Microsoft has released the Windows 11 KB5019509 preview cumulative update to enable new features that were not ready when 22H2 was released.

Microsoft says that they will start to roll out the new features to those who installed today’s preview update but that it may take some time before it’s enabled on all Windows 11 devices.

Once the cumulative update is installed, Windows 11 users will slowly have the new features enabled.

The most eagerly anticipated feature is the new tabbed File Explorer interface, which allows you to open multiple folder tabs within a single interface.

Microsoft is also introducing the new Suggested Actions feature, which allows you to select text in Notepad or other applications and have Windows automatically prompt you to perform an associated action.

For example, if you select a number, Windows will ask if you wish to call it, or if you choose a date, Windows will prompt you to create a calendar event, as shown below.

The new update also comes with the Taskbar overflow feature that will show a small submenu of open taskbar items when the taskbar fills up with open applications.

Finally, Microsoft has brought back the ability to launch the Task Manager by right-clicking anywhere on the Windows 11 Task Bar. This feature was removed with the initial release of Windows 11, causing many users to right-click on the taskbar for no reason constantly.

Unfortunately, these features are still rolling out and will not be available to all Windows 11 users immediately, even after installing today’s optional update.

Therefore, if you do not have these features yet, please be patient as Microsoft rolls them out over the next few days.

For Windows 11 users who choose not to install today’s optional update, these features will be included as part of the mandatory November Patch Tuesday cumulative updates.

Original Posts: Microsoft finally releases tabbed File Explorer for Windows 11

The post Microsoft finally releases tabbed File Explorer for Windows 11 appeared first on Resultworx.

Microsoft added this policy as they say Windows does not currently apply Account Lockout policies to “local administrators,” allowing threat actors to repeatedly brute force passwords for these accounts.

As a result, Windows 11 systems where the policy is toggled on automatically lock user accounts (including Administrator accounts) for 10 minutes after 10 failed sign-in attempts within 10 minutes.

“Win11 builds now have a DEFAULT account lockout policy to mitigate RDP and other brute force password vectors,” he tweeted on July 21st.

“This technique is very commonly used in Human Operated Ransomware and other attacks – this control will make brute forcing much harder which is awesome!”

Today, almost three months after Weston’s announcement, Microsoft revealed that the same account lockout policy is now available on any Windows system where the October 2022 cumulative updates are installed.

“In an effort to prevent further brute force attacks/attempts, we are implementing account lockouts for Administrator accounts,” Microsoft said today.

“Beginning with the October 11, 2022 or later Windows cumulative updates, a local policy will be available to enable local administrator account lockouts.”

Admins who want to toggle on this additional defense against brute force attacks can find the “Allow Administrator account lockout” policy under Local Computer Policy\Computer Configuration\Windows Settings\Security Settings\Account Policies\Account Lockout Policies.

This group policy will be enabled by default on all new machines running Windows 11 22H2 or those where the October 2022 Windows cumulative updates were installed before the initial setup when the Security Account Manager (SAM) database that stores the users’ passwords is first instantiated on the new machine.

Microsoft also announced today that it now requires local administrator accounts to use complex passwords that “must have at least three of the four basic character types (lower case, upper case, numbers, and symbols).”

This decision was taken as an extra defense against brute force attacks which are trivial to pull off using systems with modern CPUs and GPUs if the passwords are not long or complex enough.

Original Posts: All Windows versions can now block admin brute-force attacks

The post All Windows versions can now block admin brute-force attacks appeared first on Resultworx.

Thirteen of the 84 vulnerabilities fixed in today’s update are classified as ‘Critical’ as they allow privilege elevation, spoofing, or remote code execution, one of the most severe types of vulnerabilities.

The number of bugs in each vulnerability category is listed below:

• 39 Elevation of Privilege Vulnerabilities
• 2 Security Feature Bypass Vulnerabilities
• 20 Remote Code Execution Vulnerabilities
• 11 Information Disclosure Vulnerabilities
• 8 Denial of Service Vulnerabilities
• 4 Spoofing Vulnerabilities

The above counts do not include twelve vulnerabilities fixed in Microsoft Edge on October 3rd.

Two zero-days fixed, one actively exploited

This month’s Patch Tuesday fixes two publicly zero-day vulnerabilities, one actively exploited in attacks and one publicly disclosed.

Microsoft classifies a vulnerability as a zero-day if it is publicly disclosed or actively exploited with no official fix available.

The actively exploited zero-day vulnerability fixed today is tracked as ‘CVE-2022-41033 – Windows COM+ Event System Service Elevation of Privilege Vulnerability.’

