Oktacron - Cyber Security RSS Feeds History

EDR functionality in a small business solution

kaspersky Apr 14, 2021 Business

Most security solutions for small and medium-size businesses exist simply to prevent malware from running on a workstation or server — and for years, that was enough. As long as an organization could detect cyberthreats on end devices, it could arrest the spread of infection over its network and thus protect the show more ...

corporate infrastructure. Times change. A typical modern cyberattack is not an isolated incident on one employee’s computer but a complex operation affecting a sizable portion of the infrastructure. Therefore, minimizing the damage of a modern cyberattack requires not just blocking malware, but also quickly understanding what happened, how it happened, and where it could happen again. What’s changed Modern cybercrime has evolved such that even a small company might reasonably fall prey to a full-featured, targeted attack. To some extent, that’s a result of the increasing availability of the tools needed for a complex, multistage attack. Also, however, criminals always try to maximize their profit-to-effort ratio, and ransomware operators really stand out in that regard. Lately, we’ve seen true research and lengthy preparation for ransomware operations. Sometimes, operators lurk in a target network for weeks, exploring the infrastructure and stealing vital data before striking with encryption and ransom demands. A small business may instead serve as an intermediate target in a supply-chain attack — attackers sometimes use the infrastructure of a contractor, an online service provider, or a small partner to assault a larger organization. In such cases, they may even exploit zero-day vulnerabilities, which is normally a costly option. Understanding what happened Ending a complex, multilevel attack requires a clear picture of how an attacker penetrated the infrastructure, how much time they spent inside, which data they may have accessed, and so forth. Simply deleting malware would be akin to treating a disease’s symptoms without addressing its causes. In enterprise-level companies, the SOC, IS department, or an outside party performs such investigations. Big companies use EDR-class solutions for that. Limited budgets and staff tend to place those options out of reach of a small business. Small businesses still need specialized tools, though, to help them respond promptly to complex threats. Kaspersky Endpoint Security Cloud with EDR Setting up our SMB solution with EDR functionality doesn’t take a security expert — the updated Kaspersky Endpoint Security Cloud Plus offers improved visibility of the infrastructure. The administrator can quickly identify the paths a threat uses to spread, view detailed info on affected machines, quickly view the details of malicious files, and see where else the files are currently used. That helps admins promptly detect all threat hot spots, block the execution of dangerous files, and isolate affected machines, thus minimizing potential damage. While we monitor the tool’s usage to determine its relevance in the field, we’ve made EDR functionality available through 2021 to users of Kaspersky Endpoint Security Cloud Plus in test mode. You can learn more and order a trial version here.

Desktop Window Manager vulnerability CVE-2021-28310 exploited ITW

kaspersky Apr 14, 2021 Business

Kaspersky researchers have found a zero-day vulnerability (CVE-2021-28310) in a Microsoft Windows component called Desktop Window Manager (DWM). We believe several threat actors have already exploited the vulnerability. Microsoft just released the patch, and we suggest applying it immediately. Here’s why. What show more ...

is Desktop Window Manager? Pretty much everyone is familiar with the windowed interface of modern operating systems: each program opening in a separate window that doesn’t necessarily take up the whole screen. Windows may overlap, for example, one casting a shadow over others as if it were physically blocking the light. In Microsoft Windows, the component responsible for rendering features such as shadows and transparency is Desktop Window Manager. To understand why Desktop Window Manager is important in a cybersecurity context, consider that programs don’t just draw their windows on the screen; they put the necessary information in a buffer. Desktop Window Manager grabs that information from each program’s buffer and creates the overall composite view that the user sees. When a user moves one window over another, the open programs don’t know anything about whether their windows should be casting a shadow or having a shadow cast on them, for example. Desktop Window Manager does that job, and as such it is a key service in Windows that has existed in every version of Windows since Vista — and cannot be deactivated in Windows 8 or later versions. Desktop Window Manager’s vulnerability The vulnerability our advanced exploit prevention technology discovered is an elevation of privilege vulnerability. That means a program can trick Desktop Window Manager into giving it access that it shouldn’t have. In this case, the vulnerability allowed the attackers to execute arbitrary code on victims’ machines — it essentially gave them full control over the computers. How to avoid CVE-2021-28310 exploitation It’s critical to act quickly. Here’s what you can do: Install the patches Microsoft released on April 13, immediately and on all vulnerable computers; Protect all of your devices with a robust security solution such as Kaspersky Endpoint Security for Business, whose advanced exploit prevention component blocks attempts to exploit CVE-2021-28310.

