Oktacron - Cyber Security RSS Feeds History

CVE-2021-40444 zero-day vulnerability in Microsoft Office

kaspersky Sep 08, 2021 Business

Microsoft has reported a zero-day vulnerability, designated CVE-2021-40444, whose exploitation enables remote execution of malicious code on victims’ computers. Worse, cybercriminals are already using the vulnerability to attack Microsoft Office users. Therefore, Microsoft is advising Windows network show more ...

administrators to employ a temporary workaround until the company can deploy a patch. CVE-2021-40444 details The vulnerability is in MSHTML, Internet Explorer’s engine. Although few people use IE these days (even Microsoft strongly recommends switching to its newer browser, Edge), the old browser remains a component of modern operating systems, and some other programs use its engine to handle Web content. In particular, Microsoft Office applications such as Word and PowerPoint rely on it. How attackers are exploiting CVE-2021-40444 The attacks appear as embedded malicious ActiveX controls in Microsoft Office documents. The controls enable the execution of arbitrary code; the documents most likely arrive as e-mail message attachments. As with any attached document, attackers have to persuade victims— to open the file. In theory, Microsoft Office handles documents received over the Internet in Protected View or through Application Guard for Office, either of which can prevent a CVE-2021-40444 attack. However, users may click the Enable Editing button without pausing to think, thus disarming Microsoft’s security mechanisms. Protected View mode notification in Microsoft Word. How to protect your company from CVE-2021-40444 Microsoft has promised to investigate and, if necessary, release an official patch. That said, we do not expect a patch before September 14, the next Patch Tuesday. Under normal circumstances, the company would not announce a vulnerability before the release of a fix, but because cybercriminals are already exploiting CVE-2021-40444, Microsoft recommends employing a temporary workaround immediately. The workaround involves prohibiting the installation of new ActiveX controls, which you can do by adding a few keys to the system registry. Microsoft provides detailed information on the vulnerability, including a Workarounds section (in which you can also learn how to disable the workaround once you no longer need it). According to Microsoft, the workaround should not affect the performance of ActiveX controls already installed. For our part, we recommend: Installing a security solution at the corporate mail gateway level or enhancing Microsoft Office 365's standard security mechanisms to protect corporate mail from attacks; Equipping all employee computers with security solutions capable of detecting vulnerability exploitation; Raising employee awareness of modern cyberthreats on a regular basis, and in particular, reminding them never to open documents from untrusted sources, much less turn on editing mode unless absolutely necessary.

Microsoft: Attackers Exploiting Windows Zero-Day Flaw

krebsonsecurity Sep 08, 2021 Latest Warnings

Microsoft Corp. warns that attackers are exploiting a previously unknown vulnerability in Windows 10 and many Windows Server versions to seize control over PCs when users open a malicious document or visit a booby-trapped website. There is currently no official patch for the flaw, but Microsoft has released show more ...

recommendations for mitigating the threat. According to a security advisory from Redmond, the security hole CVE-2021-40444 affects the “MSHTML” component of Internet Explorer (IE) on Windows 10 and many Windows Server versions. IE been slowly abandoned for more recent Windows browsers like Edge, but the same vulnerable component also is used by Microsoft Office applications for rendering web-based content. “An attacker could craft a malicious ActiveX control to be used by a Microsoft Office document that hosts the browser rendering engine,” Microsoft wrote. “The attacker would then have to convince the user to open the malicious document. Users whose accounts are configured to have fewer user rights on the system could be less impacted than users who operate with administrative user rights.” Microsoft has not yet released a patch for CVE-2021-40444, but says users can mitigate the threat from this flaw by disabling the installation of all ActiveX controls in IE. Microsoft says the vulnerability is currently being used in targeted attacks, although its advisory credits three different entities with reporting the flaw. On of the researchers credited — EXPMON — said on Twitter that it had reproduced the attack on the latest Office 2019 / Office 365 on Windows 10. “The exploit uses logical flaws so the exploitation is perfectly reliable (& dangerous),” EXPMON tweeted. Windows users could see an official fix for the bug as soon as September 14, when Microsoft is slated to release its monthly “Patch Tuesday” bundle of security updates. This year has been a tough one for Windows users and so-called “zero day” threats, which refers to vulnerabilities that are not patched by current versions of the software in question, and are being actively exploited to break into vulnerable computers. Virtually every month in 2021 so far, Microsoft has been forced to respond to zero-day threats targeting huge swaths of its user base. In fact, by my count May was the only month so far this year that Microsoft didn’t release a patch to fix at least one zero-day attack in Windows or supported software. Many of those zero-days involve older Microsoft technologies or those that have been retired, like IE11; Microsoft officially retired support for Microsoft Office 365 apps and services on IE11 last month. In July, Microsoft rushed out a fix for the Print Nightmare vulnerability that was present in every supported version of Windows, only to see the patch cause problems for a number of Windows users. On June’s Patch Tuesday, Microsoft addressed six zero-day security holes. And of course in March, hundreds of thousands of organizations running Microsoft Exchange email servers found those systems compromised with backdoors thanks to four zero-day flaws in Exchange.

