Remember - Patch all windows computers (Corp / Personal) with 01/2020 MS Updat

e. An attacker can spy on your web browsing, even on encrypted sites, as well as altering the content you get back or modifying the data you upload.

https://nakedsecurity.sophos.com/2020/01/14/serious-microsoft-crypto-vulnerability-patch-right-now/

Microsoft starts 2020 patch Tuesday with a BANG - Brian Krebs calls one of the vulnerability (fixed) as "extraordinarily serious security vulnerability". So, if we don't patch then, "Shame on Us".

It could have wide-ranging security implications for a number of important Windows
functions, including authentication on Windows desktops and servers, the protection of sensitive data handled by Microsoft’s Internet Explorer/Edge browsers, as well as a number of third-party applications and tools


Those sources say Microsoft has quietly shipped a patch for the bug to branches of the U.S. military and to other high-value customers/targets that manage key Internet infrastructure, and that those organizations have been asked to sign agreements preventing them from disclosing details of the flaw prior to Jan. 14, the first Patch Tuesday of 2020.


https://krebsonsecurity.com/2020/01/cryptic-rumblings-ahead-of-first-2020-patch-tuesday/

Need another good reason to apply 07/18 Windows Patches? - SWAPGS Vulnerability

It could allow attackers to steal any type of information that is stored in the memory, including chat messages, emails, login credentials, payment information, passwords, encryption keys, tokens, or access credentials.

What it comes down to, is that no information can be kept secret.

In order to increase performance in CPUs, a feature called speculative execution will execute instructions before it knows if they are needed or not. Vulnerabilities that target this feature are called side-channel attacks.

In a new side-channel attack discovered by Bitdefender, attackers "break the memory isolation provided by the CPU, allowing an unprivileged attacker to access privileged, kernel memory."


https://www.bleepingcomputer.com/news/security/swapgs-vulnerability-in-modern-cpus-fixed-in-windows-linux-chromeos/

Apple iPhone/iPad users - Upgrade you iOS to 12.4 - Apple has fully patched five of six critical flaws including CVE-2019-8624 and CVE-2019-8646, which allow an attacker to read files off an iOS device remotely, without any interaction from the victim. The code to exploit these vulnerabilities is publicly available.

Only 9.6 percent of devices have been updated to iOS 12.4, as of August 1 – 10 days after the patch was released on July 22 and three days after the vulnerability was disclosed to the public on July 29.

“The exploit initiates a dump of the victim’s iMessage database and compromises the iOS sandbox, putting files on the device at risk,” explained Cuddeford, in a post on Thursday. “This vulnerability calls into question the integrity of iOS sandboxing, which is one of the most significant fundamentals of the entire iOS security model. This iMessage exploit has similar implications to a jailbreak in that the weakness in iMessage exposes the file space on the device.”


https://threatpost.com/90-enterprise-iphone-users-imessage-spy-attack/146899/

Time to patch WINRAR (to version 5.70 beta 1) - A critical 19-year-old WinRAR vulnerability disclosed last week has now been spotted actively being exploited in a spam campaign spreading malware.

If a bad actor used spear-phishing tactics to send an unknowing victim a disguised ACE file, and the victim opened the file in WinRAR, the file would automatically extract in the victim’s startup folder and malware could then be quickly planted on the system.

https://threatpost.com/critical-winrar-flaw-found-actively-being-exploited/142204/

If you use "Logitech Options desktop app" then, you MUST read this. Logitech has finally issued a patched for a bug that could have allowed adversaries to launch keystroke injection attacks against Logitech keyboard owners that used the app.

Previously, a malicious actor could use a rogue website to send a range of commands to the Options app and change a user’s settings. In addition, a malicious actor could send arbitrary keystrokes by changing some simple configuration settings. That in turn would allow a hacker to access all manner of information and even take over a targeted machine

https://threatpost.com/logitech-keystroke-injection-flaw/139928/

Windows patching , most do. Patching all apps, almost no one does and this MUST change. "LUCKY" (no kidding, this is the name) malware can exploit ten different vulnerabilities in Windows and Linux server which includes, Windows SMB, JBoss, WebLogic, Tomcat, Apache Struts 2, and Spring Data Commons.

Lucky also is worm-like in behavior and capable of spreading on its own with no human interaction at all

https://www.darkreading.com/threat-intelligence/satan-ransomware-variant-exploits-10-server-side-flaws/d/d-id/1333448

Beware Skype users - A flaw in Skype for Business enables hackers to launch a DoS attack against the platform by sending large numbers of emojis on the instant messaging client. (btw, latest patch/ proper privacy settings can fix this)

When receiving about 800 kittens at once, your Skype for Business client will stop responding for a few seconds. If a sender continues sending emojis your Skype for Business client will not be usable until the attack ends


Any lack of control over users (such as allowing anyone to sign up for the service, rather than specifically authorising each applicant) opens up the messaging system to a range of what are effectively ‘insider’ vulnerabilities."

https://www.scmagazineuk.com/emoji-tsunami-dos-skype-business/article/1518921

Simple and the most effective Security solution - It is time for Patch,patch,patch Tuesday

• Microsoft has fixed an actively exploited vulnerability.
• Adobe has patches for seven critical vulnerabilities  From now on it will be your fault for not applying them 

https://www.helpnetsecurity.com/2018/09/12/september-2018-patch-tuesday/

https://www.scmagazine.com/home/news/september-patch-tuesday-adobe-patches-seven-critical-vulnerabilities/

I thought CPU meant "Central Processing Unit" , I see that it is now "Critical Patch Update" - Patch today, Oracle has released patches for 334 security vulnerabilities of which 61 are rated critical. Note, 65 percent of the flaws can be exploited remotely without entering credentials

Oracle’s financial services applications received the most patches (56), followed by Fusion middleware (44)

https://threatpost.com/oracle-sets-all-time-record-with-july-critical-patch-update/134089/

PATCHING - Simplest and the most powerful step in protecting against Malware/hackers Don't forget to Patch your Adobe and Microsoft products.

