Tag Archive for: Microsoft

What Data Big Tech Companies Admit To Have On You

Have you ever asked yourself, “What does the Data big companies such as Google know about me?” The answer is uncomfortable. What Google knows about you includes everything from your clicks on ads to your birthday to the device you’re using right now and the Wi-Fi network it’s connected to. But Google pales in comparison to some of the other big companies that sell your data or collect it out there.

This is what the big six tech companies have officially admitted to collecting as far as personal data about you, according to their official privacy policies.

The Data Big Tech Companies Have On You

Microsoft Publishes PDF With Every Windows Terminal Command

If you wanted an exhaustive reference for all the windows terminal command line tools and utilities available in Windows, “/h” was as good as it got. Well, that was until last month, when Microsoft published a whopping big PDF with information on every single terminal command the operating system has to offer.

The document, released on April 18, comes in at 4.6MB and 948 pages and covers the following platforms:

  • Windows Server (Semi-Annual Channel)
  • Windows Server 2016
  • Windows Server 2012 R2
  • Windows Server 2012
  • Windows Server 2008 R2
  • Windows Server 2008
  • Windows 10
  • Windows 8.1

Even though Windows 7 is absent, it’s fair to say a lot of the commands should work on the older OS.

The reference isn’t just limited to commands — it also contains tips for configuring the command prompt window, as well as changes you can make to the Registry to enable and disable features, such as filename / directory completion.

Best of all, hyperlinks embedded in the file for each command jump directly to online documentation, so you can always check out the most up-to-date content.

This does however raise the question: why have a gigantic reference PDF in the age of online documentation?

lifehacker

This New Web Standard Could Finally Kill the Password

Passwords are pretty archaic. Unfortunately, despite the best efforts of companies including Google, Apple, Facebook and others, no one has figured out a uniform standard that would make it possible to do away with them entirely. Until, perhaps, now.

A new credential system proposed by the W3C—the World Wide Web Consortium—could be what we need to kill off the password for good.

Per the w3c, the new Web Authentication specification details an “API enabling the creation and use of strong, attested, scoped, public key-based credentials by web applications, for the purpose of strongly authenticating users.” In other words, this would be a universal system that could offer unique encryption keys for each user that could be accessed securely across every site, all in your standard web browser.

But the big upgrade is that, instead of being limited to a regular password, the API would also support the use of fingerprint readers, cameras, and USB keys as a method of logging into your account. In fact, some potential use cases even include using the fingerprint reader on your phone to log into a website that you’re browsing on your laptop or desktop, which may not have its own fingerprint sensor.

While the new standard is currently listed as just a “Candidate Recomendation,” the feature is already in use as an experimental technology in FireFox, with other browsers including Chrome and Edge expected to test the Web Authentication API later this year.

The sad part so far is that, despite input and contribution from companies such as Google, Microsoft, PayPal, Mozilla, Qualcomm and others, it doesn’t seem like Apple is on board to help test or refine the tech. That’s a real shame, because even though wide-scale adoption is still a ways out, it would be nice if there was a secure, non-proprietary login platform that all the big tech companies could agree on.

gizmodo

Facebook is hosting an online abuse summit with other tech leaders

Desperate to show it takes thwarting misinformation, fraud and spam seriously, Facebook just revealed that it’s hosting a private “Fighting Abuse @Scale” invite-only conference in San Francisco on April 25th. Speakers from Facebook, Airbnb, Google, Microsoft and LinkedIn will discuss how to stop fake news, prevent counterfeit account creation, use honeypots to disrupt adversarial infrastructure and how machine learning can be employed to boost platform safety.

Facebook Event: fighting abuse Though never publicly announced, Facebook has already privately filled the event to capacity. The company’s PR says this isn’t a “last-minute” event as we originally described it, and initial invites went out February 6th. But the sudden move to invite journalists less than a month ahead seems timed to humanize Facebook’s efforts to combat its ongoing data abuse and election interference scandals.

Fighting Abuse @Scale will be held at the Bespoke Event Center within the Westfield Mall in SF. We can expect more technical details about the new proactive artificial intelligence tools Facebook announced today during a conference call about its plans to protect election integrity. The first session is titled “Combating misinformation at Facebook” and will feature an engineering director and data scientists from the company.

Facebook previously held “Fighting Spam @Scale” conferences in May 2015 and November 2016 just after the presidential election. But since then, public frustration has built up to a breaking point for the social network. Russian election interference, hoaxes reaching voters, violence on Facebook Live, the ever-present issue of cyberbullying and now the Cambridge Analytica data privacy scandal have created a convergence of backlash. With its share price plummeting, former executives speaking out against its impact on society and CEO Mark Zuckerberg on a media apology tour, Facebook needs to show this isn’t just a PR problem. It needs users, potential government regulators, and its own existing and potential employees to see it’s willing to step up and take responsibility for fixing its platform.

tech crunch

Microsoft Issues Emergency Windows Security Update For A Critical Vulnerability

If your computer is running Microsoft’s Windows operating system, then you need to apply this emergency patch immediately. By immediately, I mean now!

