Latest Picks

“There’s a zero-day exploit in the wild that exploits a key file-sharing protocol in most supported versions of Windows, including Windows 10, the latest and most secure version of the Microsoft operating system.”

“The exploit is probably not worth worrying about, but you’d never know that based on the statement Microsoft officials issued on Thursday when asked what kind of threat the exploit poses: ‘Windows is the only platform with a customer commitment to investigate reported security issues and proactively update impacted devices as soon as possible,’ an unnamed spokesperson replied in an e-mail. ‘We recommend customers use Windows 10 and the Microsoft Edge browser for the best protection.’”

“Ars reminded the employee that an advisory issued hours earlier by the CERT Coordination Center [non-profit computer emergency response team to improve computer security] at Carnegie Mellon University warned that the vulnerability might leave Windows users open to code-execution attacks. … Ars pressed the employee several more times for details that would allow Windows users to assess the risk they faced and learn of any potential workarounds. She declined. As is almost always the case with security-related questions from reporters, people inside Microsoft declined to be interviewed.”

“In the hours that followed the [Microsoft] statement, outside sources made clear that the vulnerability didn’t pose as grave a threat as was suggested by the CERT advisory. CERT had initially scored the flaw's severity with a 10, the maximum in the Common Vulnerability Scoring System. The main reason that the true severity was lower is that the exploit—which stems from a null pointer dereference bug in version 3 of Microsoft’s server message block file server protocol—could only cause computers to crash as opposed to forcing them to execute malicious code. … CERT later removed the code-execution wording from the advisory and downgraded the severity score from 10 to 7.8.”

“When WikiLeaks on Tuesday dumped thousands of files documenting hacking tools used by the U.S. Central Intelligence Agency, many feared WikiLeaks would soon publish a trove of so-called ‘zero days,’ the actual computer code that the CIA uses to exploit previously unknown flaws in a range of software and hardware products used by consumers and businesses. But on Thursday, WikiLeaks editor-in-chief Julian Assange promised that his organization would work with hardware and software vendors to fix the security weaknesses prior to releasing additional details about the flaws. … It’s unclear if WikiLeak’s decision to work with software makers on zero-days was impacted by a poll the organization took via its Twitter page over the past few days. … So far, just over 38,000 people have responded, with a majority (57 percent) saying ‘Yes, make people safe,’ while only 36 percent selected ‘no, they’re part of the problem.’”