May 2018

Joanap gives hackers remote control of devices so they can steal data, install additional viruses and perform other tasks. Hidden Cobra has used Brambul and Joanap for several years, making little change to the malware over that period.  The first alert of HIDDEN COBRA dates back to 2009, meaning the patches for these vulnerabilities have existed for years.

Google Chrome ‘Out of Bounds’

Google has released Chrome 67 to the stable channel to provide various improvements, including patches for 34 vulnerabilities.

Of the 34 security fixes delivered in the new browser release, 24 are for vulnerabilities reported by external researchers.  These include 9 flaws rated High, 12 as Medium and the remaining 3 considered Low severity.  The worst of the vulnerabilities could allow an attacker to take control of an affected system.

Google also addressed Out of bounds memory access in PDFium, Incorrect escaping of MathML in Blink, and Password fields not taking advantage of OS protections in Views.

The top mitigation strategy recommended in the alert is keeping software up-to-date. “Patching with the latest updates greatly reduces the number of exploitable entry points available to an attacker.”

How to Handle Software Updates

Syxsense is the solution for your patching needs. At a glance, you can easily tell which devices need updates. Our color-coded indicators tell you the severity and number of patches a device requires. Then it’s a few simple steps to set up an automated patch deployment. You can ensure no work is interrupted by scheduling patches to be deployed around business hours.

There’s a better way to manage patching. Come see how with a trial of Syxsense.

Two Zero-Day Exploits Resolved

Microsoft has released two zero-days that have actively been exploited in the wild by cybercriminals. Microsoft has credited Qihoo 360 and Kaspersky Lab for reporting this vulnerability.

Both companies say the flaw has been exploited in targeted attacks, but no information is currently available.

Double Kill IE 0-day Vulnerability

(CVE-2018-8174) under active attack is a critical remote code execution vulnerability that was revealed by Chinese security firm Qihoo 360 last month and affected all supported versions of Windows operating systems.

Dubbed “Double Kill” by the researchers, the vulnerability is notable and requires prompt attention as it could allow an attacker to remotely take control over an affected system. This could be done by executing malicious code remotely through several ways, such as a compromised website, or malicious Office documents.

Win32k Elevation of Privilege Vulnerability

(CVE-2018-8120) patched this month is a privilege-escalation flaw that occurred in the Win32k component of Windows when it fails to properly handle objects in computer memory.

The vulnerability is rated “important,” and only affects Windows 7, Windows Server 2008 and Windows Server 2008 R2. The issue has actively been exploited by threat actors, but Microsoft did not provide any detail about the in-the-wild exploits.

Microsoft Releases Critical Update

In something of an unusual move, Microsoft has released a critical update before Patch Tuesday. This patch addresses a vulnerability within the Windows Host Compute Service Shim (hcsshim) library.

Thanks to work by Swiss security researcher Michael Hanselmann, the flaw was identified and an update has been released. According to the security update CVE-2018-8115, “a remote code execution vulnerability exists when the Windows Host Compute Service Shim (hcsshim) library fails to properly validate input while importing a container image.”

Basically, someone could place malicious code in a container image and then execute code on the host operating system. However, Microsoft believes that it is unlikely that this flaw has or will be exploited.

When it comes to holes in your security, it’s better to be safe than sorry. Deploy this emergency Microsoft update to every Windows device.

Utilizing Syxsense can make such a deployment a breeze. Simply scan your networks for any device running Windows. Then create a maintenance window to deploy the update after business hours. Syxsense can even email you once the task has been completed.

Don’t be caught unprepared and start your free trial of Syxsense today.

Oracle WebLogic Flaw Opens Door to Hackers

In early April, Oracle released updates for a vulnerability within WebLogic Server. At the time, it seemed like that was that, but now a tech researcher claiming to be part of Alibaba’s security team has found a work around.

There are also indications that hackers are seeking to target these devices again. Groups on the lookout have observed a large spike in devices scanning for TCP port 7001, a port related to the WebLogic vulnerability.

Affected versions of WebLogic: 10.3.6.0, 12.1.3.0, 12.2.1.2 and 12.2.1.3.

To ensure your devices are up to date, implement a patch manager that will eliminate the burden of constant software updates.

Syxsense will scan your devices to determine which need updates. Then a task can be set up that will deploy the patches around working hours.

Start your trial of Syxsense today. Manage your devices inside or outside your network from the cloud without software to download and nothing to install.