Microsoft released an urgent update to fix a vulnerability that could allow cybercriminals to hijack an entire system.
The bug, which affects the Windows operating system, allows for remote code execution, meaning the vulnerability can be exploited without a user’s permission. The Microsoft update was produced quickly, and the fix was pushed out before Patch Tuesday, the software giant’s usual monthly security update.
The vulnerability will raise concern among security professionals, many of whom already contend with ever-increasing security threats. News of the rapid Microsoft update will, however, come as a relief. Businesses should ensure their systems are up to date.
A ‘Crazy Bad’ Bug
The bug was discovered last weekend by Google Project Zero researchers Tavis Ormandy and Natalie Silvanovich. Ormandy, a prominent vulnerability hunter, described the bug as “crazy bad,” Bleeping Computer noted.
Ormandy reported the vulnerability but held other details back to give Microsoft time to fix the bug. The software firm issued a security advisory at the start of the week, which included details of the automatic Microsoft update.
The bug affects the Microsoft Malware Protection Engine (MsMpEng). This is a key service in Windows 7, Windows 8.1, Windows 10 and Windows Server 2016, and is the core of many of the software giant’s security tools, including Windows Defender and Microsoft Endpoint Protection.
Exploiting the Vulnerability
The Project Zero team said that vulnerabilities in MsMpEng are among the most severe possible in Windows due to the privilege, accessibility and ubiquity of the service. Cybercriminals could exploit the bug by sending an infected email or instant message, or getting the user to click on a web link.
The flaw also allows fraudsters to remotely execute code when MsMpEng scans a specially created file. That means the bug could be exploited without a user opening a message or clicking on a link.
Once the code is exploited, attackers can gain access to the LocalSystem account and hijack an entire system. They then have complete control and could choose to install or delete programs, steal information or download additional malware.
Microsoft Update Highlights the Importance of Disclosure
Experts praised Microsoft for its speedy response, according to BBC. The company prepared and shipped a fix in just a few days thanks to the built-in deployment system in Microsoft’s products, which sends the patch to users automatically.
News of the flaw comes at a time when experts fear that attacks exploiting software vulnerabilities are on the rise, according to Help Net Security. It noted that Kaspersky Lab detected 702 million attempts to launch exploits in 2016, an increase of 25 percent from 2015. Recent reports also revealed that thousands of industrial control systems (ICS) could be at risk due to critical vulnerabilities.
The increase in vulnerabilities also helps raise the importance of security advisories such as this one issued by Microsoft. As the firm’s security director, Tim Rains, suggested in a blog post last year, chief information security officers (CISOs) must pay close attention these disclosures and updates.