Afraid of missing important security news during the week? We're here to help! Every week we put together a curated list of all important security news in one place, for your reading pleasure. Enjoy!    For the

If you’re a security researcher, you might have been wondering what happens to you this week.

Als je een beveiligingsonderzoeker bent, vraag je je misschien af wat er deze week met je gebeurt.

Afraid of missing important security news during the week? Every week we put together a curated list of all important security news in one place, for your reading pleasure. You can subscribe to one of our feeds on Twitter, Facebook or RSS.

Bang om belangrijk veiligheidsnieuws te missen tijdens de week? Elke week stellen wij een lijst samen van al het belangrijke beveiligingsnieuws op één plaats, voor uw leesplezier. U kunt zich abonneren op een van onze feeds op Twitter, Facebook of RSS.

Afraid of missing important security news during the week? We’re here to help! Every week we put together a curated list of all important security news in one place, for your reading pleasure. Enjoy!

For the less technical
• Up to 90% of governmental websites include cookies of third-party trackers
• Japan makes ‘online insults’ punishable by one year in prison after TV star’s death
• Ransomware gang now lets you search their stolen data
• CEO of dozens of companies and entities charged in scheme to taffic an estimated $1 billion in fraudulent and counterfeit Cisco networking equipment
• [AUDIO] Interview with Alexandre Dulaunoy about tools produced by CIRCL

For the more technical
• From Follina to Rozena – Leveraging Discord to distribute a backdoor
• From cookie theft to BEC: Attackers use AiTM phishing sites as entry point to further financial fraud
• How bad actors can abuse block explorers to trick you
• This is the code the FBI used to wiretap the world
• OrBit: New undetected Linux threat uses unique hijack of execution flow
• BlackCat (aka ALPHV) ransomware is increasing stakes up to $2,5m in demands
• New ransomware groups on the rise
• Mantis – the most powerful botnet to date
• From industrial-scale scam centers, trafficking victims are being forced to steal billions
• Luna Moth: The actors behind the recent false subscription scams
• Why organizations should (and should not) worry about KillNet

Did you enjoy this list? You can subscribe to one of our feeds on Twitter, Facebook or RSS.

IT Security Weekend Catch Up – July 15, 2022

Based on its observations of Russia’s cyber assault on Ukraine, Microsoft has developed these strategic steps for global organizations to take to safeguard their operations.

Since the start of the conflict in Ukraine, Microsoft has published a report on how to protect businesses against cyber attacks.

Sinds het begin van het conflict in Oekraïne heeft Microsoft een rapport gepubliceerd over hoe bedrijven te beschermen tegen cyberaanvallen.

In January, the Microsoft Threat Intelligence Center (MSTIC) discovered wiper malware in more than a dozen networks in Ukraine. We alerted the Ukrainian government and published our findings. Since then, we have continued working closely with Ukrainian government officials and cybersecurity staff at government organizations and private enterprises to identify and address threat activity against Ukrainian networks.

Sindsdien zijn wij nauw blijven samenwerken met Oekraïense overheidsfunctionarissen en cyberbeveiligingsmedewerkers van overheidsorganisaties en particuliere ondernemingen om dreigingen tegen Oekraïense netwerken te identificeren en aan te pakken. In het proces hebben wij ook nieuwe strategieën ontdekt voor de aanpak van netwerkverdediging te midden van militaire conflicten. Op basis van onze observaties van de cyberaanval van Rusland op Oekraïne, hebben we top strategische aanbevelingen ontwikkeld voor wereldwijde organisaties.

In January, the Microsoft Threat Intelligence Center (MSTIC) discovered wiper malware in more than a dozen networks in Ukraine. Designed to look like ransomware but lacking a ransom recovery mechanism, we believe this malware was intended to be destructive and designed to render targeted devices inoperable rather than obtain a ransom. We alerted the Ukrainian government and published our findings.

Since then, we have continued working closely with Ukrainian government officials and cybersecurity staff at government organizations and private enterprises to identify and address threat activity against Ukrainian networks. This focused engagement, in combination with our unique view into affected systems, has offered insight into ongoing Russian cyber targets, tactics, and procedures. In the process, we have also discovered new strategies on how to approach network defense in the midst of military conflict.

Based on our observations of Russia’s cyber assault on Ukraine, we’ve developed top strategic recommendations for global organizations.

A brief overview of Russia’s destructive attacks on Ukraine

Microsoft has observed known and suspected Russian nation-state actors use multiple techniques to compromise Ukrainian targets, including phishing campaigns, exploiting unpatched vulnerabilities in on-premises Exchange servers, and compromising upstream IT service providers.

Threat groups with known or suspected ties to the GRU, Russia’s military intelligence service, have also developed and used destructive wiper malware or similarly destructive tools on Ukrainian networks. From February 23 to April 8, 2022, Microsoft saw evidence of nearly 40 discrete destructive attacks that permanently destroyed files in hundreds of systems across dozens of organizations in Ukraine.

More than 40% of the attacks were aimed at organizations in critical infrastructure sectors, and 32% of destructive incidents affected Ukrainian government organizations at the national, regional, and city levels. After each wave of attacks, threat actors modified the malware to better avoid detection. While we cannot observe all ongoing activity in Ukraine, we estimate that there have been at least eight destructive malware families deployed on Ukrainian networks to date — including one tailored to industrial control systems (ICS).

