While fourteen remote code execution (RCE) bugs were fixed, Microsoft only rated one as critical. The three critical flaws fixed today are an Azure information disclosure bug, an RCE in Windows Internet Connection Sharing (ICS), and a Hyper-V escape flaw that allows the executions of programs on the host with SYSTEM privileges.

The number of bugs in each vulnerability category is listed below:

• 16 Elevation of Privilege Vulnerabilities
• 6 Security Feature Bypass Vulnerabilities
• 15 Remote Code Execution Vulnerabilities
• 6 Information Disclosure Vulnerabilities
• 5 Denial of Service Vulnerabilities
• 11 Spoofing Vulnerabilities

The total count of 58 flaws does not include 5 Mariner security updates and 20 Microsoft Edge security updates released earlier this month.

Five zero-days fixed

This month’s Patch Tuesday fixes five zero-day vulnerabilities, with three exploited in attacks and three publicly disclosed.

Microsoft classifies a vulnerability as a zero-day if it is publicly disclosed or actively exploited with no official fix available.

The three actively exploited zero-day vulnerabilities in today’s updates are:

CVE-2023-36036 – Windows Cloud Files Mini Filter Driver Elevation of Privilege Vulnerability

Microsoft has fixed an actively exploited Windows Cloud Files Mini Filter Elevation of Privileges bug.

“An attacker who successfully exploited this vulnerability could gain SYSTEM privileges,” explains Microsoft.

The post Microsoft November 2023 Patch Tuesday fixes 5 zero-days, 58 flaws appeared first on Resultworx.

An unending supply of unwanted browser extensions is published on the Chrome Web Store and promoted through popup and redirect ads.

These extensions are made by scam companies and threat actors who use them to inject advertisements, track your search history, redirect you to affiliate pages, or in more severe cases, steal your Gmail emails and Facebook accounts

The problem is that these extensions are churned out quickly, with the developers releasing new ones just as Google removes old ones from the Chrome Web Store.

Unfortunately, if you installed one of these extensions, they will still be installed in your browser, even after Google detects them as malware and removes them from the store.

Due to this, Google is now bringing its Safety Check feature to browser extensions, warning Chrome users when an extension has been detected as malware or removed from the store and that they should be uninstalled from the browser.

This feature will go live in Chrome 117, but you can now test it in Chrome 116 by enabling the browser’s experimental ‘Extensions Module in Safety Check’ feature.

To enable the feature, simply copy the Chrome URL, ‘chrome://flags/#safety-check-extensions’, into the address bar and press enter. You will be brought to the Chrome Flags page with the ‘Extensions Module in Safety Check’ feature highlighted.

Now set it to enabled and restart the browser when prompted to enable the feature.

Google Chrome Safety Check for extensions

Once enabled, a new option will appear under the ‘Privacy and security’ settings page that prompts you to review any extensions removed from the Chrome Web Store, as shown below.

Clicking this link will bring you to your extension page, listing the removed extensions and why they were removed and prompting you to uninstall them.

Google says that extensions can be removed from the Chrome Web Store because they were unpublished by the developer, violated policies, or were detected as malware.

For extensions detected as malware, it is strongly advised that you remove them immediately to not only protect your data but also to prevent your computer from facing future attacks.

For those that are removed for other reasons, it is advised that you remove them as well, as they are no longer supported or break other policies that are not strictly malware but are not necessarily helpful.

Google has a dedicated Chrome Web Store policies page detailing what content or behavior could lead to an extension being removed from the store.

The post Google Chrome to warn when installed extensions are malware appeared first on Resultworx.

This new schedule will start with Google Chrome 116, scheduled for release today.

Google explains that Chromium is an open-source project, allowing anyone to view its source code and scrutinize developer discussions, commits, and fixes made by contributors in real time.

These changes, fixes, and security updates are then added to Chrome’s development releases (Beta/Canary), where they are tested for stability, performance, or compatibility issues before they can be pushed to the stable Chrome release.

However, this transparency comes with a cost, as it also allows advanced threat actors to identify flaws before fixes reach a massive user base of stable Chrome releases and exploit them in the wild.

