This vulnerability is largely being called “probably the widest impact in the history of Windows,” making it quite a big deal indeed. Yang Yu, a security researcher at Tencent’s Xuanwu Lab, is the one responsible for finding the bug, and his actions in doing so were rewarded handsomely; he’s one of the few who have managed to earn more than $100,000 through Microsoft’s “bug bounty” program, and the discovery of BadTunnel netted him a modest $50,000.
Forbes reports: “This vulnerability can be exploited through Edge, Internet Explorer, Microsoft Office and many other third-party software on Windows. It can also be exploited through web servers … or even through thumb drives – insert the thumb drive into one of the ports on the system and the exploitation is complete.”
Perhaps the most disconcerting thing about this vulnerability is that it’s left Windows PCs vulnerable to attacks for the past 20 years. A successful exploit of the flaw can spoof connections over NetBIOS that allows computers to communicate with one another over a local area network. Essentially, the hacker could route traffic on a user’s Windows PC to their own. Forbes explains further: “Not only could the hacker spy on non-encrypted traffic, they could intercept and tamper with Windows Update downloads. And they could inject further attacks in web pages visited by the victim. For instance, they could ensure that the “tunnel” between the target and the hacker would remain open by inserting code into web pages cached by the browser.”
But, fear not – a patch for BadTunnel was issued in Microsoft’s June 14th Patch Tuesday. However, not all businesses automatically deploy patches and updates, so communicate with your IT department to ensure that your business is protected from BadTunnel. If you ignore this vulnerability, there’s a chance that your Windows PCs could be monitored and controlled remotely by malicious entities. You can view the official Microsoft security bulletin here.
Yu believes this vulnerability to be the first of its kind, and it’s understood that Windows users should update as soon as possible. Yet, some users, like those who have Windows XP (still), will be out of luck. In these circumstances, researchers have recommended disabling NetBIOS over TCP/IP. However, it might just be easier, and more secure, to just upgrade to a supported operating system. Whatever you decide to do, Aspire has your back.
Yu plans to discuss the finer details of BadTunnel later this month at the 2016 BlackHat Conference in Las Vegas, July 30th through August 4th.
For more technology news and security tips, reach out to Aspire at (469) 7-ASPIRE.
