NSA Reports Major Windows 10 Flaw to Microsoft, Patch Coming Today
It’s “Patch Tuesday” for Microsoft, and this is an important one. Not only is this the end of the road for Windows 7, but Microsoft is releasing a major fix for Windows 10 thanks to the National Security Agency (NSA). The NSA reportedly uncovered a serious flaw in Windows 10, and it took the unusual but welcome step of telling Microsoft about it.
Despite its name, the NSA is not aimed at improving security for the general public. Its goal of gathering intelligence and monitoring national communication networks is not served by patching vulnerabilities when it can weaponize them instead. That’s why, traditionally, the NSA keeps these security holes a secret so it can use them against targets.
The vulnerability affects the way Windows 10 verifies digital signatures. That could allow a malicious software package to masquerade as a legitimate installer without tripping any alarms. Thus, someone could leverage the bug to remotely install malware and give it access to the entire system. From the NSA’s perspective, that’s a useful tool for cyberespionage, provided your target is using Windows 10. There’s a reasonable chance they will be, considering Windows 10 is the most popular desktop operating system in the world.
People briefed on the matter liken this vulnerability to EternalBlue, a flaw that affected most versions of Windows until 2017. The NSA used EternalBlue to break into computers for five years, but then the tool found its way into the hands of other organizations. As a result, EternalBlue fueled major malware campaigns like the WannaCry and NotPetya ransomware outbreaks. While the new vulnerability isn’t as severe as EternalBlue (it only affects Windows 10), it could allow for similar attacks if it ever got out. Perhaps that’s why the NSA opted to alert Microsoft instead of trying to weaponize the flaw.
Microsoft should release the patch today for all Windows 10 users. We also expect a statement on the vulnerability, urging everyone to update as soon as possible. While it’s better than the NSA disclosed the flaw to Microsoft, it could still serve as the basis for online attacks if users don’t update their systems. The NSA claims there are no currently active exploits online that use this vulnerability, but that could change in an instant.
Continue reading
Xbox Series X Launch Is Microsoft’s Biggest Ever, Causes ISP Traffic Spike
Microsoft claims the Xbox Series X is its most successful debut in history and specifically calls out the Xbox Series S for bringing new players into the fold.
Microsoft: Bethesda Games ‘Either First or Better’ on Xbox, Not Exclusive
Microsoft's Tim Stuart doesn't think the company will try to cut PS5 gamers out of future Bethesda titles. The company wants Xbox to be the best destination for its games, but not the only one.
Microsoft: Pluton Chip Will Bring Xbox-Like Security to Windows PCs
Intel, AMD, and Qualcomm are working to make Pluton part of their upcoming designs, which should make PCs more difficult to hack, but it also bakes Microsoft technology into your hardware.
Apple: ‘It’s Up to Microsoft’ to Get Windows Running on New ARM Macs
According to Apple, the question of supporting Windows on the M1 is entirely in Microsoft's court.