Adobe -  Overall, 104 vulnerabilities were patched in Adobe Acrobat and Reader PDF products, including 53 critical bugs and 51 vulnerabilities rated important.

Microsoft - (Important) all but two of the “critical” fixes  apply to vulnerabilities in Microsoft’s browsers.

https://threatpost.com/adobe-issues-over-100-patches-for-flash-acrobat-and-reader/133832/

Three important advice (Patch,Patch and Patch) June 2018, MS Patch Tuesday - 11 Critical and 39 Important Security Updates

More Here:

https://thehackernews.com/2018/06/microsoft-june-security-patch.html

Don't forget to patch your Adobe Flash player -Adobe has patched two critical and two important vulnerabilities in its Flash Player on Thursday, including one that is being exploited in the wild in targeted attacks against Windows users

More Here:

https://threatpost.com/adobe-patches-critical-flash-player-bug-with-active-exploit/132595/

FYI - Google has released 34 new updates for Chrome

• Includes mitigation for Spectre
• Site isolation 
• Added support for the credential management API called WebAuth.

https://threatpost.com/google-patches-34-browser-bugs-in-chrome-67-adds-spectre-fixes/132370/

We might be patching windows regularly but, Are we patching Adobe (47 patches released this week Sev 2 and Sev 1) and something we miss, are we using the supported version of their product?

A week after issuing updates on Patch Tuesday, Adobe has posted patches for a second slew of 24 critical vulnerabilities, which have a higher risk of being exploited.

This week’s crop of vulnerabilities, of which there were 47 overall, impact versions of Adobe’s Acrobat DC Acrobat Reader DC, and Photoshop CC, all for both Windows and MacOS.

While last week’s fixes were assigned a severity rating of priority 2, this week’s patches have been assigned a priority 1 rating


https://threatpost.com/adobe-doles-out-second-round-of-higher-priority-patches/131967/

MS Patch Tuesday - 15 marked critical. - My three most important advise - Patch, Patch, Patch

One of the most significant patches was a vulnerability in Microsoft's Credential Security Support Provider protocol (CredSSP) which could allow a hacker to gain control of a domain server and other systems in the network

Microsoft also patched a remote code execution flaw in Windows Shell that requires the user to download and open a malicious file in order to exploit it along with Meltdown and Spectre patches covering 32-bit versions of Windows 7 and 8.1, as well as Server 2008 and 2012.

https://www.scmagazine.com/this-months-patch-tuesday-fixed-bug-that-could-exploit-authentication-in-microsoft-remote-desktop-protocol/article/750777/

Meltdown, Spectre patch drama continues - first they said "PATCH it is critical", then "WAIT it will break", then "GO AHEAD" then, Intel says "oops we did not test our patches properly" and today Microsoft wants to uninstall one of its patches.

Microsoft has issued on Saturday an emergency out-of-band Windows update that disables patches for the Spectre Variant 2 bug (CVE-2017-5715).

The update —KB4078130— targets Windows 7 (SP1), Windows 8.1, all versions of Windows 10, and all supported Windows Server distributions.


https://www.bleepingcomputer.com/news/microsoft/microsoft-issues-windows-out-of-band-update-that-disables-spectre-mitigations/

Microsoft has a patch for "Meltdown-Spectre" vulnerability but , don't rush and end up with BSOD. You need to update your AV

Test/Update (all) your systems.


By now Windows users should have received the patches Microsoft released yesterday to plug the widespread Meltdown bug and its companion Spectre, which expose most computers and phones to speculative execution side-channel attacks that affect chips from Intel, AMD, and Arm.

But if you're a Windows user and haven't received Microsoft's patches yet, Microsoft warns that the reason is your antivirus isn't compatible with its Windows update.


For More:
http://www.zdnet.com/article/windows-meltdown-spectre-patches-if-you-havent-got-them-blame-your-antivirus/

The cost to change one line of code on a piece of avionics equipment is #1 Million , and it takes a year to implement.

The cost to change one line of code on a piece of avionics equipment is $1 million, and it takes a year to implement. For Southwest Airlines, whose fleet is based on Boeing’s 737, it would “bankrupt” them if a cyber vulnerability was specific to systems on board 737s, he said, adding that other airlines that fly 737s would also see their earnings hurt. Hickey said newer models of 737s and other aircraft, like Boeing’s 787 and the Airbus Group A350, have been designed with security in mind, but that legacy aircraft, which make up more than 90% of the commercial planes in the sky, don’t have these protections.


For More:
http://www.aviationtoday.com/2017/11/08/boeing-757-testing-shows-airplanes-vulnerable-hacking-dhs-says/

Patch...Patch...Patch is the simplest advise to protect against any Malware - Patch CHROME today

Google is urging users to update their Chrome desktop browsers to avoid security issues related to a high-severity stack-based buffer overflow vulnerability. Google issued the alert Thursday and said an update for most browsers has been released.

Google is not releasing any details surrounding this stack buffer overflow vulnerability (CVE-2017-15396) stating, “access to bug details and links may be kept restricted until a majority of users are updated with a fix.

For More:
https://threatpost.com/google-patches-high-severity-browser-bug/128661/