Microsoft recently released a critical security update for a serious vulnerability found in Microsoft Secure Channel package. This is a built-in software and is available in all the modern Windows systems starting with Vista to the recent Windows 8.1 and other Windows server versions. This new critical vulnerability affects the secure network connections and allows an attacker to perform remote code executions.
Since the vulnerability is affecting almost all the Windows systems, it is rated as critical by Microsoft, and it is recommended to update your Windows system as soon as possible to stay secure and safe from any possible exploitations. In case you are wondering, this new bug in the Windows system is much like Heartbleed – a serious vulnerability found in OpenSSL which exposes the cryptographic keys and other sensitive information.
Note: Microsoft didn’t mention Windows XP, and there isn’t even a clear message to know if Windows XP is affected. If you are still using Windows XP, you are on your own as Microsoft is no longer providing any update for Win XP. It is a good idea to switch to Windows 7 (or later) or other operating systems like Mac OS X or Linux.
A Bug in Microsoft Secure Channel (Schannel)
For those of you who don’t know, Microsoft Secure Channel, or Schannel for short, is a software package used to secure and encrypt the network connections. It consists of its own standard SSL library comprising SSL and TLS cryptographic protocols to handle the encryption and cryptography. This same package is invoked whenever your browser, FTP, or any other software for that matter, is requesting a secure connection.
Due to the bug found in Schannel by a private research group, an attacker can carefully craft packets into deceiving your secure connection to execute remote code which can potentially compromise your Windows system. The recent security bulletin (MS14 – 066) confirms the same and you can find more details on the effected systems from the official update page (KB2992611). It’s worth noting that all the major SSL/TLS stacks like OpenSSL, GNUTLS, Microsoft Secure Channel and Apple Secure Transport were effected in the same year (2014) with some serious vulnerabilities.
What is Remote Code Execution
As the name implies, Remote Code Execution vulnerability in a software allows any attacker to execute malicious code to remotely access and modify your system without any physical access. In the worst case scenario, the attacker can take over your computer with elevated privileges.
Updating your Windows PC
Even though there are no reported attacks, it is always a good thing to update your Windows PC. If you have enabled automatic updates, then you can relax as Windows downloads and installs the update like any other Windows update. But if you didn’t set Windows to update automatically, you can update your system manually. To do that, open up your start menu, search for and open “Windows Update.”
Once you are there, click on the link “Check for Updates” in the left panel. Once you have done that, Windows will check for any possible updates, and you can install them by clicking on the “Install Updates” button.
That’s all there is to do. You have successfully updated your Windows system.
Conclusion
The vulnerability found in Windows is serious. Even though there are no known attacks using this exploit, it is always a good thing to update your Windows systems as soon as possible to be safe from online predators.
Hopefully that helps, and do comment below sharing your thoughts on this new vulnerability found in Microsoft Schannel.
Vamsi is a tech and WordPress geek who enjoys writing how-to guides and messing with his computer and software in general. When not writing for MTE, he writes for he shares tips, tricks, and lifehacks on his own blog Stugon.
Our latest tutorials delivered straight to your inbox