Microsoft has just released an emergency security patch to address a critical remote code execution (RCE) vulnerability in its Malware Protection Engine (MPE) that could allow an attacker to take full control of a victim’s PC.

Enabled by default, Microsoft Malware Protection Engine offers the core cybersecurity capabilities, like scanning, detection, and cleaning, for the company’s antivirus and antimalware programs in all of its products.

According to Microsoft, the vulnerability affects a large number of Microsoft security products, including Windows Defender and Microsoft Security Essentials along with Endpoint Protection, Forefront Endpoint Protection, and Exchange Server 2013 and 2016, impacting Windows 7, Windows 8.1, Windows 10, Windows RT 8.1, and Windows Server.

Tracked as CVE-2017-11937, the vulnerability is a memory corruption issue which is triggered when the Malware Protection Engine scans a specially crafted file to check for any potential threat.

Flaw Lets Hackers Take Full Control of Your Computer

Successful exploitation of the flaw could allow a remote attacker to execute malicious code in the security context of the LocalSystem account and take control of the target’s computer.

Microsoft said an attacker could place a specially crafted malicious file in a location that is scanned by the Malware Protection Engine to exploit the memory corruption flaw which eventually leads to remote code execution.

“There are many ways that an attacker could place a specially crafted file in a location that is scanned by the Microsoft Malware Protection Engine. For example, an attacker could use a website to deliver a specially crafted file to the victim’s system that is scanned when the website is viewed by the user,” the report from Microsoft explained.

Other ways to deliver a specially crafted file could be via emails or Instant Messenger services. The attacker could also “take advantage of websites that accept or host user-provided content, to upload a specially crafted file to a shared location that is scanned by the Malware Protection Engine running on the hosting server,” the report said.

Patch! Patch! Patch!

Microsoft assured its customers that the vulnerability was fixed before any misuses in the wild.

The company has released an out-of-band critical update for the flaw and advised users to install it as soon as possible. Most home users and many enterprise customers will get the emergency patch automatically over the air.

The security vulnerability was discovered and reported to Microsoft by the UK’s National Cyber Security Centre (NCSC), a cyber defense organization of Britain’s signals intelligence and cybersecurity agency, known as GCHQ.

The emergency fix comes just days before Microsoft is scheduled to roll out its December Patch Tuesday updates.

The Hacker News

Microsoft Releases Update to Fix 53 Vulnerabilities

Microsoft has released a large batch of security updates as part of its November Patch Tuesday in order to fix a total of 53 new security vulnerabilities in various Windows products, 19 of which rated as critical, 31 important and 3 moderate.

The vulnerabilities impact the Windows OS, Microsoft Office, Microsoft Edge, Internet Explorer, Microsoft Scripting Engine, .NET Core, and more.

At least four of these vulnerabilities that the tech giant has now fixed have public exploits, allowing attackers to exploit them easily. But fortunately, none of the four are being used in the wild, according to Gill Langston at security firm Qualys.

The four vulnerabilities with public exploits identified by Microsoft as CVE-2017-8700 (an information disclosure flaw in ASP.NET Core), CVE-2017-11827 (Microsoft browsers remote code execution), CVE-2017-11848 (Internet Explorer information disclosure) and CVE-2017-11883 (denial of service affecting ASP.NET Core).

Potentially Exploitable Security Vulnerabilities

What’s interesting about this month’s patch Tuesday is that none of the Windows OS patches are rated as Critical. However, Device Guard Security Feature Bypass Vulnerability (CVE-2017-11830) and Privilege Elevation flaw (CVE-2017-11847) are something you should focus on.

Also, according to an analysis of Patch Tuesday fixes by Zero-Day Initiative, CVE-2017-11830 and another flaw identified as CVE-2017-11877 can be exploited to spread malware.

“CVE-2017-11830 patches a Device Guard security feature bypass vulnerability that would allow malware authors to falsely authenticated files,” Zero-Day Initiative said.

“CVE-2017-11877 fixes an Excel security feature bypass vulnerability that fails to enforce macro settings, which are often used by malware developers.”

The tech giant also fixed six remote code execution vulnerabilities exist “in the way the scripting engine handles objects in memory in Microsoft browsers.”

Microsoft identified these vulnerabilities as CVE-2017-11836, CVE-2017-11837, CVE-2017-11838, CVE-2017-11839, CVE-2017-11871, and CVE-2017-11873, which could corrupt memory in such a way that attackers could execute malicious code in the context of the current user.

