Oktacron - Cyber Security RSS Feeds History

Microsoft July Patch Tuesday 2023 | Kaspersky official blog

kaspersky Jul 12, 2023 Business

The Microsoft July patch collection turned out to be quite surprising. Firstly, they are once again fixing the seemingly dead Internet Explorer. Secondly, as many as six of the vulnerabilities are already being actively exploited by attackers. And thirdly, two of these six were closed not with patches, but with show more ...

recommendations. Here are the total statistics: 132 flows were closed, 9 of them considered critical. Exploitation of 37 vulnerabilities can lead to arbitrary code execution, 33 to privilege elevation, 13 to security features bypass, and 22 may result in a denial of service. Why they are patching Internet Explorer? Not so long ago we wrote that Internet Explorer is dead, but not quite. In particular, we talked about Microsofts advice to continue installing security updates related to IE, since some of its components are still in the system. And now it becomes clear why they gave this advice. The July patch closes as many as three vulnerabilities in MSHTML, the engine inside the legendary browser. In the CVE descriptions Microsoft says the following: While Microsoft has announced retirement of the Internet Explorer 11 application on certain platforms and the Microsoft Edge Legacy application is deprecated, the underlying MSHTML, EdgeHTML, and scripting platforms are still supported. The MSHTML platform is used by Internet Explorer mode in Microsoft Edge as well as other applications through WebBrowser control. The EdgeHTML platform is used by WebView and some UWP applications. The scripting platforms are used by MSHTML and EdgeHTML but can also be used by other legacy applications. Updates to address vulnerabilities in the MSHTML platform and scripting engine are included in the IE Cumulative Updates; EdgeHTML and Chakra changes are not applicable to those platforms. To stay fully protected, we recommend that customers who install Security Only updates install the IE Cumulative updates. The most dangerous of the freshly discovered IE vulnerabilities is CVE-2023-32046, and it is already used in real attacks. Its successful exploitation allows cybercriminals to elevate their privileges to the level of the victim. Attack scenarios involve the creation of a malicious file that is sent to the victim by mail or hosted on a compromised website. All attackers need then is to convince the user to follow the link and open the file. The remaining two vulnerabilities, CVE-2023-35308 and CVE-2023-35336, can be used to bypass security features. The first allows a cybercriminal to create a file bypassing the Mark-of-the-Web mechanism so that the file can be opened by Microsoft Office applications without Protected View mode. And both holes can be used to trick a victim into accessing a URL in a less restrictive Internet Security Zone than intended. Recommendations instead of the patches The next two vulnerabilities are also in active exploitation, but instead of full-fledged patches, they only got security recommendations. First one, CVE-2023-36884 with CVSS rating 8.3, is exploited in the Storm-0978/RomCom RCE attacks on Office and Windows. To stay safe, Microsoft advises adding all Office executables to the FEATURE_BLOCK_CROSS_PROTOCOL_FILE_NAVIGATION list. The second unresolved issue relates to the signing of kernel-level drivers — it does not have a CVE index, but only a guide with recommendations (ADV-230001). Redmond revoked a bunch of developer certificates used in APT attacks and blocked several malicious drivers, but the root of the problem remained. Hackers still manage to sign drivers with Microsoft certificates or sign them with the backdate to make them work as one of the exceptions and do not require the MS Developers Portal signature. As a countermeasure, Microsoft recommends keeping Windows and EDR up to date. The only small consolation is that in order to exploit such drivers, the attacker must have administrator privileges. The rest exploited vulnerabilities Except the abovementioned vulnerabilities there are three more holes that are already exploited by cybercriminals. CVE-2023-32049 — SmartScreen security feature bypass vulnerability. Its exploitation allows attackers to create a file that opens without displaying the Windows warning downloaded from the Internet. CVE-2023-36874 — privilege escalation vulnerability in Windows Error reporting service. Allows attackers to elevate privileges if they already have normal permissions to create folders and technical performance monitoring files. CVE-2023-35311 — security feature bypass vulnerability in Outlook. Its exploitation helps cybercriminals to avoid showing warnings when using preview. How to stay safe In order to keep corporate resources safe, we recommend installing security patches ASAP, as well as protecting all working computers and servers using modern solutions that can detect exploitation of both known and yet undetected vulnerabilities.

