Microsoft Patch Tuesday, September 2021 Edition
Microsoft today pushed software updates to plug dozens of security holes in Windows and related products, including a vulnerability that is already being exploited in active attacks. Also, Apple has issued an emergency update to fix a flaw that's reportedly been abused to install spyware on iOS products, and Google's got a new version of Chrome that tackles two zero-day flaws. Finally, Adobe has released critical security updates for Acrobat, Reader and a slew of other software. READ MORE...
Attackers Impersonate Dept of Transportation in Two-Day Phishing Scam
Threat actors impersonated the U.S. Department of Transportation (USDOT) in a two-day phishing campaign that used a combination of tactics - including creating new domains that mimic federal sites so as to appear to be legitimate - to evade security detections. Between Aug. 16-18, researchers at e-mail security provider INKY detected 41 phishing emails dangling the lure of bidding for projects benefitting from a $1 trillion infrastructure package recently passed by Congress. READ MORE...
Microsoft fixes remaining Windows PrintNightmare vulnerabilities
Microsoft has released a security update to fix the last remaining PrintNightmare zero-day vulnerabilities that allowed attackers to gain administrative privileges on Windows devices quickly. In June, a zero-day Windows print spooler vulnerability dubbed PrintNightmare (CVE-2021-34527) was accidentally disclosed. This vulnerability exploits the Windows Point and Print feature to perform remote code execution and gain local SYSTEM privileges. READ MORE...
SAP Patches Critical Vulnerabilities With September 2021 Security Updates
German software maker SAP this week announced the release of 17 new and two updated security notes on the September 2021 Security Patch Day. Seven of these deal with critical vulnerabilities in SAP products. The most important of the newly released security notes patches a missing authorization check in SAP NetWeaver Application Server for Java. Tracked as CVE-2021-37535, the vulnerability has a CVSS score of 10. READ MORE...
ICS Patch Tuesday: Siemens, Schneider Electric Address Over 40 Vulnerabilities
Siemens and Schneider Electric on Tuesday published a total of 25 advisories to address more than 40 vulnerabilities affecting their industrial control system (ICS) products. Siemens has released 21 new advisories and updated 25 previously published advisories. The new advisories cover 36 vulnerabilities, including five that have been assigned a critical severity rating. Schneider Electric released four advisories covering a total of seven vulnerabilities. READ MORE...
Steganography explained and how to protect against it
Steganography is a millennia-old concept that means hiding a secret message within an ordinary-looking file that doesn't raise any suspicions. The word has Greek roots, being a combination of steganos, which translates to "concealed, protected," and graphein, which means "writing." APT groups, ransomware gangs, and other threat actors often hide information when attacking a target. READ MORE...
How Walgreens' sloppy Covid-19 test registration system exposed patient data
If you got a Covid-19 test at Walgreens, your personal data - including your name, date of birth, gender identity, phone number, address, and email - was left on the open web for potentially anyone to see and for the multiple ad trackers on Walgreens' site to collect. In some cases, even the results of these tests could be gleaned from that data. The data exposure potentially affects millions of people who used Walgreens' Covid-19 testing services over the course of the pandemic. READ MORE...
Severe Vulnerabilities Could Expose Thousands of Azure Users to Attacks
Four of the fixes that Microsoft released as part of its September 2021 Patch Tuesday updates deal with vulnerabilities in the Open Management Infrastructure (OMI) software agent embedded in Azure services. Assessed with severity ratings of critical and high, the vulnerabilities, collectively dubbed OMIGOD, could be exploited to execute code remotely or gain elevated privileges on vulnerable Linux virtual machines running on Azure. READ MORE...
- ...in 1857, 27th President William Howard Taft is born in Cincinnati, Ohio.
- ...in 1858, the new Overland Mail Company sends out its first two stages, inaugurating government mail service between the eastern and western regions of the nation.
- ...in 1928, jazz saxophonist Julian Edwin "Cannonball" Adderley ("Mercy, Mercy, Mercy") was born in Tampa, FL.
- ...in 1978, boxer Muhammad Ali defeats Leon Spinks at the Louisiana Superdome in New Orleans to win the world heavyweight championship.