“In a web-based attack scenario, an attacker could host a specially crafted website that is designed to exploit the vulnerability through Microsoft Edge and then convince a user to view the website,” Microsoft said. “These websites could contain specially crafted content that could exploit the vulnerability.”

17-Year-Old MS Office Flaw Lets Hackers Install Malware

Also, you should be extra careful when opening files in MS Office.

All versions of Microsoft Office released in the past 17 years found vulnerable to remote code execution flaw(CVE-2017-11882) that works against all versions of Windows operating system, including the latest Microsoft Windows 10 Creators Update.

However, due to improper memory operations, the component fails to properly handle objects in the memory, corrupting it in such a way that the attacker could execute malicious code in the context of the logged-in user.

Exploitation of this vulnerability requires opening a specially crafted malicious file with an affected version of Microsoft Office or Microsoft WordPad software, which could allow attackers to remotely install malware on targeted computers.

Adobe Patch Tuesday: Patches 62 Vulnerabilities

Besides fixing vulnerabilities in its various products, Microsoft has also released updates for Adobe Flash Player.

These updates correspond with Adobe Update APSB17-33, which patches 62 CVEs for Acrobat and Reader alone. So, Flash Player users are advised to ensure that they update Adobe across their environment to stay protected.

It should also be noted that last Patch Tuesday, Microsoft quietly released the patch for the dangerous KRACK vulnerability (CVE-2017-13080) in the WPA2 wireless protocol.

Therefore, users are also recommended to make sure that they have patched their systems with the last month’s security patches.

Alternatively, users are strongly advised to apply November security patches as soon as possible in order to keep hackers and cybercriminals away from taking control of their computers.

For installing security updates, just head on to Settings → Update & security → Windows Update → Check for updates, or you can install the updates manually.

The Hacker News

Office 365: A Vehicle for Internal Phishing Attacks

A new threat uses internal accounts to spread phishing attacks, making fraudulent emails even harder to detect.

Cybercriminals go where the users are. Office 365, which has more than 100 million active monthly subscribers, has become a hotspot for compelling and personalized cyberattacks. Users trust emails from coworkers, especially those with the correct corporate email address.

Traditional phishing attempts have red flags: suspicious attachments, bold requests, misspelled words, questionable email addresses. Users know how to react to these. But what happens when attacks are more personalized, with legitimate addresses and reasonable requests?

These have become more popular and tougher to spot, says Asaf Cidon, spearphishing expert at Barracuda. The company recently released a report on a threat he calls Account Compromise. Once they have an employee’s Office 365 account information, threat actors can craft realistic-looking messages and send them from an account their victims trust.

Attackers primarily steal credentials using traditional methods, he continues. Most rely on phishing or spearphishing to send victims to fraudulent websites, where they are prompted to reset their Office 365 credentials. Some buy users’ credentials on the dark web.

“What’s new is what happens after they get access to the accounts,” Cidon says. Threat actors can conduct several types of attacks after they gain a foothold in an organization.

In one common scenario, an attacker sets forwarding rules on an Office 365 account to send emails to an account they control. From there, they can both steal data and monitor the user’s internal and external communication patterns so they can plan future attacks.

Threat actors also impersonate their victims and send emails to other employees with the goal of collecting data. Some send emails with PDF attachments that can only be opened with a username and password. Some send an invoice for payment that requires logging into a web portal, where they have to log in with a corporate email address and password.

Damage could potentially extend outside the organization. Cidon explains a scenario in which an attacker, impersonating an employee, used their access to request a wire transfer from a partner company. The employee in the scenario didn’t even realize the transfer was happening.

“This is an evolution of spearphishing – we’re seeing more and more sophistication,” he says. A couple of years ago, cyberattackers primarily targeted executive employees. These new Office 365 threats are putting all employees at risk.

“With this attack, they’re just trying to get in and once they’re in, a lot of the employees getting targeted are not high-level. It’s not just executive targets,” Cidon continues.

There are red flags that signify a company is targeted in one of these attacks. Oftentimes the IP addresses used to log into corporate accounts come from other countries, he says, and looking at the log can identify geographical anomalies. It also helps to keep track of your email account to see when emails are getting forwarded or sent to unfamiliar addresses.

Cidon advises security leaders to train employees on how to spot phishing attacks to prevent attackers gaining initial access. He also advises adding security layers like multi-factor authentication to Office 365 to lessen the chance of a break-in.

“Traditional email security systems are going to be almost useless in stopping this,” he says, noting how most tools look at the API of the email provider. “Once an attacker is in, they don’t see internal emails … only the external emails coming in.”

DARKReading

Microsoft is preparing to kill off Paint after 32 years

Microsoft has revealed that the graphics editing app is no longer “in active development”, and may be removed from Windows altogether.

