Patch Tuesday

Breathe easy knowing we've got you covered with Patch Tuesday news and remediation recommendations every month!

209 Topics
209 Replies

209 Topics

Brittany-AutomoxAutomox Employee

posted in Patch Tuesday

Cybersecurity Awareness Month - has your organization been prepared?

We’re a little late on the game here in the Automox Community, but October is Cybersecurity Awareness Month - a great month to check-in on your organization’s cybersecurity practices and make users more aware of the importance of staying safe. Through this month, you have seen plenty of educational pieces of content or advice about getting into the cybersecurity industry, but I wanted to take a moment to hear from y’all. Do you feel like your organization is well-prepared for any cyberattacks? Is cybersecurity a priority? (PS: if you are interested in reading some advice from cybersecurity experts here at Automox, you can read the blog post here!)

A

Anonymous

posted in Patch Tuesday

Security Wrap-Up (October 25th, 2021)

Hi, everybody - Chad here. Happy Monday to all y’all. As you know, October is Cybersecurity Awareness Month, so let’s get to some security news already. Missouri Governor Vows to Prosecute St. Louis Post-Dispatch for Reporting Security Vulnerability In unsurprising facepalm news, a politician doesn’t understand how technology works! It’s mentioned by the story’s author as well, but to me, the worst part of this is how it could discourage other people to report vulnerabilities. I’ve never heard of anything like this before, and I hope it’s a one-off. It’s Windows XP’s 20th birthday and way too many still use it TWENTY YEARS!? It’s fine…I’m fine. Anyways, why would anyone still use a 20yr old operating system you ask? I would ask too, tbh. But the short answer is: Threat Actors Abuse Discord to Push Malware Okay first of all, how dare you!? Second…no, I don’t even need a second thing to rage about. Leave my Discord alone! FWIW, that’s the app that did me the most good during quarantine,

A

Brittany-AutomoxAutomox Employee

posted in Patch Tuesday

Have you or someone you know been affected by a cyberattack?

You may be entitled to comp- Wait, wrong intro… Hello! We are looking for some individuals that have been affected by, or know someone who has been affected by, a cyberattack. As cyberattacks grow in number, the effects on people can range from a mild inconvenience to an absolute nightmare, and we want to learn more. If you would be willing to chat with our team about your first-hand experience going through a cyberattack, feel free to reach out through this thread or via PM to discuss the opportunity further. And if you have any friends that might be interested in sharing their thoughts, please share this post. Thanks in advance for your help!

A

Anonymous

posted in Patch Tuesday

Security Wrap-Up (Oct 7th, 2021)

FORGET THE INTRO - OMZJ, TWITCH!! Even in a week when Facebook booted itself off the internet entirely, you likely heard/read/ranted to someone by now about the astoundingly nasty Twitch breach. So let’s talk about Twitch this week. First off, I hope you’ve already changed your password(s). Second, sigh…it’s tough to feel sorry for Twitch after some of their recent heat, but there’s really no hyperbole hyper-enough to get across how terrible this was for them. TL;DR that article - the information stolen/posted contains: The entirety of Twitch’s source code with comment history “going back to its early beginnings” Creator-payout reports from 2019 Mobile, desktop and console Twitch clients Proprietary SDKs and internal AWS services used by Twitch “Every other property that Twitch owns” including IGDB and CurseForge An unreleased Steam competitor, codenamed Vapor, from Amazon Game Studios Twitch internal “red-teaming” tools (designed to improve security by having staff pretend to be hac

David_MitchellNovice

posted in Patch Tuesday

Anyone else having problems with Microsofts September patches breaking network printing?

We are in the process of rolling back some patches now and testing. (Update - Rollback of [KB5005613] fixed our printing problems.) BleepingComputer New Windows security updates break network printing Windows administrators report wide-scale network printing problems after installing this week's September 2021 Patch Tuesday security updates.