“An attacker who successfully exploited this vulnerability could gain SYSTEM privileges,” reads Microsoft’s advisory.

The exploited vulnerability is listed as discovered by an ‘Anonymous’ researcher.

The publicly disclosed vulnerability is tracked as ‘CVE-2022-41043 – Microsoft Office Information Disclosure Vulnerability’ and was discovered by Cody Thomas of SpecterOps.

Microsoft says attackers could use this vulnerability to gain access to users’ authentication tokens.

Microsoft Exchange zero-days not fixed

Unfortunately, Microsoft has not released security updates for two actively exploited zero-day vulnerabilities tracked as CVE-2022-41040 and CVE-2022-41082, also dubbed to ProxyNotShell.

These vulnerabilities were disclosed in late September by Vietnamese cybersecurity outfit GTSC, who first spotted and reported the attacks.

The vulnerabilities were disclosed to Microsoft through Trend Micro’s Zero Day Initiative and were expected to be fixed today.

However, today’s Microsoft Exchange security bulletin states that the fixes are not ready.

“The October 2022 SUs do not contain fixes for the zero-day vulnerabilities reported publicly on September 29, 2022 (CVE-2022-41040 and CVE-2022-41082),” reads the Microsoft Exchange bulletin.

“Please see this blog post to apply mitigations for those vulnerabilities. We will release updates for CVE-2022-41040 and CVE-2022-41082 when they are ready.”

Recent updates from other companies

Other vendors who released updates in October 2022 include:

• Apple released iOS 16.0.3 with a fix for a Mail denial-of-service vulnerability.
• Cisco released security updates for numerous products this month.
• Fortinet released security updates for an actively exploited authentication bypass vulnerability.
• Google released Android’s October security updates.
• SAP has released its October 2022 Patch Day updates.
• VMware released security updates for VMware ESXi and vCenter Server vulnerabilities.

The October 2022 Patch Tuesday Security Updates

Below is the complete list of resolved vulnerabilities and released advisories in the October 2022 Patch Tuesday updates. To access the full description of each vulnerability and the systems that it affects.,

Original Posts: Microsoft October 2022 Patch Tuesday fixes zero-day used in attacks, 84 flaws

The post Microsoft October 2022 Patch Tuesday fixes zero-day used in attacks, 84 flaws appeared first on Resultworx.

The security flaw (CVE-2022-40684) is an auth bypass on the administrative interface that enables remote threat actors to log into FortiGate firewalls, FortiProxy web proxies, and FortiSwitch Manager (FSWM) on-premise management instances.

“An authentication bypass using an alternate path or channel vulnerability [CWE-288] in FortiOS, FortiProxy and FortiSwitchManager may allow an unauthenticated atttacker to perform operations on the administrative interface via specially crafted HTTP or HTTPS requests,” Fortinet said in an advisory issued today.

The company released security updates to address this flaw on Thursday. It also alerted some of its customers via email (in what it calls an “advanced communication”) to disable remote management user interfaces on affected devices “with the utmost urgency.”

“Fortinet is aware of an instance where this vulnerability was exploited, and recommends immediately validating your systems against the following indicator of compromise in the device’s logs: user=”Local_Process_Access,” the company said.

The complete list of Fortinet vulnerable products exposed to attacks attempting to exploit the CVE-2022-40 flaw if left unpatched includes:

• FortiOS : 7.2.1, 7.2.0, 7.0.6, 7.0.5, 7.0.4, 7.0.3, 7.0.2, 7.0.1, 7.0.0
• FortiProxy : 7.2.0, 7.0.6, 7.0.5, 7.0.4, 7.0.3, 7.0.2, 7.0.1, 7.0.0
• FortiSwitchManager : 7.2.0, 7.0.0

Fortinet released security patches last week and asked customers to update vulnerable devices to FortiOS 7.0.7 or 7.2.2 and above, FortiProxy 7.0.7 or 7.2.1 and above, and FortiSwitchManager 7.2.1 or above to defend their devices from attacks.

PoC exploit ready to be released

Security researchers with the Horizon3 Attack Team have developed proof-of-concept (PoC) exploit code and announced its release later this week.

Per a Shodan search, more than 140,000 FortiGate firewalls can be reached from the Internet and are likely exposed to attacks if their admin management interfaces are also exposed.

Workaround also available

Fortinet also provided information on how customers can block incoming attacks even if they cannot immediately deploy security updates.

To block remote attackers from bypassing authentication and logging into vulnerable devices, admins should disable HTTP/HTTPS administrative interface or limit the IP addresses that can reach the administrative interface using a Local in Policy.