Paint was introduced back in 1985, and has featured on every version of Microsoft’s computer operating system.

Though it was never the most capable program, it was easy to use and familiar to millions of people, many of whom used it as their main source of digital fun before going online.

The company has published a support document listing a number of Windows features that are set to be killed off.

“The following features and functionalities in the Windows 10 Fall Creators Update are either removed from the product in the current release (“Removed”) or are not in active development and might be removed in future releases (“Deprecated”),” Microsoft says.

“This list is intended to help customers consider these removals and deprecations for their own planning.”

Paint would be the biggest casualty by far, though it might yet survive, as Microsoft says “the list is subject to change and may not include every deprecated feature or functionality”.

Paint 3D, a modern version of the app, was introduced earlier this year, but Microsoft decided to make it available alongside regular Paint, rather than instead if it.

3D Builder app, Apndatabase.xml, Enhanced Mitigation Experience Toolkit (EMET), Outlook Express, Reader app, Reading List, Screen saver functionality in Themes, Syskey.exe, TCP Offload Engine, Tile Data Layer and Trusted Platform Module (TPM) Owner Password Management will be removed from Windows 10 when the the Fall Creators Update arrives – most likely in September.

Along with Paint, IIS 6 Management Compatibility, IIS Digest Authentication, RSA/AES Encryption for IIS, Sync Your Settings, System Image Backup (SIB) Solution, TLS RC4 Ciphers, Trusted Platform Module (TPM): TPM.msc and TPM Remote Management, Trusted Platform Module (TPM) Remote Management, Windows Hello for Business deployment that uses System Center Configuration Manager and Windows PowerShell 2.0 have also been marked as Deprecated.

independent

Microsoft hit with anti-trust complaint from Russian cybersecurity firm over Windows Defender

Russian cybersecurity company Kaspersky Lab said it has filed complaints with regulators in Germany as well as the European Union as a whole against Microsoft, alleging the Redmond, Wash. technology giant unfairly favors its security software over other solutions.

In a blog post with a very Yoda-like title — Antitrust: Pursue It in Europe We Must — Eugene Kaspersky writes that the company is moving forward with complaints to the European Commission and the German Federal Cartel Office because it wants users to have more choices in security software. Kaspersky also filed a complaint with Russia’s Federal Antimonopoly Service late last year on the same issue.

“We see clearly — and are ready to prove — that Microsoft uses its dominant position in the computer operating system (OS) market to fiercely promote its own — inferior — security software (Windows Defender) at the expense of users’ previously self-chosen security solution,” Kaspersky writes. “Such promotion is conducted using questionable methods, and we want to bring these methods to the attention of the anti-competition authorities.”

Microsoft issued the following statement in response to Kaspersky’s claim:

Microsoft’s primary objective is to keep customers protected and we are confident that the security features of Windows 10 comply with competition laws. We’re always interested in feedback from other companies and we engage deeply with antimalware vendors and have taken a number of steps to address their feedback. We reached out directly to Kaspersky a number of months ago offering to meet directly at an executive level to better understand their concerns, but that meeting has not yet taken place.

A European Commission representative confirmed that the complaint has been received.

Windows Defender is built into Windows 10, which Microsoft said last month is on more than 500 million devices, and Kaspersky claims it is impossible to completely disable or uninstall. The cybersecurity company further claims that Microsoft actively encourages people to get rid of independent security systems, and that the upgrade to Windows 10 in some cases invalidated security programs already on a device by uninstalling drivers.

Kaspersky concludes the blog post with the outcome it would like to see from its complaints.

We want Microsoft to stop misleading and misinforming our — and not only our — users. We want to see all security solutions being able to work on the Windows platform on a level playing field. And we want to see users being able to decide for themselves what they want and consider important to them.

Besides, we want fair and healthy competition, which has always given excellent results everywhere – no matter in which industry or market. And btw, we invite all our competitors/colleagues to join us: as we’ve already shown, turning to antitrust bodies does bring positive change.

And remember: the only folks who gain unequivocally if there is a monopoly in the security products market are cybercriminals. They’d love nothing more than to be able to concentrate on trying to out-smart the single security solution of a monopolist.

GeekWire

A bored intern created the original Windows Solitaire

Solitaire has been a staple for office distraction since Microsoft first included the game in Windows 3.0 in 1990. But the digital adaptation wasn’t made by an iconic coder or just one of the company’s many full-time employees. It was programmed by an intern.

Great Big Story has an interview with Wes Cherry, who was an intern at Microsoft in 1988. He describes the experience as “all-encompassing,” but even internships at Microsoft have lulls. He put the downtime to good use. “I came up with the idea to write Solitaire for Windows out of boredom, really,” Cherry said. “There weren’t many games at the time, so we had to make them.” Read more