Tag Archive for: Windows Defender

Microsoft Issues Emergency Windows Security Update For A Critical Vulnerability

/in ,
If your computer is running Microsoft’s Windows operating system, then you need to apply this emergency patch immediately. By immediately, I mean now!

Microsoft has just released an emergency security patch to address a critical remote code execution (RCE) vulnerability in its Malware Protection Engine (MPE) that could allow an attacker to take full control of a victim’s PC.

Enabled by default, Microsoft Malware Protection Engine offers the core cybersecurity capabilities, like scanning, detection, and cleaning, for the company’s antivirus and antimalware programs in all of its products.

According to Microsoft, the vulnerability affects a large number of Microsoft security products, including Windows Defender and Microsoft Security Essentials along with Endpoint Protection, Forefront Endpoint Protection, and Exchange Server 2013 and 2016, impacting Windows 7, Windows 8.1, Windows 10, Windows RT 8.1, and Windows Server.

Tracked as CVE-2017-11937, the vulnerability is a memory corruption issue which is triggered when the Malware Protection Engine scans a specially crafted file to check for any potential threat.

Flaw Lets Hackers Take Full Control of Your Computer

Successful exploitation of the flaw could allow a remote attacker to execute malicious code in the security context of the LocalSystem account and take control of the target’s computer.

Microsoft said an attacker could place a specially crafted malicious file in a location that is scanned by the Malware Protection Engine to exploit the memory corruption flaw which eventually leads to remote code execution.

“There are many ways that an attacker could place a specially crafted file in a location that is scanned by the Microsoft Malware Protection Engine. For example, an attacker could use a website to deliver a specially crafted file to the victim’s system that is scanned when the website is viewed by the user,” the report from Microsoft explained.

Other ways to deliver a specially crafted file could be via emails or Instant Messenger services. The attacker could also “take advantage of websites that accept or host user-provided content, to upload a specially crafted file to a shared location that is scanned by the Malware Protection Engine running on the hosting server,” the report said.

Patch! Patch! Patch!

Microsoft assured its customers that the vulnerability was fixed before any misuses in the wild.

The company has released an out-of-band critical update for the flaw and advised users to install it as soon as possible. Most home users and many enterprise customers will get the emergency patch automatically over the air.

The security vulnerability was discovered and reported to Microsoft by the UK’s National Cyber Security Centre (NCSC), a cyber defense organization of Britain’s signals intelligence and cybersecurity agency, known as GCHQ.

The emergency fix comes just days before Microsoft is scheduled to roll out its December Patch Tuesday updates.

The Hacker News

Microsoft hit with anti-trust complaint from Russian cybersecurity firm over Windows Defender

/in

Russian cybersecurity company Kaspersky Lab said it has filed complaints with regulators in Germany as well as the European Union as a whole against Microsoft, alleging the Redmond, Wash. technology giant unfairly favors its security software over other solutions.

In a blog post with a very Yoda-like title — Antitrust: Pursue It in Europe We Must — Eugene Kaspersky writes that the company is moving forward with complaints to the European Commission and the German Federal Cartel Office because it wants users to have more choices in security software. Kaspersky also filed a complaint with Russia’s Federal Antimonopoly Service late last year on the same issue.

“We see clearly — and are ready to prove — that Microsoft uses its dominant position in the computer operating system (OS) market to fiercely promote its own — inferior — security software (Windows Defender) at the expense of users’ previously self-chosen security solution,” Kaspersky writes. “Such promotion is conducted using questionable methods, and we want to bring these methods to the attention of the anti-competition authorities.”

Microsoft issued the following statement in response to Kaspersky’s claim:

Microsoft’s primary objective is to keep customers protected and we are confident that the security features of Windows 10 comply with competition laws. We’re always interested in feedback from other companies and we engage deeply with antimalware vendors and have taken a number of steps to address their feedback. We reached out directly to Kaspersky a number of months ago offering to meet directly at an executive level to better understand their concerns, but that meeting has not yet taken place.

A European Commission representative confirmed that the complaint has been received.

Windows Defender is built into Windows 10, which Microsoft said last month is on more than 500 million devices, and Kaspersky claims it is impossible to completely disable or uninstall. The cybersecurity company further claims that Microsoft actively encourages people to get rid of independent security systems, and that the upgrade to Windows 10 in some cases invalidated security programs already on a device by uninstalling drivers.

Kaspersky concludes the blog post with the outcome it would like to see from its complaints.

We want Microsoft to stop misleading and misinforming our — and not only our — users. We want to see all security solutions being able to work on the Windows platform on a level playing field. And we want to see users being able to decide for themselves what they want and consider important to them.

Besides, we want fair and healthy competition, which has always given excellent results everywhere – no matter in which industry or market. And btw, we invite all our competitors/colleagues to join us: as we’ve already shown, turning to antitrust bodies does bring positive change.

And remember: the only folks who gain unequivocally if there is a monopoly in the security products market are cybercriminals. They’d love nothing more than to be able to concentrate on trying to out-smart the single security solution of a monopolist.

GeekWire