Security researcher Brian Krebs is warning that a particularly nasty bug may be patched on Tuesday, January 14—the day that support for Windows 7 is expected to expire.
If that’s true, then potentially millions of Windows users could be exposed to the malware, which Krebs is reporting could involve crypt32.dll, which controls “certificate and cryptographic messaging functions in the CryptoAPI.” Here’s what’s scary, Krebs reports: A flaw in the crypt32.dll could be used to spoof the digital signature of a piece of software, creating the possibility that your PC could allow in a piece of malware posing as a perfectly legitimate application.
Krebs is also noting that Will Dormann, who authors many of the vulnerability reports for the CERT Coordination Center, tweeted that “people should perhaps pay very close attention to installing tomorrow’s Microsoft Patch Tuesday Updates in a timely manner.”
Krebs is also reporting that the NSA is scheduled to host a conference call on January 14 regarding a current cybersecurity issue.
With support for Windows 7 set to expire tomorrow, the timing of this is extremely concerning. If Microsoft hews to its previous guidance, that means that it would not provide a security patch for the vulnerability, leaving millions of Windows 7 users especially vulnerable. Of course, even if Microsoft does issue a patch for this rumored flaw—and if there is one, extending support by a day wouldn’t be out of the question—that doesn’t mean there’s not another blockbuster bug waiting in the wings.
To reiterate: It’s highly unlikely that Microsoft wouldn’t issue a patch for Windows 7 if such a major vulnerability were disclosed. Nevertheless, Microsoft couldn’t come up with a more perfect reason to encourage users to migrate off an older, less secure OS—even if both Windows 10 and Windows 7 are vulnerable.
Whether or not Microsoft or the NSA plans to release a bombshell tomorrow, one thing is true: You simply can not go wrong keeping your PC up to date with patches and other fixes.