Detailed information on how to disable the vulnerable admin interface for FortiOS, FortiProxy, and FortiSwitchManager or limit access per IP address can be found in this Fortinet PSIRT advisory published Monday, October 10.

“If these devices cannot be updated in a timely manner, internet facing HTTPS Administration should be immediately disabled until the upgrade can be performed,” Fortinet said in notifications sent to some of its customers last week.

Original Posts: Fortinet says critical auth bypass bug is exploited in attacks

The post Fortinet says critical auth bypass bug is exploited in attacks appeared first on Resultworx.

While Redmond hasn’t shared how much longer such file operations will take on affected systems, user reports say that the amount of time needed could more than double in some conditions.

Microsoft has shared additional information regarding this issue in a support document detailing the contents of the KB5017389 preview cumulative update released a week ago.

“Copying large multiple gigabyte (GB) files might take longer than expected to finish on Windows 11, version 22H2,” Microsoft revealed.

“You are more likely to experience this issue copying files to Windows 11, version 22H2 from a network share via Server Message Block (SMB) but local file copy might also be affected.”

The company added that Windows devices used in home networks or small offices are less likely to be affected by this newly acknowledged issue.

Workaround available

Microsoft also shared a workaround for customers affected by this known issue after updating their devices to Windows 11 22H2.

As Redmond explains, impacted users can mitigate the file copying performance hit over SMB with the help of file copy tools that don’t use cache manager (buffered I/O).

You can do this using the built-in robocopy and xcopy tools and the commands listed below:

robocopy \\someserver\someshare c:\somefolder somefile.img /J

OR

xcopy \\someserver\someshare c:\somefolder /J

Microsoft is currently investigating this issue and working on a fix that could address it. An update will be provided with an upcoming release.

Since Windows 11 22H2 was released, Microsoft has added compatibility holds to block the upgrade from being offered on some systems due to printer issues or blue screens.

The company also confirmed this week that the Windows 11 2022 Update is also breaking provisioning, leaving Windows 11 endpoints partially configured and failing to finish installing.

Windows 11 22H2 entered a new deployment phase on Tuesday, October 4, and it is now available to all seekers on eligible devices.

Original Posts: Microsoft: Windows 11 22H2 causes file copy performance hit

The post Microsoft: Windows 11 22H2 causes file copy performance hit appeared first on Resultworx.

The exploitation of CVE-2022-36934 could lead to an integer overflow in WhatsApp for Android, resulting in RCE in an established video call.

Versions affected by the flaw: WhatsApp for Android prior to v2.22.16.12, Business for Android prior to v2.22.16.12, iOS prior to v2.22.16.12, Business for iOS prior to v2.22.16.12.

“This RCE bug affects a piece of code in the WhatsApp component Video Call Handler, which allows an attacker to manipulate the bug to trigger a heap-based buffer overflow and take complete control of WhatsApp Messenger,” Malware Bytes explained.

Another bug, CVE-2022-27492, affects an unspecified code block of the component Video File Handler.

“The manipulation with an unknown input leads to a memory corruption vulnerability. To exploit this vulnerability, attackers would have to drop a crafted video file on the user’s WhatsApp messenger and convince the user to play it,” Malwarebytes explained.

Affected versions: WhatsApp for Android prior to v2.22.16.2 and WhatsApp for iOS v2.22.15.9.

There’s been no evidence of these flaws being exploited in the wild.

“The vulnerabilities were found by the WhatsApp internal security team and silently fixed, so there is a good chance that your WhatsApp has already been updated. However, it never hurts to check,” Malwarebytes added.

Original Posts: WhatsApp quietly fixes two severe bugs

The post WhatsApp quietly fixes two severe bugs appeared first on Resultworx.

The RatMilad spyware was discovered by mobile security firm Zimperium who warned that the malware could be used for cyber espionage, extortion, or to eavesdrop on victim’s conversations.

“Similar to other mobile spyware we have seen, the data stolen from these devices could be used to access private corporate systems, blackmail a victim, and more,” warned a new report by Zimperium Labs shared with BleepingComputer before publication.

“The malicious actors could then produce notes on the victim, download any stolen materials, and gather intelligence for other nefarious practices.”

Distributed through fake Android apps

The spyware is distributed through a fake virtual number generator used for activating social media accounts called “NumRent.” When installed, the app requests risky permissions and then abuses them to sideload the malicious RatMilad payload.

The main distribution channel for the fake app is Telegram, as NumRent, or other trojans carrying RatMilad, aren’t available on the Google Play Store or third-party stores.