Transatlantic Cable podcast, episode 307 | Kaspersky official blog

kaspersky Jul 12, 2023 News

The latest edition of the Transatlantic Cable Podcast begins with news that a judge has ruled that the United States government must limit its contact with social media networks. From there discussion moves to news that the U.K government is trying to push through new legislation to enable it to essentially break show more ...

end-to-end encryption – privacy groups are, as youd expect, concerned. The last two stories look at news around the snoopers charter in France and should parents hide their kids faces on social media – Mark Zuckerberg thinks so. If you like what you heard, please consider subscribing. Biden officials must limit contact with social media firms E2E encryption: Should big tech be able to read peoples messages? New French laws dubbed a snoopers charter Zuckerberg hides his kids faces on social and experts say you should do the same

Apple & Microsoft Patch Tuesday, July 2023 Edition

krebsonsecurity Jul 12, 2023 Security Tools

Microsoft Corp. today released software updates to quash 130 security bugs in its Windows operating systems and related software, including at least five flaws that are already seeing active exploitation. Meanwhile, Apple customers have their own zero-day woes again this month: On Monday, Apple issued (and then show more ...

quickly pulled) an emergency update to fix a zero-day vulnerability that is being exploited on MacOS and iOS devices. On July 10, Apple pushed a “Rapid Security Response” update to fix a code execution flaw in the Webkit browser component built into iOS, iPadOS, and macOS Ventura. Almost as soon as the patch went out, Apple pulled the software because it was reportedly causing problems loading certain websites. MacRumors says Apple will likely re-release the patches when the glitches have been addressed. Launched in May, Apple’s Rapid Security Response updates are designed to address time-sensitive vulnerabilities, and this is the second month Apple has used it. July marks the sixth month this year that Apple has released updates for zero-day vulnerabilities — those that get exploited by malware or malcontents before there is an official patch available. If you rely on Apple devices and don’t have automatic updates enabled, please take a moment to check the patch status of your various iDevices. The latest security update that includes the fix for the zero-day bug should be available in iOS/iPadOS 16.5.1, macOS 13.4.1, and Safari 16.5.2. On the Windows side, there are at least four vulnerabilities patched this month that earned high CVSS (badness) scores and that are already being exploited in active attacks, according to Microsoft. They include CVE-2023-32049, which is a hole in Windows SmartScreen that lets malware bypass security warning prompts; and CVE-2023-35311 allows attackers to bypass security features in Microsoft Outlook. The two other zero-day threats this month for Windows are both privilege escalation flaws. CVE-2023-32046 affects a core Windows component called MSHTML, which is used by Windows and other applications, like Office, Outlook and Skype. CVE-2023-36874 is an elevation of privilege bug in the Windows Error Reporting Service. Many security experts expected Microsoft to address a fifth zero-day flaw — CVE-2023-36884 — a remote code execution weakness in Office and Windows. “Surprisingly, there is no patch yet for one of the five zero-day vulnerabilities,” said Adam Barnett, lead software engineer at Rapid7. “Microsoft is actively investigating publicly disclosed vulnerability, and promises to update the advisory as soon as further guidance is available.” Barnett notes that Microsoft links exploitation of this vulnerability with Storm-0978, the software giant’s name for a cybercriminal group based out of Russia that is identified by the broader security community as RomCom. “Exploitation of CVE-2023-36884 may lead to installation of the eponymous RomCom trojan or other malware,” Barnett said. “[Microsoft] suggests that RomCom / Storm-0978 is operating in support of Russian intelligence operations. The same threat actor has also been associated with ransomware attacks targeting a wide array of victims.” Microsoft’s advisory on CVE-2023-36884 is pretty sparse, but it does include a Windows registry hack that should help mitigate attacks on this vulnerability. Microsoft has also published a blog post about phishing campaigns