After observing attacks on customers , Cisco is telling users to i nstall Vulnerability-related.PatchVulnerability the fix for a recently disclosed denial-of-service flaw a ffecting Vulnerability-related.DiscoverVulnerability a number of its security appliances . The flaw , t racked as Vulnerability-related.DiscoverVulnerability CVE-2018-0296 , was detailed in an advisory on June 6 and a ffects Vulnerability-related.DiscoverVulnerability Cisco ASA Software and Cisco Firepower Threat Defense ( FTD ) Software . `` Cisco strongly recommends that customers u pgrade Vulnerability-related.PatchVulnerability to a fixed software release to r emediate Vulnerability-related.PatchVulnerability this issue , '' Omar Santos of Cisco 's Product Security Incident Response Team w arned Vulnerability-related.DiscoverVulnerability on June 22 . The attacks follow the publication of proof-of-concept exploits for the flaw . Santos n otes Vulnerability-related.DiscoverVulnerability that a unauthenticated , remote attacker could cause a device to reload unexpectedly and cause a denial-of-service ( DoS ) condition . Additionally , an exploit could cause a DoS or unauthenticated disclosure of information . However , Santos said : `` Only a denial-of-service condition ( device reload ) has been observed by Cisco . '' Cisco h as also updated Vulnerability-related.PatchVulnerability the advisory for CVE-2018-0296 with details about the attacks . The researcher who f ound Vulnerability-related.DiscoverVulnerability the flaw , Michał Bentkowski from Polish security firm Securitum , gave a brief description of the root cause in a tweet shortly after Cisco d isclosed Vulnerability-related.DiscoverVulnerability the bug . Bentkowsky r eported Vulnerability-related.DiscoverVulnerability the issue to Cisco as a way to use directory-traversal techniques to disclose information to an unauthenticated attacker . Cisco labeled its primary impact as a DoS condition , but said it is possible that on certain releases of ASA a device reload would not occur , yet still allow an attacker to use directory-traversal techniques to view sensitive system information . Bleeping Computer i dentified Vulnerability-related.DiscoverVulnerability two proof-of-concept exploits for CVE-2018-0296 on GitHub . One attempts to e xtract Attack.Databreach user names from Cisco ASA . The other states : `` If the web server is vulnerable , the script will dump in a text file both the content of the current directory , files in +CSCOE+ and active sessions . ''

For weeks , perhaps months , hackers could take control of a victim 's ' computer , or install malware on it , just by tricking them into opening a booby-trapped document , thanks to a critical `` zero-day '' bug in most versions of Microsoft Word . When bugs a re unknown Vulnerability-related.DiscoverVulnerability to the vendor , and s till unpatched, Vulnerability-related.PatchVulnerability they 're called zero-days . That 's their value : they will work no matter what , as there 's no fix for them . Criminal hackers , as well as hackers working for governments , sometimes use zero-days , but it 's rare for the same zero-day exploit to be used by both groups . Somehow , however , that 's what happened with that Microsoft Word zero-day . The exploit was used by government hackers , likely inside Russia , to target victims and infect them with the infamous FinFisher spyware since at least late January . The same exploit , according to security firm FireEye , was also used by a criminal gang spreading malware known as Latentbot in March . To add even more mystery to the mix , it appears that multiple researchers independent of each other f ound Vulnerability-related.DiscoverVulnerability the original bug on which the exploit was developed . When Microsoft p atched Vulnerability-related.PatchVulnerability it on Tuesday , it credited three researchers , as well as its own internal teams . That 's not unheard of , but as a recent study pointed out , it 's rare for different teams or researchers to find the same bug , something that 's known as `` bug-collision . '' Ryan Hanson , a security researcher , c laimed Vulnerability-related.DiscoverVulnerability in a tweet that he o riginally found Vulnerability-related.DiscoverVulnerability it in July and d isclosed Vulnerability-related.DiscoverVulnerability it to Microsoft in October . Hanson did not respond to a request for comment , but Motherboard was able to confirm this timeline . For some reason , however , Microsoft did n't p atch Vulnerability-related.PatchVulnerability it until this week . ( For example , previous office bugs f ound Vulnerability-related.DiscoverVulnerability by Google Project Zero g ot patched Vulnerability-related.PatchVulnerability within 90 days . ) The company said in a statement that they heard of a `` small number '' of targeted attacks in the wild using the exploit `` approximately one month ago , '' and added that there were no widespread attacks until McAfee d isclosed Vulnerability-related.DiscoverVulnerability the bug publicly last Saturday . `` This was a complex investigation that took time to thoroughly investigate and patch , '' a Microsoft spokesperson told Motherboard . `` We performed an investigation to identify other