There's a zeroday exploit in the wild that exploits a key file-sharing protocol in all supported versions of windows. That includes Windows 10, the latest and most secure version of the Microsoft operating system. The exploit is probably not worth worrying about, but you'd never know that based on the statement Microsoft officials issued on Thursday when asked what kind of threat the exploit poses:
"Windows is the only platform with a customer commitment to investigate reported security issues and proactively update impacted devices as soon as possible," an unnamed spokesperson replied. "We recommend customers use Windows 10 and the Microsoft Edge browser for the best protection."
An employee at Microsoft's outside PR firm, WE Communications, wouldn't explain why the statement advised customers to use Windows 10 and Edge when the exploit works on all versions of Windows and doesn't require that targets use a browser. Ars reminded the employee that an advisory issued hours earlier by the CERT Coordination Center at Carnegie Mellon University warned the vulnerability might leave users of all supported versions of Windows open to code-execution attacks.
Ars pressed the employee several more times for details that would allow Windows users to assess the risk they faced and learn of any potential workarounds. She declined. As is almost always the case with security-related questions from reporters, people inside Microsoft declined to be interviewed.
Enlarge
In the hours that followed the statement, outside sources made clear that the vulnerability didn't pose as grave a threat as was suggested by the CERT advisory. CERT had initially scored the flaw's severity with a 10, the maximum in the Common Vulnerability Scoring System. The main reason the true severity was lower is that the exploit―which stems from a null pointer dereference bug in version 3 of Microsoft's server message block file server protocol―could only cause servers to crash, as opposed to forcing them to execute malicious code. Another reason: to be exploited by an attacker on the Internet, a target would have to configure vulnerable servers to maintain an outgoing file share. That's something almost no security-conscious organization does. CERT later removed the code-execution wording from the advisory and downgraded the severity score from 10 to 7.8.
But Windows users had no way of knowing that from Microsoft's statement. Instead of providing useful information, the company made patently false claims that operating systems from Microsoft competitors―Apple and linux maintainers, for example―don't adhere to the same commitment to security that Windows does. This is demonstrably false. Even worse, the statement left open the mistaken impression that Windows 10 wasn't vulnerable. This is clearly not the case. Indeed, the name of the proof-of-concept exploit that was published on Wednesday is Win10.py . An updated statement issued Friday abandoned the advice to use Windows 10 and Edge, but it didn't say why, and the WE Communications employee wouldn't elaborate.
The exploit was released by Laurent Gaffie, a security researcher who privately reported the bug to Microsoft in September. He told Ars that the software maker initially planned to patch the flaw in December, but later decided to delay the release until February so it could be included with other planned SMB fixes.
In an email, Gaffie wrote:
I decided to release this bug one week before the patch is released, because it is not the first time Microsoft sits on my bugs. I'm doing free work here with them (I'm not paid in anyways for that) with the goal of helping their users. When they sit on a bug like this one, they're not helping their users but doing marketing damage control, and opportunistic patch release.
Microsoft may have good reasons for delaying the patch. But once an exploit is in the wild, there's no excuse for leaving customers in the dark about its effects and any possible mitigations or workarounds. The mishandling of Win10.py is even worse: CERT had warned that malicious code-execution attacks were possible.
The time has come for Microsoft vulnerability disclosure communications to mute the marketers and let the security engineers do the talking instead.