tied to Storm-0978 and to the exploitation of this flaw. Barnett said it’s while it’s possible that a patch will be issued as part of next month’s Patch Tuesday, Microsoft Office is deployed just about everywhere, and this threat actor is making waves. “Admins should be ready for an out-of-cycle security update for CVE-2023-36884,” he said. Microsoft also today released new details about how it plans to address the existential threat of malware that is cryptographically signed by…wait for it….Microsoft. In late 2022, security experts at Sophos, Trend Micro and Cisco warned that ransomware criminals were using signed, malicious drivers in an attempt to evade antivirus and endpoint detection and response (EDR) tools. In a blog post today, Sophos’s Andrew Brandt wrote that Sophos identified 133 malicious Windows driver files that were digitally signed since April 2021, and found 100 of those were actually signed by Microsoft. Microsoft said today it is taking steps to ensure those malicious driver files can no longer run on Windows computers. As KrebsOnSecurity noted in last month’s story on malware signing-as-a-service, code-signing certificates are supposed to help authenticate the identity of software publishers, and provide cryptographic assurance that a signed piece of software has not been altered or tampered with. Both of these qualities make stolen or ill-gotten code-signing certificates attractive to cybercriminal groups, who prize their ability to add stealth and longevity to malicious software. Dan Goodin at Ars Technica contends that whatever Microsoft may be doing to keep maliciously signed drivers from running on Windows is being bypassed by hackers using open source software that is popular with video game cheaters. “The software comes in the form of two software tools that are available on GitHub,” Goodin explained. “Cheaters use them to digitally sign malicious system drivers so they can modify video games in ways that give the player an unfair advantage. The drivers clear the considerable hurdle required for the cheat code to run inside the Windows kernel, the fortified layer of the operating system reserved for the most critical and sensitive functions.” Meanwhile, researchers at Cisco’s Talos security team found multiple Chinese-speaking threat groups have repurposed the tools—one apparently called “HookSignTool” and the other “FuckCertVerifyTimeValidity.” “Instead of using the kernel access for cheating, the threat actors use it to give their malware capabilities it wouldn’t otherwise have,” Goodin said. For a closer look at the patches released by Microsoft today, check out the always-thorough Patch Tuesday roundup from the SANS Internet Storm Center. And it’s not a bad idea to hold off updating for a few days until Microsoft works out any kinks in the updates: AskWoody.com usually has the lowdown on any patches that may be causing problems for Windows users. And as ever, please consider backing up your system or at least your important documents and data before applying system updates. If you encounter any problems with these updates, please drop a note about it here in the comments.

Attacks on APIs demand a Security Re-Think

securityledger Jul 12, 2023 agile development

New threats demand that we transform the way we think about securing the endpoints. Case in point: APIs, writes Ross Moore. The post Attacks on APIs demand a Security Re-Think appeared first on The Security Ledger with Paul F. Roberts. Related StoriesMalicious Automation is driving API Security BreachesThe surveys show more ...

speak: supply chain threats are freaking people outResearcher finds malicious packages lurked on npm for months

White House Urged to Quickly Nominate National Cyber Director

darkreading Jul 12, 2023 Feed

A group of cybersecurity organizations is urging the White House to move with haste in nominating a new National Cyber Director, amid a complex and shifting threat landscape.

How to Put Generative AI to Work in Your Security Operations Center

darkreading Jul 12, 2023 Feed

Generative AI is the cybersecurity resource that never sleeps. Here are some of the ways security-focused generative AI can benefit different members of the SOC team.

Hackers Exploit Policy Loophole in Windows Kernel Drivers

darkreading Jul 12, 2023 Feed

Using open source tools, attackers target Chinese speakers with malicious drivers with expired certificates, potentially allowing for full system takeover.

