Glimpse Into The Leakage Of Microsoft Security POC

It goes that whenever Microsoft detected vulnerabilities, it will proceed to create security patches. However, just one day before the patches are to be released as Windows updates to for its products, such information is to be released for partners (Microsoft Active Protections Program partners) for them to patch up their own security products so that there will be no misunderstanding between security products and Microsoft products when the updates are in forced.

For instance, a vulnerability is detected by Microsoft internal security team on day 1. A patch is created and released out to end users on day 2. Hackers receive such information and proceed to create a threat based on the confirmed vulnerability. Hence for those PC which did not install the updates, it will be vulnerable to attacks. To make things worst, if security partners’ products also didn’t have enough time to deliver essential updates, the threat will not have been detected on day 2.

Way back, such process used to take months until today it may have shrunk to hours due to the increasing complexity in handling security vulnerabilities and the tenacity of the uprising of security threats day in and out.

The short notices is important to prevent hackers from gaining enough time to reverse-engineer the patches in order to create newer version of threats as counter-attack.

This means that the weakest link is the communication between Microsoft and partners because Microsoft could have done it without informing partners and that will save the trouble. Hackers most often rely on insider’s information in order to gain insights into potential vulnerabilities and in this case, the insider is suspected to be originated from one of the partners.

The patches for the new hole were distributed on Tuesday, as part of Microsoft’s regular monthly cycle for security fixes. The hole is a very serious one, because full exploitation would allow an attacker to control machines running Windows XP and later Windows versions that have Remote Desktop Protocol enabled, as long as the network doesn’t demand authentication.

Fortunately, the exploit code Auriemma drafted would only shut a PC down, not hand over control to the attacker. Full exploit code has not been seen yet, but security experts said it would likely come more quickly now that the starting point is in the wild.

For more information, refer to ‘Microsoft says hacking code could have leaked‘