Throughout our engagement in Ukraine, we’ve observed several common tactics, techniques, and procedures by Russia-aligned cyber operations. These include:
• Exploiting public-facing applications or spear-phishing with attachments/links for initial access.
• Stealing credentials and leveraging valid accounts throughout the attack lifecycle, including within Active Directory Domain Services and through virtual private networks (VPNs) or other remote access solutions. This has made “identities” a key intrusion vector.
• Using valid administration protocols, tools, and methods for lateral movement, relying on compromised administrative identities in particular.
• Utilizing known publicly available offensive capabilities, sometimes disguising them with actor-specific methods to defeat static signatures.
• “Living off the land” during system and network discovery, often utilizing native utilities or commands that are non-standard for the environments.
• Leveraging destructive capabilities that access raw file systems for overwrites or deletions.

In an attempt to proactively counter these attacks, Ukrainian organizations enabled controlled folder access in Microsoft Defender and were able to meaningfully mitigate some of the damage done by destructive wiper malware. Additionally, because our Ukrainian partners were using Microsoft Defender for Endpoint, we were able to observe how endpoint detection and response (EDR) solutions can respond to alerts and remediate intrusions before destructive attacks were launched.

Based on our observations in Ukraine so far, we recommend taking the following steps to safeguard your organization:
• Minimize credential theft and account abuse: Protecting user identities is a critical component of network security. We recommend enabling multi-factor authentication (MFA) and identity detection tools, applying least-privilege access, and securing the most sensitive and privileged accounts and systems.
• Secure internet-facing systems and remote access solutions: Ensure your internet-facing systems are updated to the most secure levels, regularly evaluated for vulnerability, and audited for changes to system integrity. Anti-malware solutions and endpoint protection can detect and prevent attackers, while legacy systems should be isolated to prevent them from becoming an entry point for persistent threat actors. Additionally, remote access solutions should require two-factor authentication and be patched to the most secure configuration.
• Leverage anti-malware, endpoint detection, and identity protection solutions: Defense-in-depth security solutions combined with trained, capable personnel can empower organizations to identify, detect, and prevent intrusions impacting their business. You can also enable cloud-protections to identify and mitigate known and novel network threats at scale.
• Enable investigations and recovery: Auditing of key resources can help enable investigations once a threat is detected. You can also prevent delays and decrease dwell time for destructive threat actors by creating and enacting an incident response plan. Ensure your business has a backup strategy that accounts for the risk of destructive actions and is prepared to exercise recovery plans.
• Defend against destructive attacks: Leverage features within Microsoft Defender such as Attack Surface Reduction (ASR) and Controlled Folder Access (CFA) to help safeguard your organization against destructive attacks. Based on our observations, these features have been successful in defeating destructive attacks in Ukraine and elsewhere.
• Review and implement “best practices” for defense in depth: Whether your environment is cloud-only, or a hybrid enterprise spanning cloud(s) and on-premises data centers, we have developed extensive resources and actionable guidance to help improve your security posture and reduce risk. Microsoft’s security best practices covers governance, risk, compliance, security operations, identity and access management, network security and containment, information protection and storage, applications, and services.

What this means for the global cybersecurity landscape

As the war in Ukraine progresses, threat actors with a vested interest in the conflict will be increasingly pushed to fill critical intelligence gaps and achieve their tactical objectives. We expect to discover new vulnerabilities and attack chains as a result of the ongoing conflict, forcing already well-resourced threat actors to reverse patches and carry out “N-day attacks” tailored to underlying vulnerabilities. These new discoveries will likely expand across multiple categories of threat actors.

Additionally, as the conflict persists and countries provide assistance to Ukraine, Russian nation state threat actors may retaliate. Russia-aligned actors active in Ukraine have shown interest in and conducted operations against organizations in the Baltics and Turkey — all member states on NATO’s eastern flank that are actively providing political, humanitarian, or military support to Ukraine. We encourage all organizations that are directly or indirectly associated with the conflict in Ukraine to proactively protect themselves from the threats we’ve observed so far and actively monitor for similar actions in their environment.

Microsoft respects and acknowledges the ongoing efforts of Ukrainian defenders and the unwavering support provided by the national Computer Emergency Response Team of Ukraine (CERT-UA) to protect their networks and maintain service during this challenging time.

For a more detailed timeline of Russia’s cyber assault on Ukraine, explore the full report.

What Every Enterprise Can Learn from Russia’s Cyber Assault on Ukraine

Notadszones.com can generate revenue from people's clicks on push notifications. Notadszones.com is a deceptive website that uses social engineering methods to trick people into subscribing

In this article, we explain how to remove unwanted adverts from web browsers.

In dit artikel leggen we uit hoe u ongewenste advertenties uit webbrowsers kunt verwijderen.

Intego scanner and manual repair option is free. More information about Reimаge and Uninstall Instructions . Reimаge scanner and manual repair option is free.

Intego scanner en handmatige reparatie optie is gratis. Meer informatie over Reimаge en Uninstall Instructies . Reimаge scanner en handmatige reparatie optie is gratis.

More information about Intego and Uninstall Instructions . Please review Intego EULA and Privacy Policy . Intego scanner and manual repair option is free. An advanced version must be purchased.

More information about Reimаge and Uninstall Instructions . Please review Reimаge EULA and Privacy Policy . Reimаge scanner and manual repair option is free. An advanced version must be purchased.

Notadszones.com is a dubious page asking users to click the "Allow" button to grant permission for push notifications. These notifications do not provide any valuable content like news, updates, etc. Users start getting spammed with pop-up ads that may lead to dangerous websites. Read our guide to learn more.

Notadszones.com can generate revenue from people's clicks on push notifications

Notadszones.com can cause annoying pop-up ads to appear on the screen

Notadszones.com is a deceptive website that uses social engineering[1] methods to trick people into subscribing to push notifications. It displays a fake image and message that asks users to click “Allow” to verify that they are not robots. In reality, the button grants permission for the site to start showing notifications.

