Hackers exploited Word flaw for months while Microsoft investigated

Re:Hackers exploited Word flaw for months while Microsoft in... by HenryBemis on Thursday April 27, 2017 @03:20AM (#14209797)

I thought that it is the norm for M$ to hand out the zero-days to the 3-letter-agencies for "a while" and patches them ONLY when someone else gets hold and starts using the same vuln.. so it makes PERFECT sense that they would do something like that.

Also who in their right mind allow Word/Excel/Powerpoint to access the internet? (oh yes it's called "365" and it makes software, that is completely unfit for the task, to access the internet)

[ Parent | on HN ]

Re:Hackers exploited Word flaw for months while Microsoft in... by HappyTypist on Thursday April 27, 2017 @05:03AM (#14210153)

Not sure why you're being downvoted. This is literally the company that built in "_NSAKEY" into the kernel, which is still present (just called "_KEY2" now.

[ Parent | on HN ]

Re:Hackers exploited Word flaw for months while Microsoft in... by repples on Thursday April 27, 2017 @03:07PM (#14213918)

If "_key2" is an public key embedded within Windows, then presumably there exists one or more holders of the private key somewhere - what exactly are they able to do with this key?

I've seen a lot of concern about "_key2" and "_NSAKEY" being expressed over the years, but scant technical detail.

[ Parent | on HN ]

Re:Hackers exploited Word flaw for months while Microsoft in... by kevingadd on Thursday April 27, 2017 @06:24AM (#14210442)

Putting some sort of security backdoor or snooping feature into your software (likely by government order) is pretty different from 'M$ gives 0days to spy agencies and delays fixing them'. _NSAKEY, whatever it is, doesn't resemble the situation the original article is describing.

[ Parent | on HN ]