Archive for category: Windows Security

You are here: / Windows Security

PATCH Critical MS14-066 ASAP People!

Information pertaining to a Proof of Concept for the Critical MS14-066 is reported close to being implemented.  The MS14-066 is a vulnerability in the Microsoft Secure Channel (Schannel) security package in Windows that may allow remote code execution if an attacker sends specially crafted packets to a Windows server.  The Microsoft Secure Channel (Schannel) is the component that implements the secure sockets layer and transport layer security (TLS) protocols.

Microsoft has been forced to issue a critical patch for a vulnerability stated that it “had not received any information to indicate that this vulnerability had been publicly used to attack customers”.

That can be short live between active developers trying to implement an exploit and once the patch is released, is will be reverse engineered from the patch.  From there it can be coded into a worm or mass botnet exploit which self-replicates causing immense damage.

A few security researchers have stated MS14-066 is actually worse than The Heartbleed Bug back in April 2014.

“If you have a windows server serving ANYTHING to the internet, patch now and save yourself a headache later.  This one is going to be big!”

You can read the actual Microsoft Bulletin (MS14-066) here – Vulnerability in Schannel Could Allow Remote Code Execution (2992611)

Windows XP Support Ending, What does that mean to you?

Support for Microsoft’s popular operating system, Windows XP will end on April 8, 2014, 12 years after it was introduced to PC users.  By that, Microsoft will no longer provide security updates or technical support for the Windows XP operating system to the user community.  securityorb.com/, an information security, privacy and internet safety awareness organization recommend users that are currently using Windows XP, migrate to a modern operating system such as Windows 7 or Windows 8.1 if possible.  If users do not migrate to a modern operating system, they will eventually increase their risk exposure exponentially as time increases.

Another areas of concern also lie with the banking industry.  At it highest point 92% of automated teller machines (ATMs) worldwide operated on Windows XP.  Recent speculation, In spite of numerous upgrading projects, estimate there are still perhaps 80% of ATM still operating on the Windows XP platform, both abroad and in the US (Seltzer, Feb 2014).

Even though the current ATM situation does pose some security risk, the positive aspect of this scenario is ATMs as well as other devices such as Point of Sales (PoS) run Windows in what Microsoft describes “with embedded restrictions” until 2016.  Embedded restrictions makes the device that it is operating on look and act less like a regular computer and minimize its attack surface as well.

securityorb.com/ has identified locations and personnel that maybe slow to migrate from Windows XP to a modern operating system.  They are as follows:

  • Senior citizens
  • Small businesses and solos
  • Smaller Non-profits
  • Individuals that may have been donated a computer

In addition to Windows XP coming to an end on April 8, 2014, support for Windows Server 2003, Exchange Server 2003, Small Business Server 2003 and Office 2003 are also on the chopping block.

Again, it is recommended that you upgrade and if you are not able to upgrade, understand the risk and operate accordingly until you can.

September 2013 Patch Tuesday Preview

Microsoft announced its lineup for next week’s Patch Tuesday. We will get 14 bulletins, already bringing the number for this year to 80 in September. We are well on our way to getPatch-Tuesday_CJCOMPUTERS more than 100 bulletins this year compared to 83 in 2012 and exactly 100 in 2011, a good reflection of how challenging the computer security business continues to be.

Of the 14 bulletins, the first eight are rated as “Remote Code Execution,” which is the type of weakness that attackers are after when looking for ways to get into your network. Bulletins #1 to #4 are rated “critical” by Microsoft indicating that they can be exploited only with user interaction. Bulletin #1 is for Sharepoint Server and should be the highest priority on the list for your server administrators, after diligent testing to assure that the patch does not impact any business critical functionality. Bulletin #2 should be high priority for your desktop security team; it addresses a flaw in Microsoft Office that can be triggered simply by previewing an e-mail in Outlook, even without explicitly opening the e-mail. Outlook in Office 2007 and 2010 is affected.

Bulletin #3 is a critical update for Internet Explorer (IE) affecting all versions starting from IE6 to IE10 and including Windows 8 and Windows RT. Bulletin #4, the last critical bulletin, addresses a flaw in Windows, but only affects the soon-to-be legacy operating systems Windows XP and Windows Server 2003. You should be phasing those out by now since they lose support for security patches in April of next year, similar to Office 2003 which will also lose support in April. Those operating systems and the Office suite will then start to accumulate unfixed vulnerabilities and become a magnet for attackers who will have access to easy-to-use and surefire tools to exploit setups that run on XP/2003 or that have Office 2003.

Read the rest here.

Hackers may cash in when XP is retired

An interesting article from ComputerWorld.com‘s Security Section:

Hackers could find themselves in the catbird seat on April 8, 2014 — the day Microsoft plans to stop patching Windows XP. As security expert Jason Fossen sees it, those who have zero-day exploits for XP will bank them until that day and then sell them to crooks or loose them themselves on unprotected PCs.

It’s simply economics at work, said Fossen, a trainer for the SANS Institute since 1998.

“The average price on the black market for a Windows XP exploit is $50,000 to $150,000, a relatively low price that reflects Microsoft’s response,” said Fossen. When a new vulnerability — dubbed a “zero-day” — is detected, Microsoft investigates, pulls together a patch and releases it to XP users.

But the price will go up when Microsoft stops patching its aged operating system.

Fossen acknowledged that there really aren’t any precedents to back up his speculation, because the last time Microsoft retired an operating system was in July 2010, when it pulled the plug on Windows 2000, which wasn’t nearly as widely used as XP is.

Read more here.

Microsoft security update may break Windows 7

an posting from NBC news in there Technology section: A security update that Microsoft pushed out earlier this week crashes some Windows 7, Windows Server 2008 and Windows Vista machines, forcing them into an endless cycle of reboots that can only be stopped by repairing the operating systems.