Microsoft Patch Tuesday, April 2021 Edition

krebsonsecurity Apr 14, 2021 Time to Patch

Microsoft today released updates to plug at least 110 security holes in its Windows operating systems and other products. The patches include four security fixes for Microsoft Exchange Server — the same systems that have been besieged by attacks on four separate (and zero-day) bugs in the email software over the show more ...

past month. Redmond also patched a Windows flaw that is actively being exploited in the wild. Nineteen of the vulnerabilities fixed this month earned Microsoft’s most-dire “Critical” label, meaning they could be used by malware or malcontents to seize remote control over vulnerable Windows systems without any help from users. Microsoft released updates to fix four more flaws in Exchange Server versions 2013-2019 (CVE-2021-28480, CVE-2021-28481, CVE-2021-28482, CVE-2021-28483). Interestingly, all four were reported by the U.S. National Security Agency, although Microsoft says it also found two of the bugs internally. A Microsoft blog post published along with today’s patches urges Exchange Server users to make patching their systems a top priority. Satnam Narang, staff research engineer at Tenable, said these vulnerabilities have been rated ‘Exploitation More Likely’ using Microsoft’s Exploitability Index. “Two of the four vulnerabilities (CVE-2021-28480, CVE-2021-28481) are pre-authentication, meaning an attacker does not need to authenticate to the vulnerable Exchange server to exploit the flaw,” Narang said. “With the intense interest in Exchange Server since last month, it is crucial that organizations apply these Exchange Server patches immediately.” Also patched today was a vulnerability in Windows (CVE-2021-28310) that’s being exploited in active attacks already. The flaw allows an attacker to elevate their privileges on a target system. “This does mean that they will either need to log on to a system or trick a legitimate user into running the code on their behalf,” said Dustin Childs of Trend Micro. “Considering who is listed as discovering this bug, it is probably being used in malware. Bugs of this nature are typically combined with other bugs, such as browser bug of PDF exploit, to take over a system.” In a technical writeup on what they’ve observed since finding and reporting attacks on CVE-2021-28310, researchers at Kaspersky Lab noted the exploit they saw was likely used together with other browser exploits to escape “sandbox” protections of the browser. “Unfortunately, we weren’t able to capture a full chain, so we don’t know if the exploit is used with another browser zero-day, or coupled with known, patched vulnerabilities,” Kaspersky’s researchers wrote. Allan Laska, senior security architect at Recorded Future, notes that there are several remote code execution vulnerabilities in Microsoft Office products released this month as well. CVE-2021-28454 and CVE-2021-28451 involve Excel, while CVE-2021-28453 is in Microsoft Word and CVE-2021-28449 is in Microsoft Office. All four vulnerabilities are labeled by Microsoft as “Important” (not quite as bad as “Critical”). These vulnerabilities impact all versions of their respective products, including Office 365. Other Microsoft products that got security updates this month include Edge (Chromium-based), Azure and Azure DevOps Server, SharePoint Server, Hyper-V, Team Foundation Server, and Visual Studio. Separately, Adobe has released security updates for Photoshop, Digital Editions, RoboHelp, and Bridge. It’s a good idea for Windows users to get in the habit of updating at least once a month, but for regular users (read: not enterprises) it’s usually safe to wait a few days until after the patches are released, so that Microsoft has time to iron out any kinks in the new armor. But before you update, please make sure you have backed up your system and/or important files. It’s not uncommon for a Windows update package to hose one’s system or prevent it from booting properly, and some updates have been known to erase or corrupt files. So do yourself a favor and backup before installing any patches. Windows 10 even has some built-in tools to help you do that, either on a per-file/folder basis or by making a complete and bootable copy of your hard drive all at once. And if you wish to ensure Windows has been set to pause updating so you can back up your files and/or system before the operating system decides to reboot and install patches on its own schedule, see this guide. As always, if you experience glitches or problems installing any of these patches this month, please consider leaving a comment about it below; there’s a better-than-even chance other readers have experienced the same and may chime in here with some helpful tips.

