Legacy apps are at risk with the September Patch Tuesday update

Credit to Author: Greg Lambert| Date: Fri, 17 Sep 2021 12:28:00 -0700

This week’s Patch Tuesday was an unusual update from Microsoft and we have added Windows, the Microsoft development platform, and Adobe Reader to our “Patch Now” schedule.

These updates are driven by the zero-day patch (CVE-2021-40444) to the core Microsoft browser library MSHTML. In addition to leading to significant remote code execution worries, this update may also lead to unexpected behaviours in legacy applications that depend on or include this browser component. Be sure to assess your portfolio for key apps that have these dependencies and perform a full functionality test before deployment. (We have identified some key mitigation strategies for handling ActiveX controls and for protecting your system during your testing and deployment phases.)

To read this article in full, please click here

Read more

Trial Ends in Guilty Verdict for DDoS-for-Hire Boss

Credit to Author: BrianKrebs| Date: Fri, 17 Sep 2021 01:22:31 +0000

A jury in California today reached a guilty verdict in the trial of Matthew Gatrel, a St. Charles, Ill. man charged in 2018 with operating two online services that allowed paying customers to launch powerful distributed denial-of-service (DDoS) attacks against Internet users and websites. Gatrel’s conviction comes roughly two weeks after his co-conspirator pleaded guilty to criminal charges related to running the services.

Read more

It’s been a big week for patches

Credit to Author: Susan Bradley| Date: Thu, 16 Sep 2021 03:35:00 -0700

This week brought updates that I consider critical for the “Big Three” — my operating system (Windows), my browser (Google Chrome) and my phone (from Apple). All three releases patch major zero-day vulnerabilities on all three platforms.

While I strongly recommend that you patch Chrome and your iPhone as soon as possible, I always recommend that you hold back on updating Windows. That remains true — at least until we see whether there are any trending side effects from the Patch Tuesday updates.

Let’s break down the patching to do right away.

First, prioritize patching Apple devices. Among this week’s patches is one for Pegasus spyware, which can open up access to the camera and microphone as well as text messages, phone calls, and emails.  iPhones, in particular, have been targeted. Apple typically pushes these updates overnight if your phone is plugged in and charging (and connected to the Internet). If you want to make sure your iPhone has received the update, click on Settings, then General, then tap Software Update. Typically, after my iPhone updates, some apps may need passwords again. I personally try to save critical ones in the iCloud keychain. Look for patches for iOS 14.8 and iPad OS 14.8, and Security Update 2021-005 for macOS Catalina and Big Sur 11.6.

To read this article in full, please click here

Read more

Windows 11: Just say no

Credit to Author: Steven J. Vaughan-Nichols| Date: Thu, 16 Sep 2021 03:15:00 -0700

It will be one thing, say, later this year or in 2022, to buy a new PC with Windows 11. We can be reasonably certain that Windows 11 will run on your new Dell, HP, or Lenovo PC. Maybe some of your drivers and programs won’t run, but Windows 11 itself? No problem.

But, if you want to update your existing computers, especially those that have a few years on them — that’s another story. It’s difficult to know whether any given computer will run Windows 11, which arrives Oct. 5. Yes, there’s Microsoft’s PC Health Check app and other programs to determine whether you can run Windows 11. But Microsoft pulled it the first time around and I’m none too sure how reliable it is this time around.

To read this article in full, please click here

Read more

Apple hits the alarm with multi-OS emergency update to patch zero-click flaw

Credit to Author: Gregg Keizer| Date: Tue, 14 Sep 2021 13:53:00 -0700

Apple on Monday issued emergency security updates for iOS, macOS and its other operating systems to plug a hole that Canadian researchers claimed had been planted on a Saudi political activist’s device by NSO Group, an Israeli seller of spyware and surveillance software to governments and their security agencies.

Updates to patch the under-active-exploit vulnerability were released for iOS 14; macOS 11 and 10, aka Big Sur and Catalina, respectively; iPad OS 14; and watchOS 7.

According to Apple, the vulnerability can be exploited by “processing a maliciously crafted PDF,” which “may lead to arbitrary code execution.” The phrase “arbitrary code execution” is Apple’s way of saying that the bug was of the most serious nature; Apple does not rank threat level of vulnerabilities, unlike operating system rivals such as Microsoft and Google.

To read this article in full, please click here

Read more

Microsoft Patch Tuesday, September 2021 Edition

Credit to Author: BrianKrebs| Date: Tue, 14 Sep 2021 21:00:42 +0000

Microsoft today pushed software updates to plug dozens of security holes in Windows and related products, including a vulnerability that is already being exploited in active attacks. Also, Apple has issued an emergency update to fix a flaw that’s reportedly been abused to install spyware on iOS products, and Google’s got a new version of Chrome that tackles two zero-day flaws. Finally, Adobe has released critical security updates for Acrobat, Reader and a slew of other software.

Read more

KrebsOnSecurity Hit By Huge New IoT Botnet “Meris”

Credit to Author: BrianKrebs| Date: Fri, 10 Sep 2021 18:12:44 +0000

On Thursday evening, KrebsOnSecurity was the subject of a rather massive (and mercifully brief) distributed denial-of-service (DDoS) attack. The assault came from “Meris,” the same new “Internet of Things” (IoT) botnet behind record-shattering attacks against Russian search giant Yandex this week and internet infrastructure firm Cloudflare earlier this summer.

Read more