Technology

Microsoft releases Zero-Day bug fix and patches a vulnerability affecting over 400 million users

Microsoft is one of the biggest companies in the entire world. It has been one for a long time now. The reach of Microsoft is as large as the whole world. Personal Computers on which the world runs was brought to us by Microsoft. It has a bunch of other services to offer as well. Microsoft Outlook, Microsoft Office, OneNote, and many more things.

Some of these features are world runners as well. Microsoft Office is one such feature which is exploited in the whole world. The outlook feature dominates the official emailing systems and OneNote is a sweetheart for researchers and students alike. Apart from this Microsoft’s Surface laptops and tablets are immaculate in design as well.

However, even after being such a huge company with so many world-renowned features, its operating systems keep struggling from attackers from all around the world. Windows 7 and Windows 10 are the most stable operating systems out there at the moment but are not out of sight from the attackers. For this, Microsoft has a Patch Tuesday.

Microsoft regularly releases security patches for its software products spread across the world. Patch Tuesday occurs on the second or the fourth Tuesday of the month. The most recent Patch Tuesday was yesterday when they fixed the Zero-Day bug. The Zero-Day bug was a lethal bug which was discovered a few months back.

The bug could log onto the system and then could run applications which were specially created to take charge of the system. Along with this they also fixed 30 flaws which were rated ‘very important’. Those flaws affected Internet Explorer, Microsoft Windows, Office, and many of the web applications. The information about these vulnerabilities is welcomed by Microsoft as they allow them to improve the current software.

Apart from this, there was another weakness which was reported to Microsoft by Safetydetective.com. Sahad NK, a security researcher, informed Microsoft of multiple vulnerabilities which were extremely dangerous when chained together. According to the blog of Safetydetective.com, there were two flaws which, when combined, could open the door to information of around 400 million users.

The first flaw was a defunct subdomain in the name of success.office.com. This was affiliated to Microsoft Azure Web Application service that is not available anymore. The researchers were able to win over this sub-domain and control the data that was being sent to it. They could also control the whole domain. The second flaw was a bit more dangerous as it was related to common services offered by the US-based company.

The second flaw allowed users to improperly authenticate Microsoft Outlook, Sway, and Store. The domain in the name of ‘wreply’ URL, allowed the researchers to get tokens of sorts. These tokens could help the attackers log in as the user itself without any requirement of the credentials. These vulnerabilities were highly important to fix.

Sahad NK and his team contacted Microsoft in June and they worked with the tech giant to fix these flaws. These flaws were fixed in November 2018. Such kind of platform is awarded by all the major companies like Facebook, Microsoft, and Google. However, when one such patch is released on Tuesday, Exploitation Wednesday is the day when people go back to finding vulnerabilities. This keeps the systems safe and improvements are being made all the time.

– Unmesh Phule

Comment here