“Bad actors could possibly take advantage of the visibility into these fixes and develop exploits to apply against browser users who haven’t yet received the fix,” reads Google’s announcement.

“This exploitation of a known and patched security issue is referred to as n-day exploitation.”

The patch gap is the time it takes a security fix to be released for testing and for it to finally be pushed out to the main population in public releases of software.

Google identified the problem years ago when the patch gap averaged 35 days, and in 2020. With the release of Chrome 77, it switched to biweekly updates to try to reduce this number.

With the switch to weekly stable updates, Google further minimizes the patch gap and reduces the window of n-day exploitation opportunity to a single week.

While this is definitely a step in the right direction and will positively affect Chrome security, it’s essential to underline that it’s not ideal in the sense that it won’t stop all n-day exploitation.

Reducing the interval between updates will stop the exploitation of flaws that demand more complex exploitation paths, which in turn require more time to develop.

However, there are some vulnerabilities for which malicious actors can build an effective exploit using known techniques, and these cases will remain a problem.

Even in those cases, though, active exploitation will still be reduced to a maximum of seven days in the worst-case scenario, given that users apply security updates as soon as they become available.

“Not all security bug fixes are used for n-day exploitation. But we don’t know which bugs are exploited in practice, and which aren’t, so we treat all critical and high severity bugs as if they will be exploited,” explains Chrome Security Team member Amy Ressler.

“A lot of work goes into making sure these bugs get triaged and fixed as soon as possible.”

“Rather than having fixes sitting and waiting to be included in the next bi-weekly update, weekly updates will allow us to get important security bug fixes to you sooner, and better protect you and your most sensitive data.”

Ultimately, the new update frequency will decrease the need for unplanned updates, enabling users and system administrators to adhere to a more consistent security maintenance schedule.

The vulnerability patch gap has also become a massive problem for Android, with Google recently warning that n-day flaws have become as dangerous as zero-days.

Unfortunately, the Android ecosystem makes it much harder for Google to control, as in many cases, a patch will be released, and it will take manufacturers months to introduce it into their phone’s operating systems.

Original Posts: Google to fight hackers with weekly Chrome security updates

The post Google to fight hackers with weekly Chrome security updates appeared first on Resultworx.

KB5028254 is a monthly non-security preview release that allows Windows administrators and users to test improvements included in the upcoming August 2023 Patch Tuesday release.

According to Microsoft, it addresses issues causing audio and display devices to disappear after the systems resume from sleep.

“There might be excessive Address Resolution Protocol (ARP) requests to the network gateway,” Redmond says.

“This occurs when the VPN is on a wireless mesh network that uses an aggressive throttling algorithm. Because of this, network performance is poor.”

This update also makes brightness settings more accurate and ensures that Widgets no longer unpin from the Windows taskbar unexpectedly.

It’s also important to note that this monthly “C” update is optional and, unlike Patch Tuesday releases, does not include any security-related fixes.

To install KB5028254, you can go to Settings > Windows Update, where they will find the ‘Download and install’ button after checking for updates.

You can also download the update from the Microsoft Update Catalog and install it manually. After installing this update, Windows 11 22H2 will be updated to build 22621.2070.

​​​​Other highlights in Windows 11 KB5028254

Today’s preview release comes with additional fixes and improvements, with some of the most significant ones outlined below:

• This update addresses an issue in the Windows Notification Platform. The issue affects how much power your device uses.
• This update affects user mode printer drivers. They unload unexpectedly. This occurs when you print from multiple print queues to the same printer driver.
• This update affects the Windows Kernel Vulnerable Driver Blocklist, DriverSiPolicy.p7b. It adds drivers that are at risk for Bring Your Own Vulnerable Driver (BYOVD) attacks.
• This update addresses an issue that affects Windows Defender Application Control (WDAC). The issue copies unsigned WDAC policies to the Extensible Firmware Interface (EFI) disk partition. This partition is reserved for signed policies.

