Oktacron logo
Cyber security aggregate rss news

Cyber security aggregator - feeds history
image for Windows driver compa ...

 Tips

Device drivers are irreplaceable programs written specifically for a particular operating system and a particular device (printer, external drive, mouse, etc.). They allow the OS and running applications to use this device by translating commands into the language of the device. Some are written by Microsoft itself;   show more ...  

others – by third parties. And when we write that Microsoft is getting to grips with drivers, we mean that its tending to minimize the latter – those written third-parties. Whats wrong with third-party drivers Although drivers are indispensable, there are common problems with using them in practice. Compatibility. If the driver installed is incompatible, the device wont work correctly. And its not always possible to keep track of device/driver compatibility using automatic tools. Stability. Since drivers work with devices directly, they have high privileges and often run in kernel mode. Many protection and isolation measures that apply to conventional applications are impracticable with drivers. And that means theyre capable of disrupting the entire system. Poorly written drivers are a common cause of freezes, the Blue Screen of Death, and other problems. Security. Their high privileges make drivers of interest to attackers. If they find a poorly written, vulnerable driver, they can embed functions in it to perform various actions that are usually off-limits to malware, such as disabling your computers security or hiding malicious files from detection. Popular among hackers is the Bring Your Own Vulnerable Driver (BYOVD) technique, in which malware gets installed in the system along with a driver containing exploitable security holes. Drivers used in this way range from video card to gaming anti-cheat drivers. Rare updates. All the above issues are compounded by the fact that device manufacturers release driver updates in their own time. Some do so once a month, some once a year, some never. This complicates life for OS developers, tech support, and users themselves. The only ones who benefit are cybercriminals. To bypass security tools, they could look for vulnerabilities in the operating system itself, but this is quite tricky, and such vulnerabilities, once discovered, get quickly patched. But a vulnerable driver is often never patched, allowing it to run unnoticed — and be exploited — for a long time. How Microsoft and standardization can solve the driver problem Put simply, Microsoft wants there to be fewer drivers, and for only the most trusted of coders to be writing them. Installing Windows used to be a lengthy procedure: after the operating system itself, you had to install three, five… even 10 drivers for your monitor, sound card, printer, scanner, and mouse. Two trends have consigned that to history. First, Microsoft ships a whole host of drivers with Windows, and many popular devices start working right out of the box. This reduces the chances of downloading corrupted, outdated, or incompatible drivers. However, most drivers are still written by third-party vendors. Second, the standardization of devices and interfaces has led to entire classes of devices (such as USB drives or mice) communicating with the computer over a common protocol, so that a single driver works with hundreds of devices from different manufacturers. Microsoft recently announced its next step: the phasing out third-party printer drivers. Going forward, Windows support for any new printer will be through Microsofts own IPP Class Driver, and customizations and additions from vendors will be done through Print Support Apps published in the Windows Store. Starting 2025, new printer drivers will no longer be publishable in a Windows Update, and from 2027 this will extend to older drivers as well. True, therell be nothing to stop vendors from publishing drivers the old-fashioned way — on their own website, and these drivers will continue to function. However, this will become a niche solution since users are accustomed to convenience. How to avoid driver threats and problems Try to use standard drivers supplied with Windows. Unless absolutely necessary, do not install proprietary utilities and add-ons from the device manufacturer. Practice shows that an 80 MB mouse driver and a 300 MB printer driver are superfluous to requirements, and the equipment works just fine without them. If you manually install a driver for a device, check for updates regularly. If a driver has been updated, install the latest version right away. Out-of-date drivers create security risks. Before buying a new device, check whether it works with standard drivers. You can do this by reading user reviews or contacting the manufacturers technical support. All else being roughly equal, its better to choose a device that uses standard drivers. The situation is more complicated if you own outdated equipment in need of exotic drivers that likely havent been updated for years. If you can, replace such devices with newer ones equipped with automatically updated standard drivers. If thats not possible, compensate for this security gap with more stringent security settings: dont use administrator accounts for regular work; uninstall unused applications. Protect your computer with a full-fledged security solution that prevents the exploitation of vulnerabilities in drivers and other software. Kaspersky products have dedicated components for this: System Watcher and Intrusion Prevention. System monitoring for suspicious activities is activated by default, but you can fine-tune it in the settings.

 Malware and Vulnerabilities

One of the vulnerabilities allows remote unauthenticated attackers to execute code in the context of the service account. The other two vulnerabilities patched include a remote code execution bug and an information disclosure issue.

 Malware and Vulnerabilities

Some packages exfiltrate data via webhooks or file-sharing links, while others scan for sensitive files and directories. Users are advised to be cautious and watch for suspicious install scripts.

 Trends, Reports, Analysis

Cybercriminals launched around 7.9 million DDoS attacks in the first half of 2023, a 31% increase compared to the previous year, according to NETSCOUT. These attacks have been driven by global events such as the Russia-Ukraine war and NATO bids.

