Good and bad news for victims of targeted attacks against Microsoft products

Posted by   Virus Bulletin on   Nov 6, 2013

Bug bounty program extended; TIFF zero-day used in the wild.

This week, Microsoft has good news and bad news for those targeted by zero-day exploits in its products.

The bad news is that a new zero-day exploit has been discovered in a graphics library that is used by Office 2010. To exploit the vulnerability, an attacker has to send the victim an Office document that contains a specially crafted TIFF image. The exploit is believed only to work on systems running Windows XP or Windows Server 2003.

Microsoft says it is aware of the exploit being used in targeted attacks "largely in the Middle East and South Asia". Meanwhile, Alienvault's Jaime Blasco has more details on the exploit being used against Pakistani targets.

A patch for the vulnerability, which has been given identifier CVE-2013-3906, is not yet available, but Microsoft has released a Fix it. It also recommends deploying the Enhanced Mitigation Experience Toolkit (EMET). (Those who saw Jarno Niemela's VB2013 presentation will know that EMET is an effective defence against most targeted attacks.)

But there is also good news for those who fall victim to zero-day exploits: they may be eligible to receive money in Microsoft's bug bounty program.

Microsoft was rather late in joining the game of awarding bug bounties to those who discover vulnerabilities in its software, but when it did introduce a bug bounty program earlier this year, it promised to award up to US$100,000 for those who found novel exploitation techniques against its latest operating system. (And the company has actually awarded a researcher the maximum amount.)

Microsoft will now extend the program to include those who discover these techniques being used in the wild. So if you are a victim of such an attack, or you are investigating one, and you tell Microsoft how it is done, you could earn a whopping US$100,000. Moreover, if you also submit a "qualifying defence idea", you could be eligible for another $50,000.

Writing about the program, Microsoft Senior Security Strategist Katie Moussouris says:

"We want to learn about these rare new exploitation techniques as early as possible, ideally before they are used, but we'll pay for them even if they are currently being used in targeted attacks if the attack technique is new - because we want them dead or alive."

CVE-2013-3906 won't be the last time a vulnerability in a Microsoft product is exploited in the wild prior to being known about by the company and, like many of its infamous predecessors, we can expect it to find its way into cybercrooks' toolkits. But with this new bounty program, Microsoft has demonstrated that it really wants to make sure that those who follow best practices are exposed to these vulnerabilities for as short a time as possible. And for that it deserves full praise.

Posted on 06 November 2013 by Martijn Grooten

twitter.png
fb.png
linkedin.png
hackernews.png
reddit.png

 

Latest posts:

VB2019 paper: Operation Soft Cell - a worldwide campaign against telecommunication providers

Today we publish the VB2019 paper by Cybereason researchers Mor Levi, Amit Serper and Assaf Dahan on Operation Soft Cell, a targeted attack against telecom providers around the world.

VB2019 paper: A study of Machete cyber espionage operations in Latin America

At VB2019 in London a group of researchers from the Stratosphere Lab at the Czech Technical University in Prague presented a paper in which they analysed and dissected the cyber espionage activities of an APT group in Latin America through the…

VB2019 paper: The push from fiction for increased surveillance, and its impact on privacy

In a paper presented at VB2019 in London, researchers Miriam Cihodariu (Heimdal Security) and Andrei Bogdan Brad (Code4Romania) looked at how surveillance is represented in fiction and how these representations are shaping people's attitudes to…

VB2019 paper: Oops! It happened again!

At VB2019 in London industry veterans Righard Zwienenberg and Eddy Willems took a detailed look at the relationship between past and current cyber threats. Today, we publish both their paper and the recording of their presentation.

Job vacancy at VB: Security Evangelist

Virus Bulletin is recruiting for a person to be the public face of the company

We have placed cookies on your device in order to improve the functionality of this site, as outlined in our cookies policy. However, you may delete and block all cookies from this site and your use of the site will be unaffected. By continuing to browse this site, you are agreeing to Virus Bulletin's use of data as outlined in our privacy policy.