The complete list of fixes and improvements can be found in the KB5028254 support bulletin published by Microsoft.

​​​​Other highlights in Windows 11 KB5028254

Today’s preview release comes with additional fixes and improvements, with some of the most significant ones outlined below:

• This update addresses an issue in the Windows Notification Platform. The issue affects how much power your device uses.
• This update affects user mode printer drivers. They unload unexpectedly. This occurs when you print from multiple print queues to the same printer driver.
• This update affects the Windows Kernel Vulnerable Driver Blocklist, DriverSiPolicy.p7b. It adds drivers that are at risk for Bring Your Own Vulnerable Driver (BYOVD) attacks.
• This update addresses an issue that affects Windows Defender Application Control (WDAC). The issue copies unsigned WDAC policies to the Extensible Firmware Interface (EFI) disk partition. This partition is reserved for signed policies.

The complete list of fixes and improvements can be found in the KB5028254 support bulletin published by Microsoft today.

Original Posts: Windows 11 KB5028254 update fixes VPN performance issues, 27 bugs

The post Windows 11 KB5028254 update fixes VPN performance issues, 27 bugs appeared first on Resultworx.

With the latest updates, users can now download the latest software on their compatible devices. Apple strongly recommends users to update their devices due to the critical security fixes included in these updates. To do this, users simply need to open the Settings app, visit the General section > Software Update > Download and Install.

The most recent updates from Apple include essential security patches for vulnerabilities linked to the Neural Engine, which is responsible for natural language processing and on-device machine learning. These patches effectively prevent malicious code from being executed on the device through apps. Additionally, the Find My app has been fortified with fixes that safeguard sensitive location information from being accessed by unauthorized apps.

People also need to download macOS 13.5 update as it brings vital security measures to fix vulnerabilities that could enable a sandboxed process to bypass security restrictions or allow unauthorized access to user-sensitive data with the help of the Voice Memos app.

Furthermore, Apple has also rolled out updates to fix multiple vulnerabilities affecting WebKit, which is the company’s open-source browser engine powering Safari. The WebKit fixes are crucial in preventing malicious code execution and the disclosure of sensitive information when the browser processes web content.

Apple has taken particular notice of reports claiming that some people are taking advantage of such security issues. In light of this, the company emphasizes that users with compatible iPhone, iPad, Mac, Apple Watch, and Apple TV models should immediately download and install the updates to shield themselves from potential security breaches.

In conclusion, the rollout of iOS 16.6, iPadOS 16.6, macOS 13.5, watchOS 9.6, and tvOS 16.6 provides critical security fixes for various vulnerabilities across Apple’s software ecosystem. Users are urged to update their devices promptly to protect themselves from potential security threats and take advantage of the latest improvements and enhancements.

Original Posts: Apple rolls out important iOS 16.6 update to fix many security issues, recommends users to install it

The post Apple rolls out important iOS 16.6 update to fix many security issues, recommends users to install it appeared first on Resultworx.

WooCommerce Payments is a very popular WordPress plugin allowing websites to accept credit and debit cards as payment in WooCommerce stores. According to WordPress, the plugin is used on over 600,000 active installations.

On March 23rd, 2023, the developers released version 5.6.2 to fix the critical 9.8-rated vulnerability tracked as CVE-2023-28121. The flaw affects WooCommerce Payment plugin versions 4.8.0 and higher, with it being fixed in versions 4.8.2, 4.9.1, 5.0.4, 5.1.3, 5.2.2, 5.3.1, 5.4.1, 5.5.2, 5.6.2, and later.

As the vulnerability allows any remote user to impersonate an administrator and take complete control over a WordPress site, Automattic force installed the security fix of WordPress installations utilizing the plugin.

At the time, WooCommerce said there was no known active exploitation of the vulnerability, but researchers warned that due to the critical nature of the bug, we would likely see exploitation in the future.

Flaw actively exploited

This month, researchers at RCE Security analyzed the bug and released a technical blog on the CVE-2023-28121 vulnerability and how it can be exploited.

