Google's Project Zero recently announced that hackers have been actively exploiting a Windows zero-day vulnerability. It reported seven active bugs.

Project Zero the bug-hunters

In 2014, Google set up Project Zero, a team of top-notch bug-hunting and security researchers to find and disclose security flaws or bugs in the world’s software.

“Our mission is to make the discovery and exploitation of security vulnerabilities more difficult and to significantly improve the safety and security of the Internet for everyone.” 

"We perform vulnerability research on popular software like mobile operating systems, web browsers, and open source libraries. We use the results from this research to patch serious security vulnerabilities, to improve our understanding of how exploit-based attacks work, and to drive long-term structural improvements to security," according to Project Zero in a blog. 

In the last 6 years, researchers at Project Zero have helped find and fix almost 2000 vulnerabilities in some of the world’s most widely-used and popular software. 

With the number of hacks increasing, the security researchers have their work cut out for them. 

When Project Zero finds a security flaw they typically give Microsoft a seven-day deadline to patch the vulnerability.  Project Zero typically does a public disclosure after 90 days or when a “fix” is developed, whichever happens first.

The active exploits are disclosed

The bug disclosure last month came prior to a patch being available. 

Project Zero announced that “ We have evidence that the following bug is being used in the wild. In other words, hackers were currently using the bugs to hack some current Windows users. Therefore, this bug is subject to a 7-day disclosure deadline.”

“The Windows Kernel Cryptography Driver (cng.sys) exposes a \Device\CNG device to user-mode programs and supports a variety of IOCTLs with non-trivial input structures,”  the Project Zero post said. “It constitutes a locally accessible attack surface that can be exploited for privilege escalation (such as sandbox escape).”

Shane Huntley, Director of Google’s Threat Analysis Group was quick to announce that, “that this is targeted exploitation and this is not related to any US election-related targeting.”

As the vulnerability, CVE-2020-17087 was tracked it became clear that it allowed attackers to escalate and obtain system privileges. This security bug only affected Windows 7 and Windows 10. 

The hack attackers were using a combination of two exploits which targeted a previously patched flaw in Chrome. This allowed the first malicious exploit to escape a security sandbox in order to allow the second to execute code on vulnerable machines.

Microsoft patched the bug got 

Project Zero technical lead Ben Hawkes explained that the disclosure was made early in order to protect existing users who were being exploited.

The short deadline for in-the-wild exploit may serve as an incentive for the development of “out-of-band patches” or other mitigations being more quickly developed and shared.

On November 10, Microsoft provided security updates for all impacted Windows platforms on the MSRC (Microsoft Security Response Center) portal.

In the meantime, there is no information on who was attacked in the active exploit. "We're not going to be able to offer much new info," Google spokesperson Scott Westover said.

----------------------------------------

Have a story you want USA Herald to cover? Submit a tip here and if we think it's newsworthy, we'll follow up on it.

Want to contribute a story? We also accept article submissions – check out our writer's guidelines here.