i figured was happening with these kinds of delays. of course windows users are also the same slaves that will say "who cares, i have nothing to hide. i want them to get the terrorists!"