A

Anonymous

posted in Patch Tuesday

"Back to School...Back to Ransomware Attacks" A Blog by Chad

Hi, everybody - Chad here. Since we’re still getting to know each other, I’m going to reveal some things about myself this morning. Aside from being a super-professional Technical Community Manager and a bottomless goldmine of accidental comedy, I’m also a long-time writer/blogger/etc. A couple of weeks ago in our Security Wrap-Up post here on AA, I wrote about a single subject for a change: the unsettling uptick in ransomware attacks against the Education sector this time of year. I hope you get through the entire post as it’s got some great info, but if not…TL; DR: This is a damn scary time to be a school Admin, and between remote folks, campus folks, BYOD, yada yada, attackers know that you’re stretched pretty thin…and they’re getting downright nasty. But, I bet some patch automation will help you sleep at night. Well…maybe. I don’t know your life. But I do know network/endpoint security in the Education sector, as I was up to my chins in it for the better part of the last decade. I

A

A

Anonymous

posted in Patch Tuesday

Security Wrap-Up (August 31st, 2021)

Hi, everybody - Chad here. Well, luckily for all of us who live near the swimming pool at my condos, it’s back to school time! And you know what that means: no, not homework and new shoes. Today, I’m focusing solely on the now-annual and still alarming uptick in ransomware attacks in the Education sector this time of year. While it may come as no surprise to those of us in the industry, it’s still shocking to see graphs like this one from a recent Comparitech ransomware report: Screen Shot 2021-08-31 at 1.40.56 PM837×409 18.1 KB As you can clearly see, September kind of sucks - which is a sentence I haven’t had to type on the Internet since season 2 of Fringe. But in general, attackers know that as schools get back into session (especially in our post-Covid world), things will be hectic. This can present them with a window of opportunity, so to speak. If I know that a school district has ~5,000 students coming back onto campus (or worse, learning remotely) at once, then I can assume

A

A

Anonymous

posted in Patch Tuesday

Security Wrap-Up (August 25th, 2021)

Hi, everybody - Chad here. It’s good to be back after last week’s (and yesterday’s) absence. You barely noticed, you say? You didn’t shriek my name while shaking closed fists at the sky even once last Tuesday, you say? Man, whatever - you’re just trying to play it cool. It’s fine. The good news is, I’m back, my sister’s wedding went off without any unplanned shenanigans last week, and now we can get back to our terrifying security news. This week… Phishing campaign uses UPS.com XSS vuln to distribute malware Well, you’re definitely getting more than you ordered with this tracking email scam. It looks pretty legit, too! Researchers have reported that this phishing scam utilized an XSS vulnerability in UPS dot com to push fake/malicious ‘Invoice’ Word docs to recipients. The email contains numerous legitimate links that have no malicious intent. But, the tracking number is a link to UPS’s site that includes an exploit for an XSS vulnerability which will inject malicious JavaScript into

A

A

Anonymous

posted in Patch Tuesday

Security Wrap-Up (August 10th, 2021)

Hi, everybody - Chad here. First off, Happy Tuesday! You’ve survived another Monday in 2021, and that’s no small feat! This week’s on time Security Wrap-Up is chock full of frustrating news, simple annoyances, and maybe a couple of things that even angried up my blood…real good! So, let’s get to it: New “Glowworm attack” recovers audio from devices’ power LEDs If you’re like me, you often sit on the balcony of your condo staring to the west - the glorious Red Rocks Amphitheater in the foreground, when it’s got-danged visible - and ponder the world’s seeming lack of evil geniuses. Well then, here’s a story for you. From ArsTechnica: “Researchers at Ben-Gurion University of the Negev have demonstrated a novel way to spy on electronic conversations. A new paper released today outlines a novel passive form of the TEMPEST attack called Glowworm, which converts minute fluctuations in the intensity of power LEDs on speakers and USB hubs back into the audio signals that caused those fluctuatio

A

A

Anonymous

posted in Patch Tuesday

Security Wrap-Up (August 4th, 2021)

Hi, everybody - Chad here. In case you missed it, today is Wednesday; not Tuesday. Good news: here’s your weekly Security Wrap-Up. Bad news: I officially need a new router. 😒 Once again, some pretty troubling stories in our little world this week. Here’s a peek at a few doozies: LockBit ransomware recruiting insiders to breach corporate networks In ransomware news, the LockBit 2.0 ransomware gang seems to be actively recruiting corporate insiders to help them breach/encrypt networks. In return, they’re promising the insider payouts of one million dollars. Various ransomware gangs operate as a Ransomware-as-a-Service organization, which consists of a core group of devs who maintain the ransomware and payment sites and recruited affiliates who breach victims’ networks and encrypt devices. While this kind of tactic sounds like a long-shot, it’s not the first time threat actors attempted to recruit an employee to encrypt their company’s network (nor will it be the last). In August

A

A

Anonymous

posted in Patch Tuesday

Security Wrap-Up (July 27th, 2021)

