Google is in the news again for publically releasing details about a security vulnerability in Windows. A vulnerability which it knew was actively being used to attack users.<\/p>\n
Doesn\u2019t sound like a big deal right?<\/p>\n
Well, the problem was that, in the interest of responsible disclosure, Google didn\u2019t wait for Microsoft to release a patch.<\/p>\n
Google published its findings on the 31st<\/sup> of October<\/a>. Its post outlined two different vulnerabilities \u2013 one that affected Adobe Flash, in addition to the one affecting Windows. These two vulnerabilities were being used together to gain access to users’ PCs.<\/p>\n It\u2019s Google\u2019s policy to publicly disclose vulnerabilities within 7 days of discovery<\/a> if they are being actively exploited. Adobe had time to release a patch within the 7-day period, but Microsoft won\u2019t have a patch available until November 8th<\/sup>.<\/p>\n Users who update Flash should be protected, since both vulnerabilities needed to exist for the specific exploit to be successful. But that has done little to quell\u00a0Microsoft\u2019s anger.<\/p>\n In a statement from Microsoft<\/a>, Terry Myerson, the Executive Vice President of the Windows and Devices Group<\/em> said \u201cresponsible technology industry participation puts the customer first, and requires coordinated vulnerability disclosure. Google\u2019s decision to disclose these vulnerabilities before patches are broadly available and tested is disappointing, and puts customers at increased risk.\u201d<\/p>\n But are users really at increased risk? Who exactly did Google put in harm\u2019s way by disclosing the vulnerability before a patch was available?<\/p>\n These are all questions that the security community asks every time a vulnerability is found, and it\u2019s very much an open debate<\/a>.<\/p>\n Earlier this week we were talking about Google\u2019s Project Zero<\/a>, another taskforce-of-sorts within Google that looks for zero-day vulnerabilities. Project Zero publicly disclosed a vulnerability in Apple\u2019s macOS and iOS a day after Apple released a patch for it. This was after granting\u00a0Apple an extension to its\u00a090-day disclosure policy, which as the name applies, gives vendors 90 days to patch the vulnerability before its made public. Apple would have missed that deadline by weeks.<\/p>\n In that case, Google\u2019s Project Zero felt it was okay to grant an extension because it\u00a0did not have evidence that the vulnerability was actively being used.<\/p>\n These two vulnerabilities, Apple’s and Microsoft’s, were also found by two entirely separate departments within Google. So these decisions were\u00a0made by different people.<\/p>\n In a case like this Windows vulnerability, where it’s known to be actively exploited, there is more pressure to publicly disclose it as soon as possible so that potential targets can be aware of the risk. After all, you can\u2019t protect yourself if you don\u2019t know how, or by whom you are being attacked.<\/p>\n But those who criticize this position say that public disclosure is akin to putting weapons into more hands, especially when a working proof-of-concept (an industry term that refers to a working exploit that uses the vulnerability) accompanies the disclosure.<\/p>\n Fortunately, we can do more than just speculate about potential danger. Looking at how these vulnerabilities are used in the real-world can give us a better understanding of the risks involved with different types of disclosure.<\/p>\n The group exploiting this new pair of vulnerabilities is known by many names<\/a> \u2013 including APT28 and Fancy Bear<\/em>. But we are going to refer to them as STRONTIUM, which is how Microsoft refers to them.<\/p>\n STRONTIUM is also behind the breach of multiple American politics groups and figures including the Democratic National Committee and former Secretary of State Colin Powell. In fact, \u201cMicrosoft has attributed more 0-day exploits to STRONTIUM than any other tracked group in 2016.\u201d<\/p>\n Groups that want to use zero-days can either purchase them \u2013 security firms will run \u201cbounties\u201d for zero-days that affect popular platforms and pay upwards of a million dollars<\/a> for a single one \u2013 or try to discover them on their own, which can take hundreds of hours of research. Either method is extremely expensive.<\/p>\n Like other expensive weapons, hacking groups use zero-days sparingly. The more a vulnerability is used, the more likely someone will notice. No one is trying to phish grandma with a zero-day Flash exploit. It\u2019s wasting a big bomb on a small target. National governments are one of the biggest purchasers of zero-days and they usually use them to attack pre-determined targets, usually political enemies\/activists.<\/p>\n