Spotlight: Securing COVID’s New Normal with Cathy Spence of Intel

securityledger Sep 08, 2021 Companies

What will it mean to secure the “new normal” after the COVID pandemic has receded? In this spotlight edition of the podcast, Cathy Spence, a Senior Principal Engineer at Intel, joins us in The Security Ledger Podcast studios to talk about what that new normal wt ill look like. For Cathy, the future looks a lot show more ...

like the COVID-influenced...Read the whole entry... » Related StoriesSpotlight: Securing the Great Resignation with Code 42Spotlight: E-Commerce’s Bot and Mouse GameEncore Podcast: Is Autonomous Driving Heading for a Crash?

New PRIVATELOG Malware Uses CLFS Log Files to Hide

cyware Sep 08, 2021 Malware and Vulnerabilities

A new malware family dubbed PrivateLog was found using Common Log File System (CLFS) to stay under the radar and uses another malware—StashLog—as its installer. PRIVATELOG and StashLog have slightly contrasting methods for delivering other malicious payloads. The security agency recommends scanning for IOCs in the events with the keywords ‘process’, ‘imageload’, or ‘filewrite’ in the EDR logs.

Germany Protests to Russia Over Pre-Election Cyberattacks

cyware Sep 08, 2021 Geopolitical, Terrorism

“These attacks could serve as preparations for influence operations such as disinformation campaigns connected with the parliamentary election,” Foreign Ministry spokeswoman told reporters in Berlin.

SEC Warns of Fraudulent Cryptocurrency Schemes

cyware Sep 08, 2021 Threat Intel & Info Sharing

The SEC adds, "If you are considering a digital asset-related investment, take the time to understand how the investment works and to evaluate its risks. Look for warning signs that it may be a scam."

FIN7 Using Windows 11 Alpha Buzz as Lure

cyware Sep 08, 2021 Threat Actors

A spear-phishing campaign by the FIN7 group was spotted using Windows 11 Alpha-themed Word maldocs—containing heavily obfuscated VBA macros—against a PoS service provider in the U.S. The document claims to be created with a new OS and fools some users that there is a compatibility problem. Security professionals are suggested to stay alert and keep sharing the latest IOCs to ensure protection against this threat.

Dropper-as-a-Service Creates Chaos

cyware Sep 08, 2021 Trends, Reports, Analysis

Research by Sophos discovered that a network of websites is acting as a DaaS. The service is relatively cheap and some of them charge as low as $2 for 1,000 malware installs.

REvil Ransomware Group Resurfaces After Two-Month Hiatus Following Kaseya Attack

cyware Sep 08, 2021 Threat Actors

The operators behind the REvil ransomware group have resurfaced after allegedly closing shop following the widespread attack on Kaseya that caused thousands of victims on July 4.

ProPublica report claims WhatsApp conversations are less private than users expect

cyware Sep 08, 2021 Mobile Security

"WhatsApp assures users that no one can see their messages — but the company has an extensive monitoring operation and regularly shares personal information with prosecutors," ProPublica claims.

Heap buffer overflow vulnerability patched in Ribbonsoft dxflib library

cyware Sep 08, 2021 Malware and Vulnerabilities

Users are encouraged to update the affected products quickly: Ribbonsoft dxflib, version 3.17.0. Talos tested and confirmed these versions of the library could be exploited by this vulnerability.

3 Ransomware Detection Techniques To Catch An Attack

cyware Sep 08, 2021 Expert Blogs and Opinion

Today, companies can't avoid ransomware threats. Eventually, attackers will get into an enterprise system. The goal then becomes to detect ransomware before it encrypts and exfiltrates business data.

Second Data Leak Reported in Indonesia's COVID-19 Tracking Apps

cyware Sep 08, 2021 Breaches and Incidents

On Friday, PeduliLindungi became the second COVID-19 tracking app in the country, after eHAC, to have suffered a data leak, affecting an unknown number of people, in the span of one week.

Crypto exchanges and their customers must protect themselves as attacks continue

cyware Sep 08, 2021 Expert Blogs and Opinion

As cryptocurrency becomes increasingly mainstream, owned by a growing number of both businesses and individuals, its value to cybercriminals will also continue to grow parallely.

Cyber Vulnerability is Healthcare’s Modern Malaise

cyware Sep 08, 2021 Trends, Reports, Analysis

Healthcare accounted for nearly a quarter of the reported data breaches – the highest – accounting for over 29 million individual patient records stolen in 2020, in the US alone.