 Companies to Watch

The acquisition of Trustwave by The Chertoff Group's affiliate MC2 Security Fund signifies the private equity firm's continued investment in cybersecurity and its recognition of the potential value in Trustwave's offerings.

 Feed

Gentoo Linux Security Advisory 202310-2 - Multiple vulnerabilities have been discovered in NVIDIA Drivers, the worst of which could result in root privilege escalation. Versions greater than or equal to 470.182.03 are affected.

 Feed

Ubuntu Security Notice 6405-1 - Multiple security issues were discovered in Thunderbird. If a user were tricked into opening a specially crafted website in a browsing context, an attacker could potentially exploit these to cause a denial of service, obtain sensitive information, bypass security restrictions,   show more ...  

cross-site tracing, or execute arbitrary code. Andrew McCreight discovered that Thunderbird did not properly manage during the worker lifecycle. An attacker could potentially exploit this issue to cause a denial of service.

 Feed

Red Hat Security Advisory 2023-5414-01 - An update for kernel is now available for Red Hat Enterprise Linux 7.6 Advanced Update Support. Red Hat Product Security has rated this update as having a security impact of Important.

 Feed

Ubuntu Security Notice 6404-1 - Multiple security issues were discovered in Firefox. If a user were tricked into opening a specially crafted website, an attacker could potentially exploit these to cause a denial of service, obtain sensitive information across domains, or execute arbitrary code. Ronald Crane discovered   show more ...  

that Firefox did not properly manage memory when non-HTTPS Alternate Services is enabled. An attacker could potentially exploit this issue to cause a denial of service.

 Feed

Ubuntu Security Notice 6403-1 - It was discovered that libvpx did not properly handle certain malformed media files. If an application using libvpx opened a specially crafted file, a remote attacker could cause a denial of service, or possibly execute arbitrary code.

 Feed

Ubuntu Security Notice 6402-1 - It was discovered that LibTomMath incorrectly handled certain inputs. An attacker could possibly use this issue to execute arbitrary code and cause a denial of service.

 Feed

Apple Security Advisory 09-26-2023-2 - macOS Sonoma 14 addresses buffer overflow, bypass, code execution, out of bounds read, resource exhaustion, spoofing, and use-after-free vulnerabilities.

 Feed

Arm has released security patches to contain a security flaw in the Mali GPU Kernel Driver that has come under active exploitation in the wild. Tracked as CVE-2023-4211, the shortcoming impacts the following driver versions - Midgard GPU Kernel Driver: All versions from r12p0 - r32p0 Bifrost GPU Kernel Driver: All versions from r0p0 - r42p0 Valhall GPU Kernel Driver: All versions from r19p0 -

 Feed

APIs, also known as application programming interfaces, serve as the backbone of modern software applications, enabling seamless communication and data exchange between different systems and platforms. They provide developers with an interface to interact with external services, allowing them to integrate various functionalities into their own applications. However, this increased reliance on

 Feed

Security Configuration Assessment (SCA) is critical to an organization's cybersecurity strategy. SCA aims to discover vulnerabilities and misconfigurations that malicious actors exploit to gain unauthorized access to systems and data. Regular security configuration assessments are essential in maintaining a secure and compliant environment, as this minimizes the risk of cyber attacks. The

 Feed

Firewall and distributed denial-of-service (DDoS) attack prevention mechanisms in Cloudflare can be circumvented by exploiting gaps in cross-tenant security controls, defeating the very purpose of these safeguards, it has emerged. "Attackers can utilize their own Cloudflare accounts to abuse the per-design trust-relationship between Cloudflare and the customers' websites, rendering the

 Feed

Chipmaker Qualcomm has released security updates to address 17 vulnerabilities in various components, while warning that three other zero-days have come under active exploitation. Of the 17 flaws, three are rated Critical, 13 are rated High, and one is rated Medium in severity. "There are indications from Google Threat Analysis Group and Google Project Zero that CVE-2023-33106, CVE-2023-33107,

 Feed

Cybersecurity researchers have disclosed multiple critical security flaws in the TorchServe tool for serving and scaling PyTorch models that could be chained to achieve remote code execution on affected systems. Israel-based runtime application security company Oligo, which made the discovery, has coined the vulnerabilities ShellTorch. "These vulnerabilities [...] can lead to a full chain Remote

 Feed

Nearly three dozen counterfeit packages have been discovered in the npm package repository that are designed to exfiltrate sensitive data from developer systems, according to findings from Fortinet FortiGuard Labs. One set of packages – named @expue/webpack, @expue/core, @expue/vue3-renderer, @fixedwidthtable/fixedwidthtable, and @virtualsearchtable/virtualsearchtable – harbored an obfuscated

2023-10
Aggregator history
Tuesday, October 03
SUN
MON
TUE
WED
THU
FRI
SAT
OctoberNovemberDecember