QuickBlox API Vulnerabilities Open Video, Chat Users to Data Theft

darkreading Jul 12, 2023 Feed

QuickBlox users should update to the latest version of the platform in order to protect against several avenues of exploitation.

Startup Spotlight: Mobb Aims to Be the Fixer

darkreading Jul 12, 2023 Feed

The startup, one of four finalists in this year's Black Hat USA Startup Spotlight competition, automates vulnerability remediation using AI.

Microsoft Discloses 5 Zero-Days in Voluminous July Security Update

darkreading Jul 12, 2023 Feed

Fixes for more than 100 vulnerabilities affect numerous products, including Windows, Office, .Net, and Azure Active Directory, among others.

Chinese APT Cracks Microsoft Outlook Emails at 25 Government Agencies

darkreading Jul 12, 2023 Feed

Foreign state-sponsored actors likely had access to privileged state emails for weeks, thanks to a token validation vulnerability.

Ransomware, From a Different Perspective

darkreading Jul 12, 2023 Feed

A good backup strategy can be effective at mitigating a ransomware attack, but how many organizations consider that their backup data can also be targeted?

Mastodon Patches 4 Bugs, but Is the Twitter Killer Safe to Use?

darkreading Jul 12, 2023 Feed

Platform's independent server "instances" may have different security levels, creating potential for supply chain-like vulnerabilities.

New Mozilla Feature Blocks Risky Add-Ons on Specific Websites to Safeguard User Security

cyware Jul 12, 2023 Security Products & Services

"We have introduced a new back-end feature to only allow some extensions monitored by Mozilla to run on specific websites for various reasons, including security concerns," the company said in its Release Notes for Firefox 115.0 shipped last week.

Microsoft Releases Patches for 132 Vulnerabilities, Including 6 Under Active Attack

cyware Jul 12, 2023 Malware and Vulnerabilities

Of the 130 vulnerabilities, nine are rated Critical and 121 are rated Important in severity. This is in addition to eight flaws the tech giant patched in its Chromium-based Edge browser towards the end of last month.

Two more lawsuits filed against Scranton cardiology group over data breach

cyware Jul 12, 2023 Incident Response, Learnings

Cybercriminals attempted to access accounts of a Scranton couple who are among clients whose personal information was exposed in a data breach at a Commonwealth Health cardiology group's practice, according to a proposed class-action lawsuit.

Update: Apple’s Rapid Security Response Patches Causing Website Access Issues

cyware Jul 12, 2023 Malware and Vulnerabilities

Apple has pulled its latest Rapid Security Response updates for iOS and macOS after users complained that they were getting errors when accessing some websites through Safari.

Cybersecurity funding drops sharply in Q2

cyware Jul 12, 2023 Trends, Reports, Analysis

Cybersecurity funding fell by more than half to $1.9 billion during Q2 2023, as fears of a recession and uncertainty in the banking sector roiled investments across technology and information security, as per a report by Pinpoint Search Group.

Bay Area City Shuts Down Municipal Sites Following Cyberattack

cyware Jul 12, 2023 Breaches and Incidents

“The City has no evidence of a breach of personal information of any employee or member of the public and is continuing to investigate the matter with the assistance of cybersecurity professionals,” officials said.

RomCom Attackers Launch Phishing Attacks Against NATO Countries

cyware Jul 12, 2023 Breaches and Incidents

Blackberry's research team has reported a phishing campaign targeting the upcoming NATO Summit in Vilnius as well as an organization supporting Ukraine abroad. Security experts believe this could be a RomCom RAT’s rebranded operation. This execution chain also involves the abuse of the Follina bug, CVE-2022-30190. The summit is scheduled for July 11-12.

Adobe Patch Tuesday: Critical Flaws Haunt InDesign, ColdFusion

cyware Jul 12, 2023 Malware and Vulnerabilities

The company’s scheduled July Patch Tuesday rollout includes fixes for a dozen documented vulnerabilities in Adobe InDesign, including a bug serious enough to lead to arbitrary code execution attacks.

