Microsoft Says Russian Hackers Exploited Flaw in Windows

Actively exploited: 7 days.

Generally: 90 days.

There are probably other caveats, but they're not interesting here.

Way to go, Google.

I'm not asking snidely. I legit want to know how this is leveraged in defense and what/how I can do.

Is it common practice in the pre-patch period to enable some sort of system call tracing that monitors for (and/or kills) processes that use the vulnerable call in a way described by the google blogpost? Or is there a sandboxing solution where I can blacklist filter certain uses of system calls?

Who is "you"? Do you realistically think the hundred of millions of Windows Servers out there are actively managed by a team of security experts who have the expertise to go under the skin of new security vulnerabilities in a matter of hours and deploy a mitigating strategy?

You might have actively looked into the technique used, understood it, and done something to mitigate it. What about the hundred of millions of Windows servers that rely on monthly updates for security patches, maintained by IT teams that do not have the resources or expertise to investigate every MSFT security bulletin in detail. They will become sitting ducks. Is that a good outcome?

In my mind it is a rhetorical question.

"a reused command-and-control address—176.31.112[.]10—that was hard coded in a piece of malware found both in the German parliament as well as on the DNC’s servers. Russian military intelligence was identified by the German domestic security agency BfV as the actor responsible for the Bundestag breach. "

Also, occam's razor.

Then how about these: because Iraq was framed as having WMDs, then the Titanic was actually the Olympic rebadged and sunk as insurance fraud. The Moon? Man didn't walk on it, that's just an American lie because no WMDs. It's also a hologram, because Iraq didn't have WMDs!

What Snowden confirmed was more the scale. The details honestly shouldn't have been terribly surprising for anyone who had followed computer news for the last decade, unfortunately.

As far as Russia hacking the DNC is concerned, what I know is there are several cybersecurity companies that have confirmed that Russian hackers were involved, publishing white papers with a fair bit of evidence. I personally haven't seen a single cybersecurity company so far refute that information.

I do welcome a technical refutation of the white papers or a point to a cybersecurity company that disagrees! Counterpoints however have to be data-oriented to be interesting. I consider random commentators posturing that all this is just US propaganda with little evidence to be merely cheerleading, sorry, that's not interesting to me...

Your premise is wrong - there is a need. The details can be used to create signatures for anti-malware software and IDSes by 3rd parties who are nimbler than Microsoft.

Additionally, there is more to be worried about than just workarounds: some organisations do full-take packet capture archiving and might be interested to know if they were hacked via this flaw (retrospectively) before (more) data is exfiltrated, the sooner they are made aware of an actively-exploited bug, the better.

> ... If they don't, everybody has to wait for Microsoft anyway, but the malware authors get one now famous 0-day

Wrong again: there is no need to wait for Microsoft for the reasons I mentioned above. Before this, only the bad guys knew about the exploit, now the good guys also know about it and may work to mitigate it. We have no idea how well-known this exploit was in underground forums, so it is hard to quantify how many more bad guys know it for certain.

They already had that. That's what active exploitation means. It's not a 0-day after it's known.

> And that is only in the interest of Google, not the customers.

Sure. Just like newspapers report misconduct and it's only in the interest of themselves, not their customers. You seem to be under the impression that companies will endeavor to fix the problems as quick as possible no matter what, and that public exposure won't change that timeline at all. History tells a different story

Edit for your edit:

> 0-days are carefully guarded and have high price.

They are carefully guarded because every use risks discovery of the exploit which reduces its value. Being identified in the wild to the level seen here, or at least to the degree of importance here, indicates that the can't already out of the bag. You can assume being used in a high level attack like this effectively eliminates it as a zero day at some point, as forensics will be done. I wouldn't be surprised if the exploit was dumped to the general malware public as soon as the hack was made public, which also helps to obscure the origin slightly.

> The moment Google publishes the details, the whole malware community has an access to something that is provably 0-day working exploit. The difference is huge, more orders of magnitude, up to every script kiddie.

You act like we can reliably make predictions about what will happen if not released. It's entirely possible it could, would or has been dumped to the greater malware community already, and not releasing the details will just allow those same script kiddies access to a populace that hasn't had a chance to mitigate the attacks.

When presented with the option to keep information about danger to the greater populace secret or take it live when taking it live allows people to take their own actions to protect themselves, you take it live. Preventing people from taking their safety into their own hands by hoarding the information is immoral. It actively prevents them from protecting themselves.

Long term, it's in the interest of the customers as well - that's the only way to encourage ocmpanies to be releasing fixes sooner!