Exploit Released for Critical Vulnerability Affecting QNAP NAS Devices

cyware Apr 14, 2021 Malware and Vulnerabilities

An exploit is now publicly available for a remote code execution vulnerability affecting QNAP network-attached storage (NAS) devices that run the Surveillance Station video management system.

Compromised Microsoft Exchange Server Used to Host Cryptominer

cyware Apr 14, 2021 Threat Intel & Info Sharing

Researchers at Sophos have reported that an unknown attacker is attempting to use a compromised Microsoft Exchange Server to deliver a malicious Monero cryptominer onto other vulnerable Microsoft Exchange Servers.

CISA gives federal agencies until Friday to patch Exchange servers

cyware Apr 14, 2021 Malware and Vulnerabilities

The US Cybersecurity and Infrastructure Security Agency (CISA) has ordered federal agencies to install newly released Microsoft Exchange security updates by Friday this week.

NSA Discovers New Vulnerabilities Affecting Microsoft Exchange Servers

cyware Apr 14, 2021 Malware and Vulnerabilities

Microsoft has rolled out fixes for a total of 114 security flaws, including an actively exploited zero-day and four remote code execution bugs in the Exchange Server. Of the 114 flaws, 19 are rated as Critical.

Update Your Chrome Browser to Patch 2 New In-the-Wild 0-Day Exploits

cyware Apr 14, 2021 Malware and Vulnerabilities

Google released a new version of Chrome for Windows, Mac, and Linux with patches for two newly discovered security vulnerabilities for both of which it says exploits exist in the wild, allowing attackers to engage in active exploitation.

Risk startup LogicGate confirms data breach

cyware Apr 14, 2021 Breaches and Incidents

An email sent by LogicGate to customers earlier this month said on February 23 an unauthorized third party obtained credentials to its AWS-hosted cloud storage servers storing customer backup files for its flagship platform Risk Cloud.

More than Half of Tasmania’s Casinos Shuttered in a Cyberattack

cyware Apr 14, 2021 Breaches and Incidents

Threat actors struck the Australian island state's sole casino operator Federal Group with ransomware. The attack affected hotel booking systems in the company's Wrest Point and Country Club venues, sited in Sandy Bay and Launceston, respectively.

FBI blasts away web shells on US servers in wake of Exchange vulnerabilities

cyware Apr 14, 2021 Malware and Vulnerabilities

The Department of Justice revealed on Tuesday that the FBI gained authorization to remove web shells installed on compromised servers related to the Exchange vulnerabilities.

Cracked copies of Microsoft Office and Adobe Photoshop steal your session cookies, browser history, crypto-coins

cyware Apr 14, 2021 Malware and Vulnerabilities

Cracked copies of Microsoft Office and Adobe Photoshop are stealing browser session cookies and Monero cryptocurrency wallets from tightwads who install the pirated software, Bitdefender has warned.

The Biden Administration’s Cybersecurity Roadmap

cyware Apr 14, 2021 Govt., Critical Infrastructure

The pandemic has forced state and local governments to shift so much of their operations and provision of services online, but their technology has often struggled to keep up, and even worse it has exposed their cybersecurity vulnerabilities.

Experts see 'unprecedented' increase in hackers targeting electric grid

cyware Apr 14, 2021 Threat Intel & Info Sharing

The leader of EI-ISAC, a key information-sharing group, said Tuesday that organizations involved in the electricity sector had seen an "unprecedented" increase in cyber threats during the COVID-19 pandemic.

