When it comes to cyber attacks, hacks, and data breaches, it seems like the world is always on the defensive. The bad actors invariably seem to be one step ahead. Sure, the good actors catch up, patch up, and fix problems. Bad actors get caught and put in jail. But they are slippery! I suppose that is to be expected for “entities” that lurk in a digital world. I’ve seen “Tron” and The Matrix” series.
It turns out; even the bad actors can foul something up. The most recent example comes from an article from that source of all things hack, The Hacker News. I love these articles when they get deep into the weeds about how something works. I confess that code is not my thing, not for lack of trying. To quote Oddball from the outstanding movie, “Kelly’s Heroes.” In one scene, Oddball who is played by Donald Sutherland is sitting under a tree, eating bread and drinking wine while his crew works to repair their broken Sherman tank. Kelly, played by Clint Eastwood, is upset and asks why he doesn’t help. Now for the applicable quote, “Hey man, I don’t know how these things work. I just ride them.” That’s me and code.
Back to the hack. A bad actor purposively or accidentally uploaded a proof of concept malware program to the website, VirusTotal. It consisted of a corrupt PDF file with the code that did not deliver an attack. It just executed the code to make sure it worked. Researchers at ESET discovered it and sent it to Microsoft, “as a potential exploit for an unknown Windows kernel vulnerability." (Part of the lingo I love.)
In this case, the discovery gave both Microsoft and Adobe time to patch the vulnerability in their respective software before the actual malware appeared “in the wild.” With patches delivered in May, Microsoft gave the okay to release the news of the exploit on 2 July.
The theory of operation was that the malicious code took advantage of a weakness in the Microsoft code to gain high-level access to the PC. It then attacked Adobe Acrobat and Reader to gain even greater administrative control. The researchers stated that the code exhibited a remarkable level of ability to identify code weaknesses and could have been a very nasty bit of malware.
We have written about the delays in letting the public know about malware and other attacks. It seems a disservice at times, but in cases like this, it allows the software companies to steal a march on the bad actors. The lesson to be learned by the billions of regular computer users around the world is simple, always patch your software, use a reliable anti-virus program, and practice safe internet habits.
Also, for the best defense of your data, privacy, and anonymity, encrypt your data and communications. CRIP.TO offers the most secure communications platform available to individuals, groups, and companies. You deserve the freedom to communicate fearlessly. See how CRIP.TO can make that a reality.