ComputerWorldIndependent

Microsoft is distributing security patches through insecure HTTP links

Credit to Author: Woody Leonhard| Date: Fri, 16 Feb 2018 09:12:00 -0800

The Microsoft Update Catalog uses insecure HTTP links – not HTTPS links – on the download buttons, so patches you download from the Update Catalog are subject to all of the security problems that dog HTTP links, including man-in-the-middle attacks.

Security researcher Stefan Kanthak, writing on Seclist’s Bugtraq mailing list, elaborates:

Even if you browse the “Microsoft Update Catalog” via the HTTPS link,  ALL download links published there use HTTP, not HTTPS!

That’s trustworthy computing … the Microsoft way!

Despite numerous mails sent to <secure () microsoft com> in the last years, and numerous replies “we’ll forward this to the product groups,” nothing happens at all.

To read this article in full, please click here

Read More
SecurityTrendMicro

This Week in Security News: Senate Hearings and Equifax Breaches

Credit to Author: Jon Clay ((Global Threat Communications)| Date: Fri, 16 Feb 2018 14:00:53 +0000

Welcome to our weekly roundup, where we share what you need to know about the cybersecurity news and events that happened over the past few days. This week, leaders of six security agencies testified before the Senate Intelligence Committee, the Equifax hack grew in severity, and hackers used the power of Machine Learning to spread…

Read More