1Password targets developers with Secrets Automation, acquisition of SecretHub

cyware Apr 14, 2021 Companies to Watch

Password specialist 1Password has acquired SecretHub, a secrets management platform aimed at IT engineers, and made a new service called Secrets Automation, previously in beta, generally available.

Small Kansas Water Utility System Hacking Highlights Risks

cyware Apr 14, 2021 Trends, Reports, Analysis

A former Kansas utility worker has been charged with remotely tampering with a public water system’s cleaning procedures, highlighting the difficulty smaller utilities face in protecting against hackers.

Adobe Patches Critical Code Execution Vulnerabilities in Photoshop, Bridge

cyware Apr 14, 2021 Malware and Vulnerabilities

Adobe on Tuesday announced patches for several vulnerabilities in four of its products, including critical code execution and buffer flow flaws affecting Photoshop and Bridge.

Capcom: Ransomware gang used old VPN device to breach the network

cyware Apr 14, 2021 Malware and Vulnerabilities

Capcom has released a final update about the ransomware attack it suffered last year, detailing how the hackers gained access to the network, compromised devices, and stole personal information belonging to thousands of individuals.

SolarWinds says dealing with hack fallout cost at least $18 million

cyware Apr 14, 2021 Companies to Watch

Texas-based SolarWinds Corp said the sprawling breach stemming from the compromise of its flagship software product has cost the company at least $18 million in the first three months of 2021.

New Linux, macOS malware hidden in fake Browserify NPM package

cyware Apr 14, 2021 Malware and Vulnerabilities

A new malicious package has been spotted on the npm registry, which targets NodeJS developers using Linux and Apple macOS operating systems. The malicious package is called "web-browserify," and imitates the popular Browserify npm component.

PoC Exploit Released for Unpatched Flaw Affecting Chromium-Based Browsers

cyware Apr 14, 2021 Malware and Vulnerabilities

A researcher has made public a proof-of-concept (PoC) exploit for a recently discovered vulnerability affecting Chrome, Edge, and other Chromium-based web browsers. The researchers demonstrated the exploit against both Chrome and Microsoft Edge.

Thycotic and Centrify Complete Merger to Expand PAM Offerings

cyware Apr 14, 2021 Companies to Watch

The two cybersecurity firms have joined together to form a single cloud identity security vendor, pooling their respective expertise and tools in the area of privileged access management (PAM).

Bolstering Our Nation's Defenses Against Cybersecurity Attacks

cyware Apr 14, 2021 Expert Blogs and Opinion

Shawn Henry, former Executive Assistant Director of the FBI and current CrowdStrike president of services and CSO, shares the top three cybersecurity priorities that the Biden administration needs to address.

WhatsApp flaw lets anyone lock you out of your account

cyware Apr 14, 2021 Malware and Vulnerabilities

The underlying loophole abuses a lapse in security of two independent WhatsApp processes, according to Forbes, which quoted research by Luis Márquez Carpintero and Ernesto Canales Pereña.

QBot Malware Is Making a Comeback by Replacing IcedID in Malspam Campaigns

cyware Apr 14, 2021 Malware and Vulnerabilities

In the first months of the year, researchers noticed a malicious email campaign spreading weaponized Office documents that was delivering QBot trojan, and changing the payload after a short while.

New Vulnerability Affecting Container Engines CRI-O and Podman (CVE-2021-20291)

cyware Apr 14, 2021 Malware and Vulnerabilities

Palo Alto Networks researchers have found CVE-2021-20291 in containers/storage that leads to a Denial of Service (DoS) of the container engines CRI-O and Podman when pulling a malicious image from a registry.

FBI Deletes Web Shells From Hundreds Of Compromised Microsoft Exchange Servers Before Alerting Admins

packetstormsecurity Apr 14, 2021 headline,hacker,government,microsoft,ema

100,000 Google Sites Used To Install SolarMarket RAT

packetstormsecurity Apr 14, 2021 headline,malware,google

Reddit Takes Bug Bounty Program Public

packetstormsecurity Apr 14, 2021 headline,hacker,social