Microsoft Put Off Fixing Zero Day for 2 Years:
One of the 120 security holes Microsoft fixed on Aug. 11's Patch Tuesday was CVE-2020-1464, a problem with the way every supported version of Windows validates digital signatures for computer programs.
Code signing is the method of using a certificate-based digital signature to sign executable files and scripts in order to verify the author's identity and ensure that the code has not been changed or corrupted since it was signed by the author.
Microsoft said an attacker could use this "spoofing vulnerability" to bypass security features intended to prevent improperly signed files from being loaded. Microsoft's advisory makes no mention of security researchers having told the company about the flaw, which Microsoft acknowledged was actively being exploited.
In fact, CVE-2020-1464 was first spotted in attacks used in the wild back in August 2018. And several researchers informed Microsoft about the weakness over the past 18 months.
Bernardo Quintero is the manager at VirusTotal, a service owned by Google that scans any submitted files against dozens of antivirus services and displays the results. On Jan. 15, 2019, Quintero published a blog post outlining how Windows keeps the Authenticode signature valid after appending any content to the end of Windows Installer files (those ending in .MSI) signed by any software developer.
[...] "In short, an attacker can append a malicious JAR to a MSI file signed by a trusted software developer (like Microsoft Corporation, Google Inc. or any other well-known developer), and the resulting file can be renamed with the .jar extension and will have a valid signature according Microsoft Windows," Quintero wrote.
[Emphasis from original retained.]
(Score: 1, Informative) by Anonymous Coward on Monday August 24 2020, @06:36PM (1 child)
What?
* a vuln
Check.
* unaddressed by MS
Check.
* not publicly known
Ok this depends how you define "publicly". The 0day defn clearly includes bugs that the developer knows of but is not patching. Having one or two security researchers make non-public disclosures only to MS is not in public. Being exploited but not identified as being exploited is also in the 0day defn. It doesn't matter if it's publicly used, it's whether it's publicly /known/ to be, which slices non/0day.
* was being actively exploited
Was being. As you quoted, for 18mo.
I don't understand - can you explain? Are you using a diff defn of 0day?
(Score: 2) by canopic jug on Tuesday August 25 2020, @06:21AM
What? The fact that it is known by the vendor automatically removes it from the category of zero-day. Once that happens the clock is ticking. M$ was told about this bug several times, years ago.
Here's what happens, not in any particular order:
Again, that's not in any particular order. Just because M$ is never ready with their patches, no matter how much advanced warning they get, until long after the exploits start rolling doesn't make the bug a zero-day.
Money is not free speech. Elections should not be auctions.