Microsoft recommends that all Windows 7 users uninstall the security update.

The update came as a part of Patch Tuesday, Microsoft’s longstanding tradition of releasing security patches on the second Tuesday of each month. The main vulnerability that this month’s update addressed required a would-be hacker to possess valid login credentials and physically interact with a computer. Although this issue was not critical by itself, some of the other problems that Patch Tuesday addressed were.

To read more click here:

Four Ways To Strengthen SMB Password Security

An posting from Dark reading: Passwords are the weak link for companies of all sizes, but many small and midsize businesses (SMBs) rely on their workers to make the right choice in selecting strong passwords.
Unfortunately, when left to their own devices, most employees do not get it right: Either due to a lack of security education or a desire for efficiency, people make the wrong choices when it comes to passwords. While almost 90 percent of people think they select good passwords, 61 percent reuse their passwords across sites and more than half have five or fewer passwords, according to a September 2012 survey of consumers by CSID, an identity management and fraud-protection firm.

To read more click here:

Russian ransomware takes advantage of Windows PowerShell

An interesting article from Naked Security: For us in SophosLabs, ransomware is a common sight. We see many different versions every day. But as to be expected, the authors think up a new gimmick that makes us take notice. This is one of those cases.

Recently we received a ransomware sample from one of our customers, which immediately piqued our interest as it used Windows PowerShell program to perform file encryption.

To read more click here:

 

Windows 8 to get first ‘critical’ security update

Windows 8, available publicly for two weeks now, is getting its first security update Nov. 13. It includes three critical updates; Windows 8 RT, for Microsoft’s Surface tablet, has one critical update.

The vulnerabilities could allow a hacker to execute malicious code remotely on systems that aren’t protected. You can learn more here. You can make sure you get the updates by setting your computer to automatically accept updates from Microsoft.

There will be other updates too, for other versions of Windows, including Windows 7, Vista and XP, as well as for Internet Explorer.

Meanwhile, security firm Bitdefender said Friday in its own testing that Windows 8, using Microsoft’s own Windows Defender anti-malware protection, was “prone to infection” by 15 percent of the 100 malware “families most used by cyber criminals this year.”

Read more at NBCNews.com

 

Microsoft Urges Customers to Install Security Tool

Reuters
Posted at 09/18/2012 9:51 AM | Updated as of 09/18/2012 9:57 AM

BOSTON – Microsoft Corp urged Windows users on Monday to install a free piece of security software to protect PCs from a newly discovered bug in the Internet Explorer browser.

The security flaw, which researchers say could allow hackers to take remote control of an infected PC, affects Internet Explorer browsers used by hundreds of millions of consumers and workers. Microsoft said it will advise customers on its website to install the security software as an interim measure, buying it time to fix the bug and release a new, more secure version of Internet Explorer.

The free security tool, which is known as the Enhanced Mitigation Experience Toolkit, or EMET, is available on Microsoft’s website.

Eric Romang, a researcher in Luxembourg, discovered the flaw in Internet Explorer on Friday, when his PC was infected by a piece of malicious software known as Poison Ivy that hackers use to steal data or take remote control of PCs.

When he analyzed the infection, he learned that Poison Ivy had gotten on to his system by exploiting a previously unknown bug, or “zero-day” vulnerability, in Internet Explorer.

“Any time you see a zero-day like this, it is concerning,” said Liam O Murchu, a research manager with anti-virus software maker Symantec Corp. “There are no patches available. It is very difficult for people to protect themselves.”

Zero-day vulnerabilities are rare, mostly because they are hard to identify – requiring highly skilled software engineers or hackers with lots of time to scrutinize code for holes that can be exploited to launch attacks. Security experts only disclosed discovery of eight major zero day vulnerabilities in all of 2011, according Symantec.

Symantec and other major anti-virus software makers have already updated their products to protect customers against the newly discovered bug in Internet Explorer. Yet O Murchu said that may not be sufficient to ward off adversaries.

“The danger with these types of attacks is that they will mutate and the attackers will find a way to evade the defenses we have in place,” he said.

Some security experts said computer users should avoid Internet Explorer, even if they install the EMET security tool available from Microsoft.

“It doesn’t appear to be completely effective,” said Tod Beardsley, an engineering manager with the security firm Rapid7.

Rapid7 released software on Monday that security experts can use to simulate attacks that exploit the security flaw in Internet Explorer to see whether corporate networks are vulnerable to that particular bug.

Marc Maiffret, chief technology officer of the security firm BeyondTrust, said it may not be feasible for some businesses and consumers to install Microsoft’s EMET tool on their PCs.

He said the security software has in some cases proven to be incompatible with existing programs already running on networks.

Dave Marcus, director of advanced research and threat intelligence with Intel Corp’s McAfee security division, said it might be a daunting task for home users to locate, download and install the EMET tool.

Security Bulletin: MS12-020 high-risk vulnerability in the RDP (Remote Desktop)

On March 14, 2012, Microsoft released a critical software patch that fixes a very high-risk vulnerability in the RDP (Remote Desktop) service installed on most Windows-based systems.  The vulnerability may allow the execution of malicious code by sending a malformed packet to an RDP enabled system.

Security Bulletin: MS12-020

Description: Vulnerabilities in Remote Desktop Could Allow Remote Code Execution (2671387)

Rating: Critical

Action: Reboot Required

The issue became very critical when the proof-of-concept exploit code for the MS12-020 RDP vulnerability was leaked. It has been suspected Microsoft has a leak or somewhere in its MAPP information-sharing program.

Be sure to move on this quickly folks…

Below is a video demo: