Windows 10 security tackles exploits, while Windows 7 gets a warning

Microsoft says Windows 10 security is so good, it is now able to thwart at least some zero-day exploits before patches are available. But the software giant also warned customers that Windows 7 is so bad, they face "enormous dangers" moving forward.

The Microsoft Malware Protection Center (MMPC) team looked at two zero-day vulnerabilities, both patched in November 2016, to see how well the latest Windows 10 security features incorporated into last summer's Anniversary Update would respond to exploits that had not yet been patched.

"We are testing the exploits against mitigation techniques delivered in August 2016 with Windows 10 Anniversary Update, hoping to see how these techniques might fare against future zero-day exploits with similar characteristics," the MMPC team wrote in a blog post. They said Microsoft is "hardening the Windows platform with mitigation techniques that can stop exploits of newly discovered and even undisclosed vulnerabilities."

"A key takeaway from the detonation of zero-day exploits is that each instance represents a valuable opportunity to assess how resilient a platform can be -- how mitigation techniques and additional defensive layers can keep cyberattacks at bay, while vulnerabilities are being fixed and patches are being deployed," the blog post read. "Because it takes time to hunt for vulnerabilities and it is virtually impossible to find all of them, such security enhancements can be critical in preventing attacks based on zero-day exploits."

Microsoft demonstrated "exploit mitigation techniques in Windows 10 Anniversary Update, which was released months before these zero-day attacks, managed to neutralize not only the specific exploits, but also their exploit methods. As a result, these mitigation techniques are significantly reducing attack surfaces that would have been available to future zero-day exploits."

Microsoft looked at two kernel-level exploits, one of which was most infamously used by the advanced persistent threat group Microsoft calls STRONTIUM, but also known as Fancy Bear, an elevation-of-privilege exploit logged as CVE-2016-7255. This bug, used together with the Adobe Flash Player vulnerability, tracked under CVE-2016-7855, was detected last October as part of a spear-phishing campaign waged by STRONTIUM targeting think tanks and nongovernmental organizations in the United States.

The second flaw, tracked under CVE-2016-7256, is an OpenType font elevation-of-privilege exploit that was first detected in attacks against South Korean targets as early as June 2016.

Both of these vulnerabilities enable elevation of privileges, and both were patched by Microsoft in November 2016 -- and both were defeated by Windows 10 security techniques added to the Anniversary Update.