Microsoft’s lethargic Tuesday: Security patch timeline comes under scrutiny

Attackers favoring flaws in Microsoft products, new research indicates

Microsoft’s Patch Tuesday didn’t fail to deliver this month, with the tech company releasing a total of 66 security updates amid reports of it being slow on delivery.

Fixes for 24 of the bugs were rated as critical, including a patch for an issue first identified in March related to unwarranted access of Windows systems.

An attacker here could exploit the CVE-2018-1038 vulnerability to takeover a machine and run programs under a user’s credentials, stealing or changing data as well.

Other updates included a hardware patch for a Microsoft wireless keyboard, which attackers could leverage to gain access to passwords by reusing the device’s encryption key.

Vulnerability CVE-2018-0950 was also met with a much needed fix – a Microsoft Office problem that essentially gave away a user’s information when they opened an attachment in Rich Text Format (RTF).

This bug was first identified in 2016.

All of these much-needed security updates come as a new report by Recorded Future showed how seven of the top 10 most exploited vulnerabilities in 2017 were found within Microsoft products.

At least two of these vulnerabilities, the report said, were critical – meaning that threat actors could run malicious code, alongside gaining access to user’s data, with ability to change the information.

The most exploited vulnerability last year was CVE-2017-0199 – a bug present in Microsoft Word and WordPad that was first exploited by assailants in January 2017, when the company initially tried to resolve the issue.

This flaw, which also made use of an RTF exploit through opened attachments, made headlines after it was taken advantage of in order to put Russian individuals and university employees in Israel under surveillance, Reuters reported.

A possible delay in patching paired with the level of communication provided to ensure that updates were implemented also came into question.

Recorded Future said that Microsoft, most typically, left users exposed until vulnerabilities began to appear on the dark web, after which time it would release a patch.

The report stated that the pervasiveness of Adobe bugs in previous years – hitting the majority of the top ten in both 2015 and 2016 - was being replaced by Microsoft’s vulnerabilities due to the company’s slow response but also the decline of products like Flash.