* Regarding the Windows 10 January Vulnerabilty and the Importance of patching it! *
The NSA came out in public to announce this vulnerability, a sign of their concern and how serious this could potentially be.
Microsoft has made patches for the various versions of Windows affected.
However -- it's possible that your own machine hasn't received the update yet, as there sometimes other pending updates, etc and things might get blurry.
A user has posted a direct link to the Microsoft Advisory page for this, and the page has links to each of the correct fixes to be downloaded and applied, depending on what version of Windows you have running, the patch level, processor type (x86 32 bits, or x64 64 bits ones)
Please consider checking your own system - and manually getting and installing the proper patch if not installed yet.
Steps I would suggest :
1. Find out the current Windows version you have running. This might very even if you do have Windows 10 running. Open a commmand line --> Windows button, then type "Winver", which will run a Windows Version program, that displays on a new window your current system info.
2. Write down the Version and processor type. E.G., version 1809 64 bits, or 1903 32 bits, etc.
3. Open the Microsoft Advisory page here : https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-0601
4. Locate the proper version of patch for your system -- based on the current version level you are running.
5. Click on that type, and a new window will open, offering download options. Select the file with the proper processor architecture to match yours; either x86 which is for 32 bit versions, or x64 for 64 bit versions (more likely on newer computers and laptops).
6. Click on the correct file and it will download. It is a LARGE file, so wait until it's completed.
7. Once the download is completed, you can click on the file and allow it to install as a "manual update".
8. Since the patch files are fairly large, the installation will take a bit of time. Wait for it to finish, you can do other tasks while waiting.
9. Once it completes installing, it will prompt you for a Restart. Do it. Now.
10. Done? It will reboot, installing the patches during the shutdown process.
11. Verify the Install? You can go into the Windows -- Updates -- Show Update History list, and you should see a new update with today's date installed in the list.
Good luck, and please make sure to have all your home and work machines updated ASAP...
The cynical side of me wonders if there's something else in the update they are anxious to get on as many machines as possible. Seems to me some benefit to them has to outweigh the cost of all the exploitable traffic they lose out on by going public, right?
@khird I think the NA is afraid of a hostile agent having acquired an exploit for this, and that is why they came out and disclosed it.
Rumours are floating around, I have heard something along this line. State sponsored cyberwar won't be fun.
I don't think so. The secrets they want to protect are handled by entirely separate networks (e.g. SIPRNET) on which hostile actors aren't even supposed to be present. The US doesn't generally transmit classified data on the public Intenet, even encrypted, as I understand it. American military exposure via an exploit like this would be pretty limited.
But terrorists etc don't have separate networks and have to use encryption. It's their traffic that this patch protects from the NSA.