The RatMilad threat actors have also created a dedicated website to promote the mobile remote access trojan (RAT) to make the app appear more convincing. This website is promoted through URLs shared on Telegram or other social media and communication platforms.

After successfully installing in a victim’s device, RatMilad hides behind a VPN connection and attempts to steal the following data:

• Basic device information (model, brand, buildID, Android version)
• Device MAC address
• Contact list
• SMS
• Call logs
• Account names and permissions
• Installed applications list and permissions
• Clipboard data
• GPS location data
• SIM information (number, country, IMEI, state)
• File list
• File contents

Moreover, RatMilad can perform file actions such as deleting files and stealing files, modifying the permissions of the installed app, or even using the device’s microphone to record audio and eavesdrop on the room.

These capabilities are more than enough for collecting corporate information, personal details, private communications, photos, videos, documents, etc.

Zimperium discovered RatMilad after the spyware failed to load on a customer’s device and proceeded to analyze the malware.

“Spyware such as RatMilad is designed to run silently in the background, constantly spying on its victims without raising suspicion,” explains Zimperium’s report.

“We believe the malicious actors responsible for RatMilad acquired the code from the AppMilad group and integrated it into a fake app to distribute to unsuspecting victims.”

From the evidence, Zimperium concludes that the operators of RatMilad are following a random-target approach instead of running a laser-focused campaign.

At the time of the investigation, the Telegram channel used for distributing the spyware was viewed over 4,700 times and counted over 200 external shares.

To protect yourself from Android spyware infections like this one, always avoid downloading apps outside the Google Play Store, run an AV scan on newly downloaded APKs, and carefully review the requested permissions during installation.

Original Posts: New Android malware ‘RatMilad’ can steal your data, record audio

The post New Android malware ‘RatMilad’ can steal your data, record audio appeared first on Resultworx.

Using the Windows logo against you

In this campaign, the hackers refreshed their toolkit to target different vulnerabilities and used steganography to hide their malicious payload from antivirus software.

Steganography is the act of hiding data within other non-secret, public information or computer files, such as an image, to evade detection. For example, a hacker can create a working image file that displays correctly on the computer but also includes malicious code that can be extracted from it.

In the campaign discovered by Symantec, Witchetty is using steganography to hide an XOR-encrypted backdoor malware in an old Windows logo bitmap image.

The file is hosted on a trusted cloud service instead of the threat actor’s command and control (C2) server, so the chances of raising security alarms while fetching it are minimized.

“Disguising the payload in this fashion allowed the attackers to host it on a free, trusted service,” Symantec explains in its report.

“Downloads from trusted hosts such as GitHub are far less likely to raise red flags than downloads from an attacker-controlled command-and-control (C&C) server.”

Next, the threat actors fetch the backdoor hiding in the image file, which enables them to do the following:

• Perform file and directory actions
• Start, enumerate, or kill processes
• Modify the Windows Registry
• Download additional payloads
• Exfiltrate files

Witchetty also introduced a custom proxy utility that causes the infected computer to act “as the server and connects to a C&C server acting as a client, instead of the other way around.”

Other tools include a custom port scanner and a custom persistence utility that adds itself in the registry as “NVIDIA display core component.”

Along with the custom tools, Witchetty uses standard utilities like Mimikatzand to dump credentials from LSASS and abuses “lolbins” on the host, like CMD, WMIC, and PowerShell.

TA410 and Witchetty remain active threats to governments and state organizations in Asia, Africa, and around the globe. The best way to prevent its attacks is to apply security updates as they are released.

In the campaign discovered by Symantec, the hackers rely on exploiting last year’s vulnerabilities to breach the target network, taking advantage of the poor administration of publicly exposed servers.

Original posts: Hacking group hides backdoor malware inside Windows logo image

The post Hacking group hides backdoor malware inside Windows logo image appeared first on Resultworx.

Two of the apps removed from the Apple Store, the VKontakte social network application and the Mail.ru mail app, are included on the Russian Ministry of Digital Development’s list of apps with mandatory pre-installation on mobile devices in Russia.

VKontakte is used by more than 75 million users each month, and, based on the watchdog’s stats, it’s the most popular social network in Russia.

“The consequence of the actions of the American corporation was the loss by millions of Russian users of the opportunity to use the VKontakte social network and other applications, including: VK Music, VK Clips, VK Messenger, VK Admin, Mail.ru,” Roskomnadzor said.

“The agency believes that such discriminatory restrictions violate the rights of Russian Internet users to freely receive information and communicate, and are unacceptable.”

