Microsoft Patches Remote Desktop to Prevent Worm

Microsoft has announced two patches for vulnerabilities in the Remote Desktop service which allows an attacker to execute arbitrary code remotely. This attack allows an unauthenticated user to execute arbitrary code, which could potentially lead to a worm, if the vulnerability is exploited by hackers. All currently supported versions of Windows are vulnerable and Microsoft recommends patching vulnerable systems as soon as possible. In the case where a system cannot be patched, Microsoft recommends turning on Network Level Authentication.

Recommendations

Patch vulnerable systems https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1182
Enable Network Level Authentication if unable to patch vulnerable systems.

Details

Microsoft has patched two Remote Code Execution (RCE) vulnerabilities in Remote Desktop which affects all currently supported Versions of windows. The systems vulnerable are: Windows 7 SP1, Windows Server 2008 R2 SP1, Windows Server 2012, Windows 8.1, Windows Server 2012 R2, and all supported versions of Windows 10, including server versions. These vulnerabilities are especially worrying because the flaw happens during a pre-authentication phase of Remote Desktop, which means an outside attacker can send a specially crafted message and achieve arbitrary code execution on the target system. Given that, these vulnerabilities are described as wormable due to their potential to be remotely exploited with a payload that exploits other vulnerable systems. Additionally, Microsoft recently patched the BlueKeep vulnerability, which was another RCE in the Remote Desktop service. Patches have been released to fix these issues but Microsoft has proposed enabling Network Level Authentication to partially mitigate the attack for those who are unable to patch their systems at this time.

Breaking News: 2019-08-14

8 New HTTP/2 Implementation Flaws Expose Websites to DoS Attacks

HTTP/2 has been around for a number of years but adoption has been low amongst the tech data giants. In this report, researchers at Netflix and Google disclosed vulnerabilities in several implementations of HTTP/2, all leading to DoS attacks for these servers. A small malicious packet could be used to trigger resource exhaustion amongst these implementations, a condition that could hurt the adoption of these protocols for long term use.

See the full report here: https://thehackernews.com/2019/08/http2-dos-vulnerability.html

New Data Breach Has Exposed Millions Of Fingerprint And Facial Recognition Records: Report - Forbes

A new breach of biometric data was found in an open database that belonged to the company Suprema and exposed 28 million records and 28 gigabytes of data. Among the data were fingerprints, facial recognition, security clearances and respective levels, logs of staff access, and unencrypted usernames and passwords. Additionally, no cryptography was used in storing this biometric data and this is especially problematic because once a user's biometric data is in the wild, it can always be compromised due to the properties being immutable. The company says it will act responsibly and disclose the magnitude and gravity of the compromise once they have finished their internal investigation.

See the full report here: https://www.forbes.com/sites/zakdoffman/2019/08/14/new-data-breach-has-exposed-millions-of-fingerprint-and-facial-recognition-records-report/

New Bluetooth Vulnerability Lets Attackers Spy On Encrypted Connections

A new bluetooth vulnerability, that affects over a billion devices, are susceptible to a vulnerability that allows a third party to intercept and change transmitted data. The vulnerability is referred to as KNOB (Key Negotiation of Bluetooth) and directly affects the entropy negotiation protocol of bluetooth. The key negotiation takes place and their devices can choose entropy between 1 and 16 bytes, with either party able to downgrade the entropy. The downgrade is allowed because the bytes of entropy are variable depending on a device's implementation. Additionally, the key negotiation takes place in clear text, so a third party could perform the downgrade on behalf of both devices, allowing the attacker to easily brute force the 1 byte of entropy and then read and mutate data sent between devices.

See the full report here: https://thehackernews.com/2019/08/bluetooth-knob-vulnerability.html