The researchers explain that attackers can simply add an ‘X-WCPAY-PLATFORM-CHECKOUT-USER‘ request header and set it to the user ID of the account they wish to impersonate.

When WooCommerce Payments sees this header, it will treat the request as if it was from the specified user ID, including all of the user’s privileges.

As part of the blog post, RCE Security released a proof-of-concept exploit that uses this flaw to create a new admin user on vulnerable WordPress sites, making it easy for threat actors to take complete control over the site.

Today, WordPress security firm Wordfence warned that threat actors are exploiting this vulnerability in a massive campaign targeting over 157,000 sites by Saturday.

“Large-scale attacks against the vulnerability, assigned CVE-2023-28121, began on Thursday, July 14, 2023 and continued over the weekend, peaking at 1.3 million attacks against 157,000 sites on Saturday, July 16, 2023,” explains Wordfence.

Wordfence says the threat actors use the exploit to install the WP Console plugin or create administrator accounts on the targeted device.

For those systems that WP Console was installed, the threat actors used the plugin to execute PHP code that installs a file uploader on the server that can be used as a backdoor even after the vulnerability is fixed.

Wordfence says they have seen other attackers using the exploit to create administrator accounts with random passwords.

To scan for vulnerable WordPress sites, the threat actors try to access the ‘/wp-content/plugins/woocommerce-payments/readme.txt’ file, and if it exists, they exploit the flaw.

The researchers have shared seven IP addresses responsible for these attacks, with IP address 194.169.175.93 scanning 213,212 sites.

Due to the ease with which CVE-2023-28121 can be exploited, it is strongly advised that all sites utilizing the WooCommerce Payment plugin ensure that their installations are up-to-date.

If you have not updated your installation recently, it is also advised that site admins scan their sites for unusual PHP files and suspicious administrator accounts and delete any that are found.

Original Posts: Hackers exploiting critical WordPress WooCommerce Payments bug

The post Hackers exploiting critical WordPress WooCommerce Payments bug appeared first on Resultworx.

“Apple is aware of an issue where recent Rapid Security Responses might prevent some websites from displaying properly,” Apple said on Tuesday.

The company added it would soon release fixed versions of the buggy updates and advised customers to remove them if they were experiencing issues while browsing the web after updating.

While Apple did not share why some websites were prevented from rendering correctly after installing the iOS 16.5.1 (a), iPadOS 16.5.1 (a), and macOS 13.4.1 (a) updates, this likely happened because the new Safari user agent containing an “(a)” string prevented websites from detecting it as a valid version of Safari, causing it to display “browser not supported” error messages.

Today, Apple started pushing iOS 16.5.1 (c), iPadOS 16.5.1 (c), and macOS 13.4.1 (c) Security Response updates that address the web browsing issues.

Apple uses RSR patches to address security issues impacting iPhone, iPad, and Mac devices and to quickly patch vulnerabilities actively exploited in attacks between major OS releases.

The zero-day flaw (CVE-2023-37450) patched today impacts the WebKit browser engine, and it allows attackers to gain arbitrary code execution by tricking targets into opening maliciously crafted web pages.

“This Rapid Security Response provides important security fixes and is recommended for all users,” Apple warns customers on devices where these emergency patches are delivered.

“Apple is aware of a report that this issue may have been actively exploited,” the company says in iOS and macOS security advisories describing the CVE-2023-37450 flaw patched in today’s re-released emergency security updates.

Since the start of 2023, the company addressed a total of ten zero-day flaws exploited in the wild to hack iPhones, Macs, or iPads.

Original Posts: Apple re-releases zero-day patch after fixing browsing issue

The post Apple re-releases zero-day patch after fixing browsing issue appeared first on Resultworx.

Chinese cyberspies, exploiting a fundamental gap in Microsoft’s cloud, hacked email accounts at the Commerce and State departments, including that of Commerce Secretary Gina Raimondo — whose agency has imposed stiff export controls on Chinese technologies that Beijing has denounced as a malicious attempt to suppress its companies.

The post Chinese hackers breach email of Commerce Secretary Raimondo and State Department officials appeared first on Resultworx.

