TechTheDay

Bug fixes aren’t all that strange or uncommon. Software these days are released without being thoroughly tested by their makers, relying only on the reports and data they’re able to gather from their users. Eventually one of those users will accidentally find something in the product that will start causing problems. People will start reporting these bugs back to the developers and developers will release a patch to fix said bugs. Though some may find this distasteful because it seems that companies are selling products that may fail (which is what it is technically) we should also remember that the developers cannot test their software as thoroughly as they would like, which is why some companies hire test users. But even then some bugs will still manage to slip into the finished product.

And Microsoft is no stranger to these types of things. As one of the biggest tech companies in the world, selling the Windows OS and other software, such as their MS Office, they too have their fair share of bug fixes released from time to time.

Emergency Fix from Microsoft

Which brings us to this month as Microsoft released a security update for their Malware Protection Engine. According to Google’s Project Zero, there’s an unusual bug in Microsoft’s anti-malware software that could be exploited by hackers to take control of computers through the use of a single email. They can do this even without the recipient opening the mail by having anti-virus software, such as Microsoft’s built-in Windows Defender, and scan the contents for the exploit to be triggered. The discovery of the bug is credited to Google Project Zero’s researchers, Tavis Ormandy and Natalie Silvanovich.

Microsoft has been very fast with their response when it was reported and was able to get an emergency fix ready.

Just last April Microsoft also had to fix another zero day exploit, this time located in their Microsoft Word. The bug was reportedly targeted by scammers, enabling them to get the user’s banking logins, by using what’s called the Dridex malware. The Dridex malware is a form of malware specially designed to get the user’s banking information via Microsoft Word’s macros. It has been causing havoc since 2015, enabling a theft of $10 million in the United States. In September 2016 it has been found to be able to target crypto-currency wallets as well. The cybersecurity firm, Proofpoint, is credited for discovering the email campaign targeting the bug. Microsoft was able to rapidly respond to the discovery as well.

 

 

 

 

Also just this year, in February, Google researcher, Ivan Fratric, also discovered another malicious bug that could allow hackers to take over a user’s browser by building a website to make it crash. It was found since November last year but Google only made it public after the expiry of the 90-day deadline they gave Microsoft to fix it. The bug involves Internet Explorer 11 and Microsoft Edge browsers. It is caused by the way that both browsers handle the instructions to format some parts of web pages.

Microsoft didn’t comment on it directly but said that they’re talking with Google to extend their deadline. So far, there has been no accounts or evidence of malicious attacks using the bug Mr. Fratric has discovered. Microsoft also said they haven’t had made a patch yet that can remove the bug.

But since then Microsoft seems to have upped their game in light of the recent reveal by Wikileaks of their Vault 7 report in March this year. The Vault 7 report features zero-day exploits, malware, viruses and trojans that the CIA has been hoarding for their own use. It got leaked out and anyone who can get their hands on the leaked info can wield the full hacking power of the CIA against anyone they choose.