Emergency Windows fix

agrinnall

http://www.bbc.co.uk/news/technology-39856391

Can any security experts shed more light on this? I don't have Defender (or any other MS anti-malware) turned on so from this story I'd assume I'm not at risk, but as it's a BBC Technology article I wouldn't want to bet my house on it being completely correct.

John_Gray

Read what The Register has to say!

agrinnall

John_Gray wrote: »

Read what The Register has to say!

Thanks, I'm quite glad now that I don't use any of the MS built in security products!

System

You are at risk, everyone is, regardless of whether you use Windows Defender or another solution. Unlike many exploits which usually require a file to be opened and run, this one just requires a file to be opened. That means that any AV program scanning this file would be opening it.

In the BBC Windows Defender was merely being used as an example probably because on Windows 8 onwards even those without a third party solution would be using it.

Thankfully though Microsoft is usually very on the ball with serious Zero Day exploits like this and it has already been patched and the fix pushed out to everyone with automatic updates turned on.

ALPedro

I just had an client whom got infected with ransom-ware by simply clicking on the 'unsubscribe' link on the email.
in general, i'd be very careful with unknown (and possibly known) senders. backup backup and backup. then backup the backup and throw it in a safe.

onomatopoeia99

Here's the original post from the Google project zero team members that found it : https://bugs.chromium.org/p/project-zero/issues/detail?id=1252&desc=5

It's proper scary:
NScript is the component of mpengine that evaluates any filesystem or network activity that looks like JavaScript. To be clear, this is an unsandboxed and highly privileged JavaScript interpreter that is used to evaluate untrusted code, by default on all modern Windows systems. This is as surprising as it sounds.

With that last sentence you'd think they were British, the amount of understatement they are using! :rotfl:

RumRat

I guess, in the midst of blind panic, it was missed that a fix had been done.
Everytime someone finds the possibility to do something with a piece of software the press start alarming everyone.
All software is secure, until someone finds a flaw or a previously unknown method of attack. The test is how fast the owner is in fixing the problem.

wongataa

agrinnall wrote: »

Thanks, I'm quite glad now that I don't use any of the MS built in security products!

Similar issues have occurred in other security software in the past. Software without any security issues is non existent. This issue has been fixed so if you are up to date with your updates then you are fine.

onomatopoeia99

RumRat wrote: »

I guess, in the midst of blind panic, it was missed that a fix had been done.

Not missed by me - the Google project zero team did responsible disclosure, to Microsoft first, and waited until a fix was in place before going public with the CVE. Microsoft worked through the weekend to get the fix written and pushed live. No complaints about the actions of either in this regard.

Having code in a security product that runs untrusted javascript with elevated priviliges in the first place however...

securityguy

onomatopoeia99 wrote: »

Here's the original post from the Google project zero team members that found it : https://bugs.chromium.org/p/project-zero/issues/detail?id=1252&desc=5

It's proper scary:
NScript is the component of mpengine that evaluates any filesystem or network activity that looks like JavaScript. To be clear, this is an unsandboxed and highly privileged JavaScript interpreter that is used to evaluate untrusted code, by default on all modern Windows systems. This is as surprising as it sounds.

With that last sentence you'd think they were British, the amount of understatement they are using! :rotfl:

Tavis, who wrote the bug report, is English.