Microsoft's Windows 10 is suffering from a serious security issue, according to a new report.
A security researcher who goes by the handle SandboxEscaper published code to GitHub that allegedly shows how a malicious hacker can gain higher privileges on a Windows 10 machine and wreak havoc. The security vulnerability was earlier reported on by ZDNet.
The zero-day vulnerability is what's called a "local privilege escalation." That means that the vulnerability won't necessarily allow hackers to gain access to your machine. Instead, the vulnerability, when exploited, will give them more control over your machine after they've already hacked it by upping their privileges to administrators.
According to ZDNet, which saw the vulnerability in action, SandboxEscaper discovered the vulnerability in Microsoft's Windows Task Scheduler. Hackers can create a malicious .job file to dupe the Task Scheduler to change the user's permissions. In doing so, it effectively gives the hacker administrator privileges over the entire machine and the opportunity to do what they want on the computer.
Interestingly, the hack has only been shown to work on 32-bit Windows 10 versions. However, the security researcher told ZDNet that some tweaks in the hack could allow it to target computers running everything from Windows XP to Windows 10. Whether that will actually happen, however, is unknown.
The problem with zero-day vulnerabilities, of course, is that you don't really have any way of protecting yourself until Microsoft patches the bug. And until that time, hackers could conceivably find the problem and target users.
It's unclear whether the Windows 10 vulnerability has been exploited in the wild. SandboxEscaper is known for revealing vulnerabilities before telling Microsoft. It's unknown when, or even if, Microsoft will respond with a patch, though the company's next Patch Tuesday is scheduled for June 11.