Users may start getting spammed with intrusive pop-up ads that can appear even when the browser is closed. Crooks can use rogue advertising networks[2] that place ads leading to dangerous websites. People can be fooled into providing personal information, downloading PUPs (potentially unwanted programs),[3] and malware.

There are hundreds of pages, like Notadszones.com that manipulate people into clicking the “Allow” button. You may encounter messages such as:

We previously wrote about pages, like Digitalpush.org, Totalwownews.com, and News-relimo.cc. The scheme they use might remind some people of a CAPTCHA verification process. However, a legitimate human verification step would never ask to choose between “Block” and “Allow” on a browser prompt.

A real CAPTCHA verification usually asks users to identify certain objects in pictures, like crosswalks, and traffic lights, or to simply check a box. Do not believe sites that require you to click something in order to access content because normally, trustworthy pages want to make it as easy as possible.

Notadszones.com uses clever manipulation tactics to get users to click "Allow"

It is rare for people to stumble upon push notification spam sites on the search results. Usually, they hide in other shady pages that engage in illegal activities. For example, illegal streaming platforms are full of deceptive ads and sneaky redirects that can open new tabs with websites from rogue advertising networks. You should not click on random links. Be careful of fake “Download” and “Play” buttons as well.

Another possibility is that the site appeared without any user input at all. This can happen if there is adware – advertising-supported software hiding in the system. It can cause an increased amount of commercial content, like pop-ups, banners, and redirects without the users' knowledge.

Push notifications are based on a subscription model, so users can enable and disable them manually in the browser settings. If you need help with the process, follow the guide below:
• Open Google Chrome browser and go to Menu > Settings.
• Scroll down and click on Advanced.
• Look at the Allow section and look for a suspicious URL.
• Click the three vertical dots next to it and pick Block. This should remove unwanted notifications from Google Chrome.
• Open Google Chrome and tap on Settings (three vertical dots).
• Scroll down to the Sites section.
• Locate the unwanted URL and toggle the button to the left (Off setting).
• Open Mozilla Firefox and go to Menu > Options.
• Under Permissions, you should be able to see Notifications. Click the Settings button next to it.
• In the Settings – Notification Permissions window, click on the drop-down menu by the URL in question.
• Select Block and then click on Save Changes. This should remove unwanted notifications from Mozilla Firefox.
• Go to the Websites tab and, under General, select Notifications.
• Select the web address in question, click the drop-down menu and select Deny.
• Open Microsoft Edge, and click the Settings and more button (three horizontal dots) at the top-right of the window.
• Select Settings and then go to Advanced.
• Under Website permissions, pick Manage permissions and select the URL in question.
• Toggle the switch to the left to turn notifications off on Microsoft Edge.
• Open Microsoft Edge, and go to Settings.
• Go to Notifications on the right.
• Under Allow, you will find the unwanted entry.
• Click on More actions and select Block.

How to prevent websites from tracking me?

All of the pages that you visit use cookies[4] to track your browsing activities. Generally, this is not a bad thing as it helps websites to personalize the user experience but in some cases, it can cause a lot of issues. If the pages you visit do not have strong security, cookies can be hijacked and used for malicious purposes. Untrustworthy pages can also sell them to advertising networks and other third parties.

That is why it is important to clear your browsers regularly. This can be automated with a maintenance tool like ReimageIntego. It can delete all cookies and cache and also fix system damage, errors, registry issues which is especially helpful after a virus infection.

Once you block the notifications, there is still a chance that there is adware hiding in your system. It is a type of PUP that can generate commercial content in the machine without your knowledge or consent. If you are still experiencing an increased amount of commercial content like surveys, banners, and redirects to suspicious pages, we strongly suggest deploying professional security tools like SpyHunter 5Combo Cleaner or Malwarebytes to scan your machine.

They can detect suspicious processes running in your machine and eliminate all the files causing it. What is more, it can prevent such infections in the future by warning you about a dangerous download. Of course, you can remove programs manually, but it can be difficult to identify PUPs as they can be disguised as “handy” tools that you use every day. If you want to perform manual removal, you can follow the instructions posted below for Windows and Mac systems:
• Enter Control Panel into Windows search box and hit Enter or click on the search result.
• From the list, find the entry of the suspicious program.
• Right-click on the application and select Uninstall.
• If User Account Control shows up, click Yes.
• Wait till uninstallation process is complete and click OK.
• Click on Windows Start > Control Panel located on the right pane (if you are Windows XP user, click on Add/Remove Programs).
• Pick the unwanted application by clicking on it once.
• In the confirmation prompt, pick Yes.
• Click OK once the removal process is finished.
• From the menu bar, select Go > Applications.
• In the Applications folder, look for all related entries.
• Click on the app and drag it to Trash (or right-click and pick Move to Trash)

To fully remove an unwanted app, you need to access Application Support, LaunchAgents, and LaunchDaemons folders and delete relevant files:
• Select Go > Go to Folder.
• Enter /Library/Application Support and click Go or press Enter.
• In the Application Support folder, look for any dubious entries and then delete them.
• Now enter /Library/LaunchAgents and /Library/LaunchDaemons folders the same way and terminate all the related .plist files.

Remove Notadszones.com ads (spam) - Free Instructions

The high-severity RCE flaw is in the KCodes NetUSB kernel module, used by popular routers from Netgear, TP-Link, DLink, Western Digital, et al.

A security vulnerability in the net could be exploited by hackers, according to a new report from SentinelOne.

Volgens een nieuw rapport van SentinelOne kan een beveiligingslek in het net door hackers worden misbruikt.

Millions of popular end-user routers are at risk of remote code execution (RCE) due to a high-severity flaw in the KCodes NetUSB kernel module. The module enables remote devices to connect to routers over IP and access any USB devices (such as printers, speakers, webcams, flash drives and other peripherals) that are plugged into them. This is made possible using the proprietary NetUSB protocol and a Linux kernel driver that launches a server, which makes the USB devices available via the network.

Miljoenen populaire eindgebruikersrouters lopen het risico van remote code execution (RCE) als gevolg van een zeer ernstige fout in de KCodes NetUSB kernelmodule. Dit wordt mogelijk gemaakt door het eigen NetUSB-protocol en een Linux-kerneldriver die een server opstart, die de USB-apparaten via het netwerk beschikbaar maakt. Volgens een dinsdag gepubliceerd rapport van SentinelOne beveiligingsonderzoeker Max Van Amerongen, zouden aanvallers de kwetsbaarheid op afstand kunnen misbruiken om code in de kernel uit te voeren via een beveiligingslek door een pre-authenticatie bufferoverloop, waardoor het apparaat kan worden overgenomen.

Millions of popular end-user routers are at risk of remote code execution (RCE) due to a high-severity flaw in the KCodes NetUSB kernel module.

The module enables remote devices to connect to routers over IP and access any USB devices (such as printers, speakers, webcams, flash drives and other peripherals) that are plugged into them. This is made possible using the proprietary NetUSB protocol and a Linux kernel driver that launches a server, which makes the USB devices available via the network. For remote users, it’s as if the USB devices are physically plugged into their local systems.

According to a Tuesday writeup from SentinelOne vulnerability researcher Max Van Amerongen, attackers could remotely exploit the vulnerability to execute code in the kernel via a pre-authentication buffer overflow security vulnerability, allowing device takeover.



 NetUSB is licensed to a slew of popular router vendors, including:

Fortunately, SentinelOne hasn’t yet spotted evidence of the flaw having been exploited in the wild.

As is his wont, Van Amerongen found the bug while poking around at a target of the Pwn2Own hacking contests: the aforementioned Netgear router, R6700v3. The device appeared in the 2019 Pwn2Own conference as well as being named as a target in Pwn2Own Austin 2021.

He came across the NetUSB kernel module while sifting through various paths through various binaries, where he saw something fishy: “As it turned out, this module was listening on TCP port 20005 on the IP 0.0.0.0,” Van Amerongen explained. “Provided there were no firewall rules in place to block it, that would mean it was listening on the WAN as well as the LAN. Who wouldn’t love a remote kernel bug?”

He does love to pop kernels: In November, Van Amerongen wrote up a bug (CVE-2021-43267) that he discovered in a Transparent Inter Process Communication (TIPC) message type that allows Linux nodes to send cryptographic keys to each other. The critical heap-overflow security vulnerability in the Linux kernel could have allowed local exploitation and RCE, leading to full system compromise.

This isn’t the first time a worrisome NetUSB vulnerability has been discovered, either. In 2015, there was another kernel stack buffer overflow in KCodes NetUSB. That discovery led to a “very helpful exploit” that helped to quickly verify the more recent vulnerability, Van Amerongen recounted.

The USB connection process starts with a handshake between the PC and router that initializes communication: a handshake that SentinelOne depicted in the graphic below.

What comes next after the handshake is a command-parsing while-loop, which contains the following code:

“SoftwareBus_fillBuf acts in a similar way to recv by taking both a buffer and its size, filling the buffer with data read from the socket,” Van Amerongen wrote.

The vulnerable chunk of code in the kernel module is triggered when the command 0x805f reaches the following code in the function SoftwareBus_dispatchNormalEPMsgOut:

“Four bytes are fetched from the remote PC,” the researcher continued. “The number 0x11 is added to it and then used as a size value in kmalloc. Since this supplied size isn’t validated, the addition of the 0x11 can result in an integer overflow. For example, a size of 0xffffffff would result in 0x10 after 0x11 has been added to it.”

This allocated region is then used and written to through both dereferencing and through the SoftwareBus_fillBuf function, he continued, as shown below.

“Looking at the final call to SoftwareBus_fillBuf, the supplied size is used as a maximum value to read from the remote socket,” Van Amerongen said. “From the previous example, the size 0xffffffff would be used here (not the overflown value) as the size sent to recv.”

Along with its report, SentinelOne sent a suggested mitigation strategy, shown below. This integer overflow check should be performed before allocating memory with user supplied sizes, the firm noted:

There are a number of factors that play into the feasibility of exploiting this bug, according to the analysis:

Size that can be allocated: The minimum size that can be allocated is 0x0, and the maximum is 0x10. “That means that the allocated object will always be in the kmalloc-32 slab of the kernel heap,” Van Amerongen noted.

The amount of control over the overflow itself: The attacker controls the data being received over the socket, but is the size negotiable? “Since a size of 0xffffffff is not realistically exploitable on a 32-bit system, it’s necessary to take a look at how SoftwareBus_fillBuf actually works,” the researcher explained. “Underneath this function is the standard socket recv function. That means that the size supplied is only used as a maximum receive size and not a strict amount, like memcpy.”

Ease of laying out the kernel heap for the overflow: “Many exploits require the use of heap holes in order to make sure that the vulnerable heap structure will be placed before the object that will be overwritten,” Van Amerongen added. “In the case of this kernel module, there’s a timeout of 16 seconds on the socket for receiving data, meaning the struct can be overflown up to 16 seconds after it is allocated. This removes the need to create a heap hole.”

Constraints regarding which target structures could be overwritten:
• The structure must be less than 32 bytes in size in order to fit into kmalloc-32
• The structure must be sprayable from a remote perspective
• The structure must have something that can be overwritten that makes it useful as a target (e.g. a Type-Length-Value structure or a pointer)

Bottom line: It’s not a trivial task to write an exploit for this vulnerability, but SentinelOne doesn’t think it’s impossible, and it’s too critical to ignore. “This vulnerability affects millions of devices around the world and in some instances may be completely remotely accessible,” Van Amerongen stressed.

Given that the vulnerability is in a third-party component licensed to various router vendors, that means the only fix is a firmware update rolling out from each specific vendor – if it’s even available.

SentinelLabs began the disclosure process on Sept. 9, and the patch was sent to all vendors on Oct. 4. On Dec. 14, Netgear had released fixed firmware for its R6700v3 device (version 1.0.4.122). And on Dec. 20, Netgear released an advisory about the flaw, with patches for D7800 models (firmware version 1.0.1.68) and R6400v2 routers (fixed in firmware version 1.0.4.122).

All of the other vendors affected by the NetUSB bug are aware of the vulnerability and have either fixed it or in the process of fixing it, according to SentinelOne. However, if a router is end-of-life, that update may never come.

Long story short: Router owners should be on the lookout for a firmware update, Van Amerongen concluded. If none’s forthcoming, the mitigation listed above is the way to go.

“While we are not going to release any exploits for it, there is a chance that one may become public in the future despite the rather significant complexity involved in developing one,” he said. “We recommend that all users follow the remediation information above in order to reduce any potential risk.”

Password Reset: On-Demand Event: Fortify 2022 with a password-security strategy built for today’s threats. This Threatpost Security Roundtable, built for infosec professionals, centers on enterprise credential management, the new password basics and mitigating post-credential breaches. Join Darren James, with Specops Software and Roger Grimes, defense evangelist at KnowBe4 and Threatpost host Becky Bracken. Register & stream this FREE session today – sponsored by Specops Software.

Millions of Routers Exposed to RCE by USB Kernel Bug

After deploying the initial attack, the researcher was able to escape the macOS sandbox

Apple has revealed a security flaw that could allow hackers to hack into Mac computers.

Apple heeft een beveiligingslek onthuld waardoor hackers in Mac-computers kunnen inbreken.

After deploying the initial attack, Alkemade was then able to escape the macOS sandbox (a feature designed to limit successful hacks to one app), and then bypass the System Integrity Protection (SIP), which effectively enabled the deployment of non-authorized code. Wardle also explained that while the vulnerability leveraged multiple flaws after he discovered it to Apple, the company addressed most of them in April 2021, and one was patched in October 2021. Both updates do not delve into the technical details of the vulnerabilities, simply saying the flaw could allow malicious apps to leak sensitive user information and escalate privileges for an attacker.

Het nieuws is afkomstig van Mac-beveiligingsspecialist Patrick Wardle die in een blogbericht van Sector7 (en op de Black Hat-conferentie in Las Vegas) heeft laten zien hoe bedreigers de fout kunnen misbruiken om het apparaat over te nemen. De cyberbeveiligingsonderzoeker zei dat hij de kwetsbaarheid in december 2020 voor het eerst had gevonden en het probleem vervolgens aan Apple had gemeld via de bug bounty-regeling van het bedrijf. Beide updates gaan niet in op de technische details van de kwetsbaarheden en zeggen alleen dat kwaadaardige apps door het lek gevoelige gebruikersinformatie kunnen lekken en de rechten van een aanvaller kunnen escaleren.

An injection flaw connected to how macOS handles software updates on the system could allow attackers to access all files on Mac devices.

The news comes from Mac security specialist Patrick Wardle who, in a Sector7 blog post (and at the Black Hat conference in Las Vegas), demonstrated how threat actors could abuse the flaw to take over the device.

After deploying the initial attack, Alkemade was then able to escape the macOS sandbox (a feature designed to limit successful hacks to one app), and then bypass the System Integrity Protection (SIP), which effectively enabled the deployment of non-authorized code.

The cybersecurity researcher said he first found the vulnerability in December 2020 and subsequently reported the issue to Apple through the company’s bug bounty scheme.

Wardle also explained that while the vulnerability leveraged multiple flaws after he discovered it to Apple, the company addressed most of them in April 2021, and one was patched in October 2021.

Both updates do not delve into the technical details of the vulnerabilities, simply saying the flaw could allow malicious apps to leak sensitive user information and escalate privileges for an attacker.

“In the current security architecture of macOS, process injection is a powerful technique,” Wardle wrote in his blog post.

“A generic process injection vulnerability can be used to escape the sandbox, elevate privileges to root and to bypass SIP’s filesystem restrictions. We have demonstrated how we used the use of insecure deserialization in the loading of an application’s saved state to inject into any Cocoa process,” the advisory concluded.

“This was addressed by Apple in the macOS Monterey update.”

The disclosure of the vulnerability and its patches comes weeks after security researchers at ESET found a macOS backdoor they dubbed “CloudMensis” that was being used in targeted attacks to steal sensitive information from victims.

Software Patches Flaw on macOS Could Let Hackers Bypass All Security Levels

Private Division, Take-Two's publishing label, is working with Weta Workshop on a new Middle-earth title, currently in early development.

The company behind the Lord of the Rings films has signed an agreement with a video game publisher.

Het bedrijf achter de Lord of the Rings films heeft een overeenkomst getekend met een uitgever van videospelletjes.

According to Private Division, Wētā’s game division is developing a new title set in Middle-earth. Private Division plans to launch the game, which is in early development, during its fiscal year 2024. The Lord of the Rings IP is home to so many remarkable stories, and no entity is better equipped than the team at Wētā Workshop to create a distinctive, new Middle-earth gaming experience.”Wētā is not the only company with a Middle-earth game on the horizon.

Take-Two Interactive heeft vandaag aangekondigd dat haar uitgeverslabel, Private Division, een overeenkomst heeft getekend met Wētā Workshop. Volgens Private Division ontwikkelt de speldivisie van Wētā een nieuwe titel die zich in Midden-aarde afspeelt. Private Division is van plan het spel, dat zich in een vroege ontwikkelingsfase bevindt, in haar boekjaar 2024 te lanceren.

Take-Two Interactive today announced that its publishing label, Private Division, has signed an agreement with Wētā Workshop. According to Private Division, Wētā’s game division is developing a new title set in Middle-earth.

Private Division plans to launch the game, which is in early development, during its fiscal year 2024. Wētā is the company behind the Lord of the Rings films’ visual effects. Unity purchased Wētā’s digital tools division last year for $1.6 billion.

Michael Worosz, head of Private Division, said in a statement, “We are thrilled to partner with Wētā Workshop to publish a game set in such an extraordinary and celebrated universe. The Lord of the Rings IP is home to so many remarkable stories, and no entity is better equipped than the team at Wētā Workshop to create a distinctive, new Middle-earth gaming experience.”

Wētā is not the only company with a Middle-earth game on the horizon. Daedalic’s Gollum title is on the way (if delayed). EA also announced a mobile Lord of the Rings title, which is currently in beta.

GamesBeat's creed when covering the game industry is "where passion meets business." What does this mean? We want to tell you how the news matters to you -- not just as a decision-maker at a game studio, but also as a fan of games. Whether you read our articles, listen to our podcasts, or watch our videos, GamesBeat will help you learn about the industry and enjoy engaging with it. Learn more about membership.

Private Division partners with Weta Workshop on Middle-earth game

Information Security Services, News, Files, Tools, Exploits, Advisories and Whitepapers

The privilege of using a password certificate is being extended to Windows.

Het privilege om een wachtwoordcertificaat te gebruiken wordt uitgebreid naar Windows.

On Windows, when registered to use a public key for computer authentication, the certificate is stored in a user accessible registry key leading to elevation of privilege.

In Windows wordt het certificaat, wanneer het geregistreerd is om een openbare sleutel voor computerauthenticatie te gebruiken, opgeslagen in een voor de gebruiker toegankelijke registersleutel, hetgeen leidt tot een verhoging van privileges.

Windows Credential Guard Domain-Joined Device Public Key Privilege Escalation ≈ Packet Storm

Tor has been released as a source code for the new Tor network.

Tor is vrijgegeven als broncode voor het nieuwe Tor-netwerk.

Tor is a network of virtual tunnels that allows people and groups to improve their privacy and security on the Internet. It provides the foundation for a range of applications that allow organizations and individuals to share information over public networks without compromising their privacy. They can also use it to connect to resources such as news sites or instant messaging services that are blocked by their local Internet service providers (ISPs).

Tor is een netwerk van virtuele tunnels dat mensen en groepen in staat stelt hun privacy en veiligheid op het internet te verbeteren. Het vormt de basis voor een reeks toepassingen die organisaties en personen in staat stellen informatie te delen via openbare netwerken zonder hun privacy in gevaar te brengen. Zij kunnen het ook gebruiken om verbinding te maken met bronnen zoals nieuwssites of instant messaging-diensten die door hun lokale internet service providers (ISP's) worden geblokkeerd.

Tor is a network of virtual tunnels that allows people and groups to improve their privacy and security on the Internet. It also enables software developers to create new communication tools with built-in privacy features. It provides the foundation for a range of applications that allow organizations and individuals to share information over public networks without compromising their privacy. Individuals can use it to keep remote Websites from tracking them and their family members. They can also use it to connect to resources such as news sites or instant messaging services that are blocked by their local Internet service providers (ISPs). This is the source code release.

TOR Virtual Network Tunneling Tool 0.4.7.10 ≈ Packet Storm

New FTC rules governing consumer data processing and handling, with a focus on the "commercial surveillance" conducted by data brokers, have entered a public comment period.

The US Federal Trade Commission (FTC) is considering introducing new rules on consumer data protection.

De Amerikaanse Federal Trade Commission (FTC) overweegt nieuwe regels in te voeren voor de bescherming van consumentengegevens.

The FTC rules now enter a public comment period of 60 days after passing a 3-2 vote for publication in the Federal Register, and could bypass the legislative process to become the first real comprehensive federal standards addressing data privacy issues for all industries. FTC rules could bring massive change to companies dealing in consumer dataThe process is only at its very beginning and has several remaining steps to completion, but the new FTC rules have a path to bypassing the usual legislative process that has bogged down the development of federal data privacy standards. The FTC has some existing means to address consumer data abuses under the FTC Act, but the chief limitation on these powers is the lack of ability to assess fines.

De FTC-regels gaan nu, na een stemming van 3-2 voor publicatie in het Federal Register, een periode van 60 dagen voor opmerkingen van het publiek in en kunnen het wetgevingsproces omzeilen en de eerste echte alomvattende federale normen worden die de bescherming van de persoonlijke levenssfeer voor alle bedrijfstakken regelen. FTC-regels kunnen grote veranderingen teweegbrengen voor bedrijven die handelen in consumentengegevensHet proces staat nog maar aan het begin en moet nog in verschillende fasen worden voltooid, maar de nieuwe FTC-regels bieden de mogelijkheid het gebruikelijke wetgevingsproces te omzeilen dat de ontwikkeling van federale normen voor de bescherming van de persoonlijke levenssfeer heeft vertraagd. Lina M. Khan, voorzitter van de FTC, heeft in een openbare verklaring de zaak van het commerciële toezicht aangepakt en de toenemende digitalisering van de economie genoemd als een dringende noodzaak om de regelgeving inzake consumentengegevens onmiddellijk aan te scherpen.

The Federal Trade Commission (FTC) has announced that it is considering proposals that would place strong and sweeping new regulations on consumer data processing and handling, with a focus on the “commercial surveillance” conducted by data brokers. The FTC rules now enter a public comment period of 60 days after passing a 3-2 vote for publication in the Federal Register, and could bypass the legislative process to become the first real comprehensive federal standards addressing data privacy issues for all industries.

FTC rules could bring massive change to companies dealing in consumer data

The process is only at its very beginning and has several remaining steps to completion, but the new FTC rules have a path to bypassing the usual legislative process that has bogged down the development of federal data privacy standards.

FTC Chair Lina M. Khan took on the business of commercial surveillance in a public statement, citing the growing digitization of the economy as a pressing need for immediate strengthening of consumer data regulations. Khan described business models that “hoover” up personal data as potentially engaging in a variety of illegal practices, obscured by the opaque nature of the industry and lack of insight into how companies collect personal data and the massive profiles that third parties accumulate.

The proposed FTC rules address a general lack of consent given to collect consumer data, along with awareness about how much is taken and how it is used, but also address data security and the potential for addiction that commercial surveillance games and services create when they are aimed at children.

The FTC has some existing means to address consumer data abuses under the FTC Act, but the chief limitation on these powers is the lack of ability to assess fines. The proposed FTC rules would represent a significant expansion of power for the agency, and proceeds with a 3-2 split among the commissioners that seemed to boil down to differences over the involvement of Congress in consumer data regulation (as well as some level of political affiliation).

A virtual public forum is being held on September 8, roughly halfway into the public commentary period, to which the general public is invited to attend. This is scheduled to run for five hours and cover a broad variety of topics, from the cost/benefit considerations of proposed regulations to what forms of relief for damages might look like.

Consumer surveillance under fire as public grows increasingly frustrated with “big data” breaches

Surveys show that consumers have become well-informed about the hidden costs of commercial surveillance, but the FTC notes that they are nevertheless expected to acquiesce to these terms as a price of access to modern technology and communications. There is also increasing restiveness regarding a seemingly endless stream of consumer data breaches, severely undermining faith in the ability of companies to safeguard all of the personal information they are “hoovering” up.

The FTC rules proposal thus far consists of a list of 95 questions regarding the shape its new regulations might take. One example is an exploration of requirements for businesses to encrypt consumer data, querying how “granular” such a requirement might be if it were included. Another is the extent to which existing trade regulations, such as COPPA and the GLBA Safeguards Rule, should be used as guidelines for data security requirements. COPPA creates special rules for the protection of consumer data for those under the age of 13, such that many sites and services simply forbid users under that age due to the complexity of compliance. The Gramm–Leach–Bliley Act (GLBA) puts special requirements on the handling of sensitive financial data.

Though the announcement thus far seems to be welcomed by privacy advocates and opponents of commercial surveillance, it is tempered by the expectation that this rulemaking process will ultimately take years to play out and may well cross political administrations (and appointed commissioners). Republican appointees are more likely to oppose new FTC rules, generally viewing this sort of business regulation as a matter for Congress to handle. The move might end up being more effective to spur Congress into working through its own version of similar legislation, which could be handled within a much shorter time window if a true effort was made.

Daniel Kaufman, Partner at BakerHostetler, who previously served as the acting director of the FTC’s Bureau of Consumer Protection, is not bullish on the potential of this path to regulation of commercial surveillance: “By a 3-2 vote, the FTC has initiated a rulemaking that is truly broad in scope and, if completed, would have an enormous impact on how companies do business. This rulemaking will proceed for many years, and any broad rule that ultimately issues would likely encounter serious legal challenges regarding whether the agency has the authority to implement such a rule.”

As things stand now, the actual FTC rules will be developed at some point after the public commentary period is over. In Congress, the American Data Privacy and Protection Act (ADPPA) is before both the House and Senate and has bipartisan support. However, there is also state-level opposition to the bill due to it potentially weakening existing consumer data protection standards and restrictions on commercial surveillance. Big tech is also rallying against the ADPPA, primarily in opposition to the ability of consumers to use its findings to bring class action suits against them.

Proposed FTC Rules Address Commercial Surveillance, Represent Seismic Shift in Handling of Consumer Data

Much of the work we do in cybersecurity requires a whole lot of technical reading. Trying to keep up with and learn new tools, technologies, tactics,

The BBC’s weekly The Boss series profiles different business leaders from around the world. This week we speak to Kevin Magee, chief security officer at Microsoft Canada.

In de wekelijkse serie The Boss van de BBC worden verschillende bedrijfsleiders uit de hele wereld beschreven. Deze week spreken we met Kevin Magee, chief security officer bij Microsoft Canada.

We rarely, if ever, have the opportunity to step back and think much more strategically — to put the threats and threat-actors we see evolving as part of our daily work as defenders into a greater perspective that includes a deeper understanding of the geopolitical and historical factors that inform, influence and motivate the actions of our adversaries. Many of my peers clearly feel the same way as I find book recommendations and discussions beginning to appear around this time every year throughout the social media chats I follow and participate in. These conversations have created new opportunities for me to meet others with common interests and many of my greatest relationships and collaborations in the industry can be traced back to sharing thoughts on an interesting chapter in a good book!