The apps, both from the same publisher, can launch without any interaction from the user to steal sensitive data and send it to servers in China.

Despite being reported to Google, the two apps continue to be available in Google Play at the time of publishing.

File Recovery and Data Recovery, identified as “com.spot.music.filedate” on devices, has at least 1 million installs. The install count for File Manager reads at least 500,000 and it can be identified on devices as  “com.file.box.master.gkd.”

The two apps were discovered by the behavioral analysis engine from mobile security solutions company Pradeo and their description states that they do not collect any user data from the device on the Data Safety section of their Google Play entry

However, Pradeo found that the mobile apps exfiltrate the following data from the device:

• Users’ contact list from on-device memory, connected email accounts, and social networks.
• Pictures, audio, and video that are managed or recovered from within the applications.
• Real-time user location
• Mobile country code
• Network provider name
• Network code of the SIM provider
• Operating system version number
• Device brand and model

While the apps might have a legitimate reason to collect some of the above to ensure good performance and compatibility, much of the collected data is not necessary for file management or data recovery functions. To make matters worse, this data is collected secretly and without gaining the user’s consent.

Pradeo adds that the two apps hide their home screen icons to make it more difficult to find and remove them. They can also abuse the permissions the user approves during installation to restart the device and launch in the background.

It is likely that the publisher used emulators or install farms to bloat popularity and make their products appear more trustworthy, Pradeo speculates.

This theory is supported by the fact that the number of user reviews on the Play store is way too small compared to the reported userbase.

It is always recommended to check user reviews before installing an app, pay attention to the requested permissions during app installation, and only trust software published by reputable developers.

Update 7/6/23 5:51 PM ET: Google shared the following statement with BleepingComputer and said that they removed the apps from Google Play.

Original Posts: Apps with 1.5M installs on Google Play send your data to China

The post Apps with 1.5M installs on Google Play send your data to China appeared first on Resultworx.

Cisco Secure Client enables employees to work from anywhere via a secure Virtual Private Network (VPN) and provides admins with endpoint management and telemetry features.

Low-privileged, local attackers can exploit this security flaw (tracked as CVE-2023-20178) in low-complexity attacks that don’t require user interaction

“This vulnerability exists because improper permissions are assigned to a temporary directory that is created during the upgrade process,” Cisco says.

“An attacker could exploit this vulnerability by abusing a specific function of the Windows installer process.”

The bug was fixed in AnyConnect Secure Mobility Client for Windows 4.10MR7 and Cisco Secure Client for Windows 5.0MR2.

According to Cisco, CVE-2023-20178 doesn’t impact the following macOS, Linux, and mobile products:

• Cisco AnyConnect Secure Mobility Client for Linux
• Cisco AnyConnect Secure Mobility Client for MacOS
• Cisco Secure Client-AnyConnect for Android
• Cisco Secure Client AnyConnect VPN for iOS
• Cisco Secure Client for Linux
• Cisco Secure Client for MacOS

No signs of active exploitation

The company’s Product Security Incident Response Team (PSIRT) is yet to find any evidence of malicious use in the wild or public exploit code targeting the bug.

In October, Cisco warned customers to patch two other AnyConnect security flaws—with public exploit code and addressed three years ago—due to in-the-wild exploitation.

The bugs (CVE-2020-3433 and CVE-2020-3153) let threat actors execute arbitrary code on targeted Windows devices with SYSTEM privileges when chained with other privilege escalation flaws.

As CISA also said when adding them to its list of known exploited bugs, “these types of vulnerabilities are a frequent attack vector for malicious cyber actors and pose significant risk to the federal enterprise.”

Two years ago, Cisco patched an AnyConnect zero-day (CVE-2020-3556) with public exploit code in May 2021 with a six-month delay after providing mitigation measures to decrease the attack surface when it was disclosed in November 2020.

Original Posts: Cisco fixes AnyConnect bug giving Windows SYSTEM privileges

The post Cisco fixes AnyConnect bug giving Windows SYSTEM privileges appeared first on Resultworx.