Hi, everybody - Chad here! I’ve officially taken it over, but I’m a little late to the Wrap-Up this week due in no small part to outages caused by [a certain unnamed ISP here in Colorado]. In this week’s wrap-up, we’ll take a look at a few stories that should probably raise one eyebrow per reader, minimum. An explosive spyware report shows limits of iOS, Android security In yet more Pegasus news, recent analysis has shown some serious security limitations in both iOS and Android devices, respectively. In the face of the report, many security researchers say that both Apple and Google can and should do more to protect their users against these sophisticated surveillance tools. A lot of criticism has centered on Apple in this regard, because the company has historically offered stronger security protections for its users than the fragmented Android ecosystem. In fact, the Amnesty International researchers say they actually had an easier time finding and investigating indicators of compr

A

A

Anonymous

posted in Patch Tuesday

Security Wrap-Up (July 20th, 2021)

Hi, everybody - it’s me, Chad! Hopefully, your week is off to a smooth start. I’m slowly but surely getting deeper into the Community here at Automox, and we figured this was a good chance for me to share some interesting security news with you. Below are a few crazy things currently happening in the world: Microsoft: Israeli Firm’s Tools Used to Target Activists, Dissidents In a pretty disturbing security story, an Israel-based company called Candiru sold spyware that exploited Windows vulnerabilities and has since been used in targeted attacks across various countries, according to new reports from both Microsoft and the University of Toronto’s Citizen Lab. The tools were being used in “precision attacks” targeting politicians, human rights activists, journalists, academics, embassy workers, and political dissidents, said Microsoft on their blog. The Microsoft Threat Intelligence Center (MSTIC) was alerted about the spyware, which led them to discover CVE-2021-31979 and CVE-2021-3377

A

posted in Patch Tuesday

OS & App Security Update Notifications

Hi All, I am curious what services everyone is using to be alerted on new OS and 3rd party critical updates that are released or soon to be released. Is there a way to be notified through Automox when a Critical OS update is published besides manually checking the software page in the console? I am looking more for a automated email sent to me rather then checking a website or twitter feed, but all suggestions are appreciated. Thank you in advance!

Brittany-AutomoxAutomox Employee

posted in Patch Tuesday

Security Wrap-Up (July 13th, 2021)

Happy Tuesday! I have some great security news available below, and I didn’t know we’d see SolarWinds so soon… check out the articles below - Unpatched critical RCE bug allows industrial and utility takeovers A critical remote code execution (RCE) vulnerability in Schneider Electric programmable logic controllers (PLCs), titled ‘ModiPwn,’ allows unauthenticated cyberattackers to gain root-level control over PLCs used in manufacturing, building automation, healthcare, and enterprise environments. The vulnerability (CVE-2021-22779) takes advantage of undocumented commands in device code and impacts the Modicon M340, M580, and other models from the Modicon series. If exploited, it could impact production lines, conveyor belts, elevators, HVACs, and other automated devices. The vulnerability is rated 9.8 out of 10 on the CVSS vulnerability-rating scale, making it critical. At the moment, Schneider has released a set of mitigations for the bug but no full patch is available yet. Google’s Ce

Brittany-AutomoxAutomox Employee

posted in Patch Tuesday

Setting up a vulnerability management remediation process

At the core of any successful vulnerability management remediation process is an alignment of competent resources, security best practices, and continuous assessment. With cyberattacks becoming an ever-growing part of our daily lives, it’s important that organizations put a functional vulnerability management remediation process in place. But first, we should ask the question, what exactly is vulnerability management? Well, in ideal circumstances, you can plan for the following items: Cyber Security Governance outlines executive management’s strategic direction in setting scope, remediation cycle, term objectives, budget, and realistic expectations of performance as negotiated with stakeholders. Cyber Security Strategy that defines roles, responsibilities, prioritizations of what is critical or required to protect for both business continuity and legal reasons such as regulatory compliance needs. Program Solutions such as vulnerability management scanners to enumerate vulnerabili

Brittany-AutomoxAutomox Employee

posted in Patch Tuesday

Hear from hackers and cyberdefenders from the Ransomware Task Force!