potentially similar methods , and ensure that o ur fix addresses Vulnerability-related.PatchVulnerability more than just t he issue reported. Vulnerability-related.DiscoverVulnerability `` It 's unclear who developed the exploit used to spread FinFisher and Latentbot , but it 's possible that the same developer sold it to both groups . `` I think whoever sells to FinFisher also does blackmarket business , '' said John Hultquist , a researcher at FireEye . `` Talent , tools , and techniques move between espionage , criminal , and hacktivist worlds . '' As the CEO of Hacking Team , a company that used to buy zero-day exploits , once said , `` exclusive zero-days do n't exist . '' `` Talent , tools , and techniques move between espionage , criminal , and hacktivist worlds . '' A source who works in the surveillance technology industry said that FinFisher buys exploits from private researchers as well as from Zerodium , a well-known exploit seller . The source , who asked to remain anonymous , said FinFisher recently offered access to an exploit subscription portal that seemed similar to what Zerodium 's predecessor , Vupen , used to offer . Zerodium 's founder Chaouki Bekrar declined to comment . ( FinFisher did not respond to a request for comment . )

For weeks , perhaps months , hackers could take control of a victim 's ' computer , or install malware on it , just by tricking them into opening a booby-trapped document , thanks to a critical `` zero-day '' bug in most versions of Microsoft Word . When bugs a re unknown Vulnerability-related.DiscoverVulnerability to the vendor , and s till unpatched, Vulnerability-related.PatchVulnerability they 're called zero-days . That 's their value : they will work no matter what , as there 's no fix for them . Criminal hackers , as well as hackers working for governments , sometimes use zero-days , but it 's rare for the same zero-day exploit to be used by both groups . Somehow , however , that 's what happened with that Microsoft Word zero-day . The exploit was used by government hackers , likely inside Russia , to target victims and infect them with the infamous FinFisher spyware since at least late January . The same exploit , according to security firm FireEye , was also used by a criminal gang spreading malware known as Latentbot in March . To add even more mystery to the mix , it appears that multiple researchers independent of each other f ound Vulnerability-related.DiscoverVulnerability the original bug on which the exploit was developed . When Microsoft p atched Vulnerability-related.PatchVulnerability it on Tuesday , it credited three researchers , as well as its own internal teams . That 's not unheard of , but as a recent study pointed out , it 's rare for different teams or researchers to find the same bug , something that 's known as `` bug-collision . '' Ryan Hanson , a security researcher , c laimed Vulnerability-related.DiscoverVulnerability in a tweet that he o riginally found Vulnerability-related.DiscoverVulnerability it in July and d isclosed Vulnerability-related.DiscoverVulnerability it to Microsoft in October . Hanson did not respond to a request for comment , but Motherboard was able to confirm this timeline . For some reason , however , Microsoft did n't p atch Vulnerability-related.PatchVulnerability it until this week . ( For example , previous office bugs f ound Vulnerability-related.DiscoverVulnerability by Google Project Zero g ot patched Vulnerability-related.PatchVulnerability within 90 days . ) The company said in a statement that they heard of a `` small number '' of targeted attacks in the wild using the exploit `` approximately one month ago , '' and added that there were no widespread attacks until McAfee d isclosed Vulnerability-related.DiscoverVulnerability the bug publicly last Saturday . `` This was a complex investigation that took time to thoroughly investigate and patch , '' a Microsoft spokesperson told Motherboard . `` We performed an investigation to identify other potentially similar methods , and ensure that o ur fix addresses Vulnerability-related.PatchVulnerability more than just t he issue reported. Vulnerability-related.DiscoverVulnerability `` It 's unclear who developed the exploit used to spread FinFisher and Latentbot , but it 's possible that the same developer sold it to both groups . `` I think whoever sells to FinFisher also does blackmarket business , '' said John Hultquist , a researcher at FireEye . `` Talent , tools , and techniques move between espionage , criminal , and hacktivist worlds . '' As the CEO of Hacking Team , a company that used to buy zero-day exploits , once said , `` exclusive zero-days do n't exist . '' `` Talent , tools , and techniques move between espionage , criminal , and hacktivist worlds . '' A source who works in the surveillance technology industry said that FinFisher buys exploits from private researchers as well as from Zerodium , a well-known exploit seller . The source , who asked to remain anonymous , said FinFisher recently offered access to an exploit subscription portal that seemed similar to what Zerodium 's predecessor , Vupen , used to offer . Zerodium 's founder Chaouki Bekrar declined to comment . ( FinFisher did not respond to a request for comment . )