Spanish Police Arrest Phishing Ring Targeting Bank Customers

cyware Jul 12, 2023 Incident Response, Learnings

The group consisted of highly professional cybercriminals who posed as employees of legitimate Spanish banks to make fraudulent calls and SMS messages, Spanish authorities said.

'RedDriver' Browser Hijacker Targets Chinese-Speaking Microsoft Users

cyware Jul 12, 2023 Malware and Vulnerabilities

Cybercriminals have been observed targeting Chinese-speaking Microsoft users with a tool called RedDriver that allows them to intercept web browser traffic. The authors of RedDriver also exhibited familiarity or experience with software development lifecycles. A previous version of RedDriver was bundled with software intended for use in internet cafes.

Former Security Engineer Arrested for $9 Million Crypto Exchange Hack

cyware Jul 12, 2023 Incident Response, Learnings

Shakeeb Ahmed, 34, of New York, has been charged with wire fraud and money laundering in connection with a scheme involving flash loans and inflated fees that were not legitimately earned.

Lawsuits Filed Against Johns Hopkins in MOVEit Hack Mess

cyware Jul 12, 2023 Incident Response, Learnings

Johns Hopkins University and its Johns Hopkins Health System are facing at least two proposed federal class action lawsuits filed in recent days following the institution's disclosure that it was among the victims of the MOVEit Transfer hacks.

ICS Patch Tuesday: Siemens, Schneider Electric Fix 50 Vulnerabilities

cyware Jul 12, 2023 Malware and Vulnerabilities

Siemens has released five new advisories to inform customers about the availability of patches for more than 40 vulnerabilities. Meanwhile, Schneider Electric has released four new advisories covering six vulnerabilities in the company’s products.

Moroccan Charged With OpenSea NFT and Crypto Theft

cyware Jul 12, 2023 Incident Response, Learnings

A Moroccan man has been charged with four counts relating to a scheme to steal nearly half-a-million dollars’ worth of cryptocurrency and non-fungible tokens (NFT) from a US victim.

DDoS Attacks Soar by 168% on Government Services, Report Warns

cyware Jul 12, 2023 Trends, Reports, Analysis

According to StormWall’s Q2 2023 Report, the United States, India, and China remain the most heavily targeted countries, bearing the brunt of the escalating DDoS attacks.

SAP Patches Critical Vulnerability in ECC and S/4HANA Products

cyware Jul 12, 2023 Malware and Vulnerabilities

German enterprise software maker SAP on Tuesday announced the release of 16 new security notes as part of its July 2023 Security Patch Day. In addition, updates were announced for two previously released notes.

Pro-Chinese Twitter Accounts Seek to Expand Beijing’s Influence in Latin America

cyware Jul 12, 2023 Social Media Threats

Three Twitter accounts that appear to have links to the Chinese government have been spreading propaganda in Latin America and successfully avoided Twitter's efforts to label state media, researchers said in an analysis published Tuesday.

Update: Bangladesh Government Fixes Website That Leaked Personal Data of 50 Million Citizens

cyware Jul 12, 2023 Incident Response, Learnings

The information and technology minister of Bangladesh, Zunaid Ahmed, told local media that the data was exposed due to security weaknesses of a website, not a cyberattack.

Chinese Hackers Deploy Microsoft-Signed Rootkit to Target Gaming Sector

cyware Jul 12, 2023 Malware and Vulnerabilities

Trend Micro has attributed the new activity cluster to the same threat actor that was previously identified as behind the FiveSys rootkit, which came to light in October 2021.

SaaS Application Security Firm Savvy Exits Stealth Mode With $30 Million in Funding

cyware Jul 12, 2023 Companies to Watch

The funds were raised in two investment rounds: $10 million in seed funding in 2021, and $20 million in a Series A funding round led by Canaan, with participation from previous investors Cyberstarts and Lightspeed.