Members of the Ransomware Task Force (an organization of over 60 members from software companies, government agencies, cybersecurity vendors, and more) were recently a part of a Reddit AMA where they answered questions about the ransomware epidemic and what we can do collectively to stop it. If you’re interested in learning more about cybersecurity, the members of the Task Force and other Redditors have a lot of really awesome feedback to share. Check out the AMA here: https://www.reddit.com/r/IAmA/comments/oaytta/we_are_hackers_and_cyber_defenders_working_to/

Brittany-AutomoxAutomox Employee

posted in Patch Tuesday

Security Wrap-Up (June 29th, 2021)

Welcome to this week’s Security Wrap-Up! We have some patched bugs and some really interesting info about the adoption of the Golang language in malware attacks. Check it out - NVIDIA patches high-severity GeForce spoof-attack bug NVIDIA’s gaming graphics software, GeForce Experience, has suffered a major vulnerability that opens the door to a remote attacker that can exploit the bug to steal or manipulate data on a vulnerable Windows computer. NVIDIA has released a software patch for the flaw, which is present in its GeForce Experience (versions 3.21 and prior) software. A 3.23 GeForce update is available now to mitigate the bug. Tracked as CVE-2021-1073, the bug carries a CVSS severity of 8.3. The company warned, “NVIDIA GeForce Experience software contains a vulnerability where, if a user clicks on a maliciously formatted link that opens the GeForce Experience login page in a new browser tab instead of the GeForce Experience application and enters their login information, the malici

Brittany-AutomoxAutomox Employee

posted in Patch Tuesday

Security Wrap-Up (June 23rd, 2021)

Happy Wednesday, everyone! We have some new security updates and topics for you to sink your teeth into. Check them out - Strange malware stops you from visiting pirate websites Last Thursday, Sophos researchers uncovered a malware campaign focused on “block[ing] infected users from being able to visit a large number of websites dedicated to software piracy.” Samples were buried in archives disguised as software packages promoted through the Discord chat service, whereas others are distributed via torrent. Numerous software brands, games, productivity tools, and cybersecurity solutions have been used to hide the malware, meaning that it’s targeting a broad subset of people who might not want to purchase a software license. If the malware’s executable is double-clicked, a message pop-up appears which claims the victim’s system is missing a crucial .DLL file. In the background, the malware is fetching a secondary payload, dubbed ProcessHacker, from an external website. This payload is re

Brittany-AutomoxAutomox Employee

posted in Patch Tuesday

Security Wrap-Up (June 15th, 2021)

Happy Tuesday, everyone! I hope your Monday wasn’t too rough and your Tuesday is equally non-demanding. I’m back with more security news from the past week. Let’s get into it! Critical remote code execution flaw in thousands of VMware vCenter servers remains unpatched If you remember a couple of weeks ago, I posted about some vulnerabilities that VMware patched - two bugs within the vCenter Server, CVE-2021-21985 (an RCE vulnerability with a 9.8 rating) and CVE-2021-21986 (an issue relating to the vCenter Server plug-in framework). VMWare said in a security advisory that CVE-2021-21985 can be exploited so threat actors can access “the underlying operating system that hosts vCenter Server” with “unrestricted privileges.” Based on an analysis done by Trustwave SpiderLabs, they revealed 5,271 instances of VMWare vCenter servers that are available online, the majority of which are running versions 6.7, 6.5, and 7.0, with port 443 the most commonly employed. They found that a total of 4019

Brittany-AutomoxAutomox Employee

posted in Patch Tuesday

Security Wrap-Up (June 2nd, 2021)

Here we are with this week’s Security Wrap-Up! My brain thought yesterday was Monday for almost the entire day, so my apologies for getting this one out a day late. But, we are here with some really intriguing security updates, including a deep-dive into PDF security. Let’s take a look! HPE fixes critical zero-day in server management software Hewlett Packard Enterprise (HPE) has patched a critical zero-day remote code execution (RCE) flaw in its HPE Systems Insight Manager (SIM) software for Windows that it originally disclosed in December. HPE SIM is a tool that enables remote support automation and management for a variety of HPE servers, including the ProLiant Gen9 and Gen10 along with some storage and networking products. Back on April 20th, HPE did issue an earlier SIM hotfix update kit that resolves the vulnerability. It’s an extremely high-risk flaw that can enable attackers with no privileges to remotely execute code within the context of HPE SIM’s hpsimsvc.exe process. The vu

Brittany-AutomoxAutomox Employee

posted in Patch Tuesday

Security Wrap-Up (May 25th, 2021)