VK added in a statement that its apps will still work for iOS users who have already installed them even though they’re no longer available for download and update in Apple’s App Store.

Russians who want to use the VKontakte social network can still do so via the platform’s mobile site and desktop apps.

“Their core functionality will be familiar and stable. There may be difficulties with the work of notifications and payments. VK specialists are working on it,” VK said.

“In recent months, we have implemented key updates to our main products that will allow applications to stay relevant for a long time.”

Roskomnadzor request for explanations follows another one made by Russia’s Ministry of Digital Affairs, which also asked Apple to share the reasons behind its decision to remove VK’s apps from the App Store, per Russian state-affiliated news outlet RT.

Removed due to sanctions

Apple confirmed VK’s removal from its App Store and said it was forced to do so to comply with recent UK-imposed sanctions against Russian entities, some of which are linked to VK (Vladimir Sergeevich Kiriyenko, the company’s CEO, is also under UK sanctions since March).

“These apps are being distributed by developers majority-owned or majority-controlled by one or more parties sanctioned by the UK government,” Apple spokesperson Adam Dema told The Verge.

“In order to comply with these sanctions, Apple terminated the developer accounts associated with these apps, and the apps cannot be downloaded from any App Store, regardless of location. Users who have already downloaded these apps may continue to use them.”

In March, Roskomnadzor announced it banned the Instagram, Facebook, and Twitter social networks in Russia after they booted pro-Kremlin media outlets and news agencies from their platforms and allowed calls for violence against Russian invaders and the Russian and Belarusian presidents.

The Russian Internet watchdog also blocked access to multiple foreign news outlets in the country, including Voice of America, BBC, DW, and Radio Free Europe/Radio Liberty, accusing them of allegedly spreading fake news regarding the ongoing invasion of Ukraine.

Original Posts: Russia demands answers after Apple kicks VK apps from App Store

The post Russia demands answers after Apple kicks VK apps from App Store appeared first on Resultworx.

Apart from flooding mobile users with advertisements, both visible and hidden, the fraudulent apps also generated revenue by impersonating legitimate apps and impressions.

Researchers from HUMAN’s Satori Threat Intelligence team identified a collection of mobile apps that are part of a new ad fraud campaign that they named ‘Scylla’.

The analysts believe Scylla is the third wave of an operation they found in August 2019 and dubbed ‘Poseidon’. The second wave, apparently from the same threat actor, was called ‘Charybdis’ and culminated towards the end of 2020.

Ad-fraud apps

The Satori team have informed Google and Apple about their findings and the apps have been removed from the official Android and iOS stores.

On Android devices, unless you have the Play Protect security option disabled, the apps should be detected automatically.

For iOS, Apple is not clear on how to remove adware apps already installed on the device. Human is recommending users remove the fraudulent apps if present on their devices. A short list with the most downloaded of them is present below:

iOS app list:

• Loot the Castle – com.loot.rcastle.fight.battle (id1602634568)
• Run Bridge – com.run.bridge.race (id1584737005)
• Shinning Gun – com.shinning.gun.ios (id1588037078)
• Racing Legend 3D – com.racing.legend.like (id1589579456)
• Rope Runner – com.rope.runner.family (id1614987707)
• Wood Sculptor – com.wood.sculptor.cutter (id1603211466)
• Fire-Wall – com.fire.wall.poptit (id1540542924)
• Ninja Critical Hit – wger.ninjacriticalhit.ios (id1514055403)
• Tony Runs – com.TonyRuns.game

Android app list (1+ million downloads)

• Super Hero-Save the world! – com.asuper.man.playmilk
• Spot 10 Differences – com.different.ten.spotgames
• Find 5 Differences – com.find.five.subtle.differences.spot.new
• Dinosaur Legend – com.huluwagames.dinosaur.legend.play
• One Line Drawing – com.one.line.drawing.stroke.yuxi
• Shoot Master – com.shooter.master.bullet.puzzle.huahong
• Talent Trap – NEW – com.talent.trap.stop.all

The full list of applications part of the Scylla ad-fraud wave is available in HUMAN’s report.

Users should monitor their apps for malicious or unwanted apps by looking for some signs that typically indicate an issue such as rapid battery drainage and increased internet data usage, or apps you don’t remember installing.

It is also recommended to check the list of installed apps and remove those you don’t remember installing or come from an unfamiliar vendor.

Original Posts: Adware on Google Play and Apple Store installed 13 million times

The post Adware on Google Play and Apple Store installed 13 million times appeared first on Resultworx.