Windows zero-day exploited by same group behind DNC hack

November 2, 2016 3oliver

Enlarge / That bear looks familiar.

On Oct. 31, Google’s Threat Analysis Group revealed a vulnerability in most versions of Windows that is actively being exploited by malware attacks.

Today, Terry Myerson, executive vice president of Microsoft’s Windows and Devices group, acknowledged the exploit was being used actively by a sophisticated threat group—the same threat group involved in the hacks that led to the breach of data from the Democratic National Committee and the Clinton campaign. And while a patch is on the way for the vulnerability, he encouraged customers to upgrade to Windows 10 for protection from further advanced threats.

In an advisory, Myerson wrote:

Recently, the activity group that Microsoft Threat Intelligence calls STRONTIUM conducted a low-volume spear-phishing campaign. Customers using Microsoft Edge on Windows 10 Anniversary Update are known to be protected from versions of this attack observed in the wild. This attack campaign, originally identified by Google’s Threat Analysis Group, used two zero-day vulnerabilities in Adobe Flash and the down-level Windows kernel to target a specific set of customers.

Microsoft customers using Windows 10 with Windows Defender Advanced Threat Detection are already protected against the zero-day, Myerson noted, because the software “will detect STRONTIUM’s attempted attacks thanks to ATP’s generic behavior detection analytics and up-to-date threat intelligence.”

Strontium is Microsoft’s code-name for the group known as APT28, also known as “Fancy Bear.” Strontium is one of two threat groups that were involved in the breach of the Democratic National Committee, Clinton campaign Chair John Podesta, and former Secretary of State Colin Powell, among others. Researchers have tied both groups to Russian intelligence. It’s not clear if the zero-days revealed by Google were used as part of those breaches, which were accomplished through spear-phishing attacks that included faked Google security alerts.

The Windows zero-day is the flaw Google identified in win32k.sys. This flaw allows malicious code to escape from Windows’ sandbox and escalate its privileges. The flaw, alongside a similar Adobe Flash exploit, was being used as part of an as-yet-unidentified Russian spear-phishing campaign.

“We have coordinated with Google and Adobe to investigate this malicious campaign and to create a patch for down-level versions of Windows,” Myerson wrote. “Along these lines, patches for all versions of Windows are now being tested by many industry participants, and we plan to release them publicly on the next Update Tuesday, Nov 8.”

Myerson said that Microsoft had wanted to coordinate disclosure of the vulnerability along with the release of a patch, and he took Google to task for releasing information early. He wrote:

“We believe responsible technology industry participation puts the customer first, and requires coordinated vulnerability disclosure,” Myerson wrote. “Google’s decision to disclose these vulnerabilities before patches are broadly available and tested is disappointing, and puts customers at increased risk.”