Sorry I missed last week, but we’re back this week with more security updates! macOS Big Sur 11.4 addresses vulnerability that could let attackers take secret screenshots macOS Big Sur 11.4 was released on Monday morning and addressed a zero-day vulnerability that could allow attackers to piggyback off of apps like Zoom, secretly taking screenshots and recording the screen. This security issue would allow Privacy preferences to be bypassed, providing an attacker with Full Disk Access, Screen Recording, and other permissions without a user’s content. Four Android bugs being exploited in the wild Google updated its May 3rd Android security bulletin on Wednesday to say that there are “indications” that four of the 50 vulnerabilities may be targeted and exploited in the wild. These include Qualcomm GPU vulnerabilities CVE-2021-1905 & CVE-2021-1906 and ARM Mali GPU vulnerabilities CVE-2021-28663 & CVE-2021-28664. Google Android exploits are a rarity, with these four bugs making up t

Brittany-AutomoxAutomox Employee

posted in Patch Tuesday

Security Wrap-Up (May 11th, 2021)

This week’s security wrap-up is full of plenty of interesting updates and discoveries - Qualcomm chip bug opens Android devices to eavesdropping A vulnerability in a 5G modem data device could allow mobile hackers to remotely target Android users by injecting malicious code into a phone’s modem, gaining the ability to execute code, access mobile users’ call histories and text messages, and eavesdrop on phone calls. The bug (CVE-2020-11292) exists in the Qualcomm Mobile Station Modem (MSM) Interface, known as QMI. MSMs are systems on chips designed by Qualcomm and QMI is a proprietary protocol used to communicate between software components in the modem and other peripheral subsystems. QMI is currently being used in roughly 30% of the world’s handsets. Attackers can exploit the bug to attack a mobile device remotely via a malicious or trojanized Android application. Cisco fixes critical SD-WAN vManage and HyperFlex HX security bugs Cisco SD-WAN vManage Software vulnerabilities patched b

Brittany-AutomoxAutomox Employee

posted in Patch Tuesday

Security Wrap-Up (May 4th, 2021)

May the 4th be with you! Unfortunately, the Dark Side has been able to wreak some havoc across a few tech giants, so let’s take a look at the latest in security news - Apple fixes zero-day security bugs under active attack Yesterday, Apple released a set of unscheduled updates for iOS, macOS, and watchOS, issuing out-of-band patches for critical security issues affecting iPad, iPhone, and iPod, which could allow remote code execution (RCE) and other attacks, compromising users’ systems. Three of these are zero-day flaws, while one is an expanded patch for a fourth vulnerability. The three zero-day bugs include: CVE-2021-30665 (a critical memory-corruption issue in the Safari WebKit engine where “processing maliciously crafted web content may lead to arbitrary code execution” was addressed with improved state management), CVE-2021-30663 (an integer overflow, which can also lead to RCE), and CVE-2021-30666 (a buffer overflow issue addressed with improved memory handling). The fourth bug

Brittany-AutomoxAutomox Employee

posted in Patch Tuesday

Security Wrap-Up (April 27th, 2021)

Hello and welcome back to a new week of the Security Wrap-Up! There are some great security updates on this week’s list and a must-patch update for macOS. Check it out - Nvidia warns of severe security bugs in GPU driver, vGPU software Nvidia has disclosed a group of security vulnerabilities in the Nvidia graphics processing unit (GPU) display driver, which could cause privilege-escalation attacks, arbitrary code execution, denial of service, and information disclosure. Out of the five bugs in the GPU display driver, the most severe is CVE-2021-1074, which rates 7.5 out of 10 on the CVSS vulnerability scale. This vulnerability exists within the display driver’s installer and allows an attacker with local system access to replace an application source with malicious files, potentially leading to code execution, escalation of privileges, denial of service, or information disclosure. The link above will show you the remaining four bugs (CVE-2021-1075, CVE-2021-2076, CVE-2021-1077, and CVE

Brittany-AutomoxAutomox Employee

posted in Patch Tuesday

Security Wrap-Up (April 20th, 2021)

We’re here with another week of security news and updates for you! There’s some great info to be had, so let’s get started - Google Project Zero cuts bug disclosure timeline to a 30-day grace period In a new disclosure policy revealed last week, Google Project Zero will give organizations a 30-day grace period to patch zero-day flaws. The goal of this policy change is to encourage faster patch adoption. Project Zero is changing its previous tactic slightly, delaying disclosure of technical details of the vulnerability until 30 days after the patch is issued, if that patch is created within the 90-day period. Moving to this “90+30 model” will allow researchers and the industry as a whole to “decouple time to patch from patch adoption time, reduce the contentious debate around attacker/defender trade-offs and the sharing of technical details, while advocating to reduce the amount of time that end users are vulnerable to known attacks,” explained Project Zero’s Tim Willis in a recent blog

1
2
3
4
5
6
...
9

Page 3 / 9