Russian hacking group attacked Microsoft and Adobe systems. Google’s security team revealed the attack, and now Microsoft strikes back on them.
Microsoft confirmed today that a hacking group, previously linked to Putin’s regime in Russia and to some US political hacks, attacked some Windows users earlier this month. Microsoft claim in an advisory on its website, that there had been a small number of attacks using “spear phishing” emails from a hacking group named Strontium, known also as Fancy Bears.
Microsoft didn’t identify any victims yet and said that a patch to protect Windows users against the newly discovered threat will be released next week, on Nov 8, which is also the election day in the US. It was not clear whether the Windows vulnerability had been used in any of the recent U.S. political hacks, but the hacker group Fancy bear, which accused to be the one to create the attack, are known by working for, or on behalf of Russia’s military intelligence agency, the GRU. The US intelligence officials have already concluded that GRU were responsible for hacks of Democratic Party databases and emails.
But it’s seems that Microsoft main frontline today is not against the Russians hackers, but against his worst rival Google. The bug that can give the hackers full control, first revealed accidently by Google’s security team, that announced on Monday about first discovering of “zero day” bugs (very unique bugs that never seen before) in Microsoft and Adobe flash systems. Adobe addressed the issue just 5 days after Google first notice, and released an update to its Adobe Flash Player that repair it, while Microsoft had yet to issue a fix, and therefore Google went it public.
Microsoft has a lot of criticism against Google’s decision to make the issue public. In a statement sent to the media, the company confront Google: “We disagree with Google’s characterization” they said “as ‘critical’ and ‘particularly serious’, since the attack scenario they describe is fully mitigated by the development of the Adobe Flash update released last week”. Terry Meyerson, EVP of Microsoft’s Windows and devices group was even more decisive against Google and wrote in a blog post “Google's decision to disclose these vulnerabilities before patches are broadly available and tested is disappointing, and puts customers at increased risk".
Google disclosed the flaw on Monday, following its standing policy of going public seven days after discovering "critical vulnerabilities" that are being actively exploited by hackers. Google gives software companies 60 days to patch less serious bugs.
Despite Microsoft announcements, some experts are still believe the bug could still be exploited while users wait for a Microsoft update. Security researcher Katie Moussouris said “The bag could be used as part of a larger attack to take control of the entire system”.
For now, if they want to be protected, Microsoft users should ensure auto updates are turned on for Flash, Windows and Antivirus software.