Russian Hackers Linked to New Attacks Exploiting Windows Vulnerability

By Laura Stotler November 02, 2016

Russia has repeatedly made headlines in the upcoming U.S. election, with government-sponsored hackers allegedly responsible for accessing Democratic Party emails and then publishing them through WikiLeaks and other sources. Now Microsoft has given the hacking sources additional validity, claiming a group previously linked to the Russian government and U.S. political hacks is responsible for recent attacks that exploited a newly discovered Windows security flaw.

Microsoft revealed on its website that “spear phishing” emails had been sent from the Strontium hacking group, also known as “Fancy Bear” and “APT 28.” Those emails were used to launch a small number of attacks by exploiting Windows vulnerabilities. Microsoft is releasing a patch on Election Day, November 8, to protect users against the threat.

The timing of Microsoft’s announcement, as well as the patch release on Election Day, adds yet another element of chaos into what has proven to be a historically unusual and turbulent election cycle. And much in the spirit of the impending election, rivals Microsoft and Google were at each other’s throats over the timing of the vulnerability announcement. According to Microsoft, the attacks exploit a vulnerability in Adobe’s Flash software as well as the Windows OS. Adobe released a patch for its vulnerability on Monday, and Google promptly went public with details of the attacks – well before Microsoft’s patch was prepared and available.

“Google’s decision to disclose these vulnerabilities before patches are broadly available and tested is disappointing, and puts customers at increased risk,” said Microsoft in a statement, while Google had no comment on the issue.

According to John Bambenek, threat systems manager at Fidelis Cybersecurity, a company specializing in threat detection and security, early disclosure was the right move in this scenario, and will protect more enterprises in the long run.

“There will always be a risk with acknowledging weakness,” said Bambenek. “Even releasing patches can give adversaries the very clues needed to weaponize and exploit. This was very much true with Microsoft patches years ago, which have been largely mitigated by automated patching and rebooting within 24 hours of release.”

“While we don’t have solid data to talk about how widely it is being used, we do know that this vulnerability is dangerous,” added Bambenek. “It's a local privilege escalation, which means that if a user can execute compromised code, that code could be used to run commands as the administrator and more deeply embed itself into a system. At this point, my preference is to release mitigation strategies so that enterprises can protect their users while awaiting a patch.”

The Fancy Bear hacking group has been primarily tied to GRU, Russia’s military intelligence agency. The group has been widely blamed for the recent hacks of Democratic Party databases and emails.




Edited by Alicia Young

TechZone360 Contributing Editor

SHARE THIS ARTICLE
Related Articles

Bloomberg BETA: Models Are Key to Machine Intelligence

By: Paula Bernier    4/19/2018

James Cham, partner at seed fund Bloomberg BETA, was at Cisco Collaboration Summit today talking about the importance of models to the future of machi…

Read More

Get Smart About Influencer Attribution in a Blockchain World

By: Maurice Nagle    4/16/2018

The retail value chain is in for a blockchain-enabled overhaul, with smarter relationships, delivering enhanced transparency across an environment of …

Read More

Facebook Flip-Flopping on GDPR

By: Maurice Nagle    4/12/2018

With GDPR on the horizon, Zuckerberg in Congress testifying and Facebook users questioning loyalty, change is coming. What that change will look like,…

Read More

The Next Phase of Flash Storage and the Mid-Sized Business

By: Joanna Fanuko    4/11/2018

Organizations amass profuse amounts of data these days, ranging from website traffic metrics to online customer surveys. Collectively, AI, IoT and eve…

Read More

Satellite Imaging - Petabytes of Developer, Business Opportunities

By: Doug Mohney    4/11/2018

Hollywood has programmed society into believing satellite imaging as a magic, all-seeing tool, but the real trick is in analysis. Numerous firms are f…

Read More