Voor mij is de zomer een geweldige tijd om nieuwe ideeën te verkennen en dat betekent boeken. Veel van mijn collega's denken er duidelijk net zo over, aangezien ik elk jaar rond deze tijd boekaanbevelingen en discussies tegenkom op de sociale media-chats die ik volg en waaraan ik deelneem. Deze gesprekken hebben nieuwe kansen voor mij gecreëerd om anderen met gemeenschappelijke interesses te ontmoeten en veel van mijn beste relaties en samenwerkingen in de sector zijn terug te voeren op het delen van gedachten over een interessant hoofdstuk in een goed boek!

Much of the work we do in cybersecurity requires a whole lot of technical reading.

Trying to keep up with and learn new tools, technologies, tactics, techniques and procedures is extremely difficult and demanding.

We rarely, if ever, have the opportunity to step back and think much more strategically — to put the threats and threat-actors we see evolving as part of our daily work as defenders into a greater perspective that includes a deeper understanding of the geopolitical and historical factors that inform, influence and motivate the actions of our adversaries.

For me, summer is a great time to explore new ideas and that means books. Warm, sunny afternoons on the deck are the perfect setting for some quality thinking. Many of my peers clearly feel the same way as I find book recommendations and discussions beginning to appear around this time every year throughout the social media chats I follow and participate in.

These conversations have created new opportunities for me to meet others with common interests and many of my greatest relationships and collaborations in the industry can be traced back to sharing thoughts on an interesting chapter in a good book!

So, what are my reading recommendations for this summer? If you are new to the industry or would simply like to gain a bigger picture perspective, then I am happy to light the path forward with a few of my top recommendations.

Industry insider books written by incredible storytellers

 My top pick for both readability and for a fascinating look into the world of zero day and cyberweapons arms dealers is This Is How They Tell Me the World Ends: The Cyberweapons Arms Race by New York Times journalist Nicole Perlroth.

It is an incredibly well researched piece of investigative journalism and yet unfolds as a real page turner as well. Perlroth includes incredible stories such as how the Russians managed to install key loggers into typewriters. She also brings many of the characters that populate this world to life, which makes the book highly entertaining, informative and a little unnerving.

 Similar books in the field by other great journalists and storytellers include The Perfect Weapon: War, Sabotage, and Fear in the Cyber Age by David Sanger, which is a must read. Sanger has updated this work with new material for a second edition and released a companion documentary of the same title on HBO.

Kingdom Of Lies: Unnerving Adventures in the World of Cybercrime by Kate Fazzini, a former journalist and now university professor and cybersecurity practitioner, is another incredibly well researched survey of the cybercriminal landscape as told through the stories of actual people who enthusiastically embraced or simply fell into this dark and shadowy world.

The ongoing history of cybersecurity

 If you want to go back and explore the early days of our industry and its cultural roots, then Cult Of The Dead Cow: How the Original Hacking Supergroup Might Just Save the World by Joseph Menn is a wonderful book that will transport you back in time to the 1980s world of elite hackers such as Mudge and RaD Man. Ghost In The Wires: My Adventures as the World’s Most Wanted Hacker by Kevin Mitnick is a look into the real life of the most well-known or mythological hacker of all time and is another one of my all-time favourites.

Russia and the current conflict in Eastern Europe

 By next summer I expect the shelves will be full of books exploring this topic, however if you are looking for an excellent primer then there are three books I would highly recommend. Sandworm: A New Era of Cyberwar and the Hunt for the Kremlin’s Most Dangerous Hackers by Wired’s Andy Greenberg is a masterpiece of investigative journalism that explores the rising menace that Russian hackers pose in modern hybrid warfare and unfolds much like a Tom Clancy thriller novel.

Mr. Putin: Operative in the Kremlin by Fiona Hill and Clifford Gaddy provides the best psychological portrait of a leader who is pushing the world into a new area of persistent engagement and cyberwarfare, while A Short History of Russia: How the World’s Largest Country Invented Itself, from the Pagans to Putin by Mark Galeotti provides a sweeping overview of the foundations of Russian society and much of the historical background needed to better interpret the current conflict.

Cybersecurity Fictional Intelligence

 I’ll end with some lighter reading recommendations that are still very thought-provoking, including a new category of Fictional Intelligence (FICINT) which is being developed by Peter Singer and August Cole who have written two excellent books, Ghost Fleet and Burn-In. Both books leverage a fictional and narrative story telling approach to teach strategic concepts and include a full and detailed reference section citing all the source material behind the technologies and concepts included in the books. While the story and characters are made up, all the technology is real or potentially real.

Hopefully there is something on this list for everyone! If you have recommendations for me or would like to connect and discuss some of these books, I would be more than pleased to chat with you on LinkedIn or Twitter as I explore some of my own summer reading on the deck over the coming weeks!

Kevin Magee is the chief security officer at Microsoft Canada (microsoft.ca).

IT-beveiligingsweekend inhaalslag - 15 juli 2022

Vergelijkbare publicaties

Software patcht een fout in macOS waardoor hackers alle beveiligingsniveaus kunnen omzeilen

Private Division werkt samen met Weta Workshop aan Midden-aarde spel

Windows Credential Guard Domain-Joined Device Public Key Privilege Escalation ≈ Packet Storm

TOR Virtueel Netwerk Tunneling Tool 0.4.7.10 ≈ Packet Storm

Voorgestelde FTC-regels betreffen commercieel toezicht en betekenen aardverschuiving in de omgang met consumentengegevens

Zomerlezing voor de veiligheidsleider

Gevonden topics

Wat elke onderneming kan leren van de cyberaanval van Rusland op Oekraïne

Verwijder Notadszones.com advertenties (spam) - Gratis instructies

Miljoenen Routers blootgesteld aan RCE door USB Kernel Bug