McDonald's leaks password for Monopoly VIP database to winners

cyware Sep 08, 2021 Breaches and Incidents

The game hit a snag over the weekend after a bug caused the user name and passwords for both the production and staging database servers to be in prize redemption emails sent to prize winners.

HAProxy Found Vulnerable to Critical HTTP Request Smuggling Attack

cyware Sep 08, 2021 Malware and Vulnerabilities

Tracked as CVE-2021-40346, the Integer Overflow vulnerability has a severity rating of 8.6 on the CVSS scoring system and has been rectified in HAProxy versions 2.0.25, 2.2.17, 2.3.14, and 2.4.4.

Machine learning technique detects phishing sites based on markup visualization

cyware Sep 08, 2021 Innovation and Research

The technique uses “binary visualization” libraries to transform the markup and code of web pages into images. Using this method, they created a dataset of legitimate and phishing images of websites.

In space, no one can hear cyber security professionals scream

cyware Sep 08, 2021 Trends, Reports, Analysis

"Space is an invaluable domain, but it is also increasingly crowded and particularly susceptible to a range of cyber vulnerabilities and threats," Managing director of The Aerospace Corp UK said.

New Zealand Banks, Post Office Suffer Network Outages After Disruptive DDoS Attack

cyware Sep 08, 2021 Breaches and Incidents

Websites of a number of financial institutions in New Zealand and its national postal service were briefly down on Wednesday, with officials saying they were battling a cyber attack.

AnaCap announces majority investment in digital ID provider WebID

cyware Sep 08, 2021 Companies to Watch

AnaCap, a specialist mid-market private equity investor in technology-enabled financial services, today announces a majority investment in WebID, a leading German digital identification provider.

New Zero-Day Attack Targeting Windows Users With Microsoft Office Documents

cyware Sep 08, 2021 Malware and Vulnerabilities

Microsoft on Tuesday warned of an actively exploited zero-day flaw impacting Internet Explorer that's being used to hijack vulnerable Windows systems by leveraging weaponized Office documents.

Android Espionage Campaign Targeting Kurdish Ethnic Group Using Backdoors Disguised as Legitimate Apps

cyware Sep 08, 2021 Breaches and Incidents

The newly discovered Android 888 RAT has been used by the Kasablanka group and by BladeHawk. Both of them used alternative names to refer to the same Android RAT – LodaRAT and Gaza007 respectively.

DEV-0322 Behind the SolarWinds Zero-Day Attacks in July

cyware Sep 08, 2021 Threat Actors

Last month, experts identified a severe zero-day RCE exploit aimed at SolarWinds Serv-U FTP software. Researchers have now linked a limited and highly targeted attack on SolarWinds with a Chinese actor dubbed DEV-0322. Flaws in SolarWinds products have been exploited by Chinese threat actors even earlier. SolarWinds has already released an advisory, which should be implemented as soon as possible.

Thailand: Hacker steals 40,000 patients' data from Bangkok hospital

cyware Sep 08, 2021 Breaches and Incidents

The personal details of more than 40,000 patients at Bhumirajanagarindra Kidney Institute Hospital have been stolen by a hacker, hospital director Thirachai Chantharotsiri said on Wednesday.

Texas Right to Life website exposed job applicants’ resumes

cyware Sep 08, 2021 Breaches and Incidents

“We are taking action to protect the concerned individuals,” said a spokesperson for Texas Right to Life, told TechCrunch, referring to those who “sought and circulated the information.”

Researchers Uncover Email Fraud Campaigns Using Social Engineering Tactics to Steal Crypto Assets

cyware Sep 08, 2021 Identity Theft, Fraud, Scams

Victims are tempted by the promise of a considerable amount of cryptocurrency. Cashing out the full balance requires them to deposit some Bitcoin to the platform, which is the point of the scheme.

Bridgeport city government hacked, residents put on notice

cyware Sep 08, 2021 Breaches and Incidents

Residents of Bridgeport have been notified city government was hacked in late May of this year. A letter to residents said city IT systems were encrypted in a ransomware attack.

TeamTNT Uses Chimaera Malware Bundle in Stealthy New Campaign

cyware Sep 08, 2021 Threat Actors

AT&T's Alien Labs has sounded the alarm on a malware campaign from TeamTNT which has gone almost entirely undetected by anti-virus and which is turning target devices into cryptocurrency miners.

Ransomware Attack Hits Howard University

packetstormsecurity Sep 08, 2021 headline,malware,usa,cryptography

ProtonMail Under Fire After Police Data Handover

packetstormsecurity Sep 08, 2021 headline,government,privacy,email,usa,sp

Netgear Smart Switches Open To Complete Takeover

packetstormsecurity Sep 08, 2021 headline,flaw,cisco