Deutsche Bank Confirms Service Provider Breach Exposed Customer Data

cyware Jul 12, 2023 Breaches and Incidents

The number of impacted clients has not been determined, but Deutsche Bank said they have all been informed accordingly on the direct impact and what precautions they should take regarding their exposed data.

Radisson Hotels, Major Insurance Firms Become Latest MOVEit Transfer Victims to Disclose Breaches

cyware Jul 12, 2023 Breaches and Incidents

The number of organizations affected by a recently exploited vulnerability in a popular file transfer tool surpassed 250 as major corporations like Radisson Hotels and two major insurance companies confirmed that their data was accessed by hackers.

Mobile Anti-Detection Toolkits for Payment Fraud Gaining Traction

cyware Jul 12, 2023 Identity Theft, Fraud, Scams

Threat actors are increasingly using specialized mobile Android OS device spoofing techniques to get beyond anti-fraud measures by posing as compromised account holders. Cybersecurity firm Resecurity has identified a surge in the emergence of such types of tools on the dark web in Q1 2023. Payment firms, online show more ...

retailers, and financial institutions are urged to stay updated on the latest fraud trends through shared threat intel solutions.

Staying ahead of the “professionals”: The service-oriented ransomware crime industry

cyware Jul 12, 2023 Trends, Reports, Analysis

The total amount of ransom paid since 2020 is estimated to be at least $2 billion, and this has both motivated and enabled the groups who are profiting from this activity to become more professional.

Python-Based PyLoose Fileless Attack Targets Cloud Workloads for Cryptocurrency Mining

cyware Jul 12, 2023 Malware and Vulnerabilities

"The attack consists of Python code that loads an XMRig Miner directly into memory using memfd, a known Linux fileless technique," security researchers Avigayil Mechtinger, Oren Ofer, and Itamar Gilad said.

Biden’s Cyber Command and NSA Nominee Seen as a Pick for Continuity

cyware Jul 12, 2023 Govt., Critical Infrastructure

At his first Senate confirmation hearing on Wednesday, Air Force Lt. Gen. Timothy Haugh, Cyber Command’s deputy chief, will explain how he plans to fill the shoes of Paul Nakasone.

Cl0p Crime Group Adds 62 Ernst & Young Clients to Leak Sites

cyware Jul 12, 2023 Breaches and Incidents

The growing list of MOVEit cyberattack victims has grown. Sixty-two clients of Big Four accounting firm Ernst & Young now appear on the Clop ransomware group's data leak sites.

Scam Page Volumes Surge 304% Annually

cyware Jul 12, 2023 Trends, Reports, Analysis

In Group-IB’s new Digital Risk Trends 2023 report, security researchers have recorded a 62% year-on-year (YoY) increase in phishing websites and a 304% surge in scam pages in 2022.

Fortinet Patches Critical FortiOS Vulnerability Leading to Remote Code Execution

cyware Jul 12, 2023 Malware and Vulnerabilities

The vulnerability impacts FortiOS and FortiProxy versions 7.2.x and 7.0.x and was resolved in FortiOS versions 7.4.0, 7.2.4, and 7.0.11, and FortiProxy versions 7.2.3 and 7.0.10.

British Prosecutors Say Teen Lapsus$ Member Was Behind Hacks on Uber, Rockstar

cyware Jul 12, 2023 Incident Response, Learnings

A British Crown Court on Tuesday lifted a reporting restriction, allowing the naming of teenager Arion Kurtaj who is accused of hacking Uber, Revolut, and video game developer Rockstar Games in a short period of time last September.

Microsoft Warns That A Chinese Cyberattack Breached Government Email Accounts

packetstormsecurity Jul 12, 2023 headline,hacker,government,privacy,micro

Windows Loophole Exploited To Give Malware Kernel Access

packetstormsecurity Jul 12, 2023 headline,hacker,malware,microsoft,flaw

Coalition Presses White House To Name A New National Cyber Director

packetstormsecurity Jul 12, 2023 headline,government,usa