The technical details of security vulnerabilities impacting Vulnerability-related.DiscoverVulnerability the Nvidia Video and an Android driver have been revealed Vulnerability-related.DiscoverVulnerability by Zimperium , which acquired the flaws as part of an exploit acquisition program . On Tuesday , Zimperium zLabs researchers published Vulnerability-related.DiscoverVulnerability a blog post detailing the security flaws , two escalation of privilege bugs found Vulnerability-related.DiscoverVulnerability within the NVIDIA Video driver and MSM Thermal driver . The Nvidia bug , CVE-2016-2435 , impacts Vulnerability-related.DiscoverVulnerability Android 6.0 on the Nexus 9 handset . The problem arises Vulnerability-related.DiscoverVulnerability when attackers craft an application to tamper with read/write memory values and force privilege escalation . The second security flaw , CVE-2016-2411 , involves Vulnerability-related.DiscoverVulnerability a Qualcomm power management kernel driver , the MSM Thermal driver , in Android version 6 . If an attacker crafts a malicious application , they can give themselves root access through an internal bug in the driver , leading to privilege escalation . These bugs are well documented Vulnerability-related.DiscoverVulnerability , known Vulnerability-related.DiscoverVulnerability , and for the most part security updates have been issued Vulnerability-related.PatchVulnerability . However , Zimperium says Vulnerability-related.DiscoverVulnerability that making the technical details available of these so-called Vulnerability-related.DiscoverVulnerability `` N-day '' flaws is important and can act as a catalyst to boost the speed of patch production and to iron out problems arriving between a patch being created Vulnerability-related.PatchVulnerability and vendors distributing Vulnerability-related.PatchVulnerability the update in good time . In February , Zimperium launched Vulnerability-related.DiscoverVulnerability an N-day acquisition program which is only interested in known security problems , rather than unknown and unpatched zero-days . Over the next year , the exploit purchaser is budgeting a total of $ 1.5 million to pick up the details on these exploits . Once a bug has been discovered Vulnerability-related.DiscoverVulnerability and a fix is being worked on Vulnerability-related.PatchVulnerability , an N-day exploit indicates a time of one or more days in which user systems can be compromised until a security update is issued Vulnerability-related.PatchVulnerability . `` By focusing on N-days , or patched vulnerabilities , Zimperium is applying pressure on the mobile ecosystem to re-think how and when users receive Vulnerability-related.PatchVulnerability security updates , '' the company said at the time . `` [ The ] program will reward the hard work of researchers who would n't otherwise receive compensation for an N-day exploit . ''

A flaw in unpatched versions of Window 10 could leave machines vulnerable Vulnerability-related.DiscoverVulnerability to EternalBlue , the remote kernel exploit behind the recent WannaCry ransomware attack Attack.Ransom . WannaCry targeted a Server Message Block ( SMB ) critical vulnerability that Microsoft patched Vulnerability-related.PatchVulnerability with MS17-010 on March 14 , 2017 . While WannaCry damage Attack.Ransom was mostly limited to machines running Windows 7 , a different version of EternalBlue could infect Windows 10 . Researchers at RiskSense stripped the original leaked version of EternalBlue down to its essential components and deemed parts of the data unnecessary for exploitation . They found they could bypass detection rules recommended by governments and antivirus vendors , says RiskSense senior security researcher Sean Dillon . This version of EternalBlue , an exploit initially released by Shadow Brokers earlier this year , does not use the DoublePulsar payload common among other exploits leaked by the hacker group . DoublePulsar was the main implant used in WannaCry Attack.Ransom and a key focus for defenders . `` That backdoor is unnecessary , '' says Dillon , noting how it 's dangerous for businesses to only focus on DoublePulsar malware . `` This exploit could directly load malware onto the system without needing to install the backdoor . '' EternalBlue gives instant un-credentialed remote access to Windows machines without the MS17-010 patch update . While it 's difficult to port EternalBlue to additional versions of Windows , it 's not impossible . Unpatched Windows 10 machines are at risk , despite the fact that Microsoft 's newest OS receives exploit mitigations that earlier versions do n't . The slimmed-down EternalBlue can be ported to unpatched versions of Windows 10 and deliver stealthier payloads . An advanced malware would be able to target any Windows machine , broadening the spread of an attack like WannaCry , Dillon explains . It 's worth noting WannaCry was a blatant , obvious attack , he says , and other types of malware , like banking spyware and bitcoin miners , could more easily fly under the radar . `` These can infect a network and you wo n't know about it until years later , '' he says . `` It 's a threat to organizations that have been targets , like governments and corporations . Attackers may try to get onto these networks and lay dormant … then steal Attack.Databreach intellectual property or cause other damage . '' Dillon emphasizes the importance of updating Vulnerability-related.PatchVulnerability to the latest version of Windows 10 , but says patching Vulnerability-related.PatchVulnerability alone wo n't give complete protection from this kind of threat . Businesses with SMB facing the Internet should also put up firewalls , and set up VPN access for users who need external access to the internal network . Businesses should have a good inventory of software and devices on their networks , along with processes for identifying and deploying Vulnerability-related.PatchVulnerability patches as they are released Vulnerability-related.PatchVulnerability , says Craig Young , computer security researcher for Tripwire 's Vulnerability and Exposures Research Team ( VERT ) . This will become even more critical as attackers move quickly from patch to exploit . There will always be a window of opportunity for attackers before the right patches are installed Vulnerability-related.PatchVulnerability , Young notes . EternalBlue is a `` very fresh vulnerability '' given that most breaches that use exploits leverage flaws that have been publicly known Vulnerability-related.DiscoverVulnerability for an average of two years or more . `` EternalBlue is a particularly reliable exploit that gives access to execute code at the very highest privilege level , so I would expect that hackers and penetration testers will get a lot of use out of it for years to come , '' he says .