Computer Safety & News

https://www.us-cert.gov/ncas/alerts/aa19-290a

QUOTE:  Systems running Windows 7 and Windows Server 2008 R2 will continue to work at their current capacity even after support ends on January 14, 2020. However, using unsupported software may increase the likelihood of malware and other security threats. Mission and business functions supported by systems running Windows 7 and Windows Server 2008 R2 could experience negative consequences resulting from unpatched vulnerabilities and software bugs. These negative consequences could include the loss of confidentiality, integrity, and availability of data, system resources, and business assets.

Mitigations

References

Below are key resources documenting this recent monthly Microsoft Patch Tuesday release

https://isc.sans.edu/forums/diary/Microsoft+October+2019+Patch+Tuesday/25396/

https://blog.talosintelligence.com/2019/10/microsoft-patch-tuesday-oct-2019.html

https://www.thezdi.com/blog/2019/10/8/the-october-security-update-review

https://patchtuesdaydashboard.com/

https://portal.msrc.microsoft.com/en-us/security-guidance/summary

QUOTE from TALOS — Microsoft disclosed nine critical vulnerabilities this month, eight of which we will highlight below.

CVE-2019-1333 is a client-side remote execution vulnerability in Remote Desktop Services (RDP) that occurs when a user visits a malicious server.

CVE-2019-1238 and CVE-2019-1239 are remote code execution vulnerabilities that exist in the way VBScript handles objects in memory. An attacker could exploit these vulnerabilities by tricking a user into visiting a specially crafted, malicious website through Internet Explorer.

CVE-2019-1307, CVE-2019-1308, CVE-2019-1335 and CVE-2019-1366 are all memory corruption vulnerabilities in the Chakra Scripting Engine inside of the Microsoft Edge web browser.

CVE-2019-1372 is an elevation of privilege vulnerability on Azure Stack when the Azure App Service fails to properly check the length of a buffer prior to copying memory to it.

There is also CVE-2019-1060, a remote code execution vulnerability in  Microsoft XML Core Services.

It is important to keep devices fully patched & on latest AV protection levels

https://www.us-cert.gov/ncas/current-activity/2019/10/04/vulnerabilities-exploited-multiple-vpn-applications

Improved protection for a new serious vulnerability was released on out of band (OOB) basis:

https://www.us-cert.gov/ncas/current-activity/2019/10/03/microsoft-re-releases-security-updates

https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1367

Microsoft has re-released security updates to address a vulnerability in Microsoft software. Updates are now available automatically via Windows Update or Windows Server Update Services.  Please review Microsoft Security Advisory for CVE-2019-1367 and apply the necessary updates.

The IC3 division of FBI has issued this special emergency alert

https://www.us-cert.gov/ncas/current-activity/2019/10/04/ic3-issues-alert-ransomware

https://www.ic3.gov/media/2019/191002.aspx

The Internet Crime Complaint Center (IC3) has released an alert on ransomware threats to U.S. businesses and organizations. Ransomware is a type of malware designed to deny access to a computer system or data until a ransom is paid. Cyber criminals often infect organizations with ransomware through email phishing campaigns or exploiting vulnerabilities in software or Remote Desktop Protocol (RDP).   The Cybersecurity and Infrastructure Security Agency (CISA) encourages users and administrators to review the IC3 Alert and CISA’s resource page on ransomware for more information on protecting against and responding to ransomware.

The FBI notes that “romance scams” is one of top five dangers for fraud when being online. Several recent documentaries are noted below of how Facebook & other social network scams work:

https://heimdalsecurity.com/blog/top-online-scams/#romancescams

To avoid becoming a victim of these Internet scams, you need to learn how to better protect yourself.  Knowing that hundreds of women and men from all over the globe are victims of this online scams, we recommend using these security tips for defensive online dating, including warning signs that could help you from becoming an easy target.

I would also recommend reading these real stories and learn from them, so you don’t fall for these online scams:

• A woman lost £1.6 million after she met two conmen on a dating site
• A Perth woman has lost $300,000 after falling in love with a fake Facebook profile
• US woman lost her $50.000 life savings by becoming victim of a cyber-dating scam artist

The FBI has created an excellent National Cybersecurity Awareness Month security awareness page:

https://www.fbi.gov/news/stories/national-cybersecurity-awareness-month-100119

The SANS ISC shares an interesting & in-depth analysis of how a “Lost Files” Ransomware attack used same fake email message a former virus was packaged in years ago.

https://isc.sans.edu/forums/diary/LostFiles+Ransomware/25382/

Malware developers don’t reinvent the wheel and re-use code published here and there. I spotted a ransomware which looked like a former Microsoft based email attack. Once processed, files are renamed with the extension ‘.Lost_Files_Encrypt‘. Apparently, the ransomware started to scan for SMB services (TCP/445) on random IP addresses after the initial infection. Probably trying to infect host vulnerable to EternalBlue.

Annually October is “National Cybersecurity Awareness Month” with key links below

https://www.us-cert.gov/ncas/current-activity/2019/09/30/prepare-national-cybersecurity-awareness-month

https://staysafeonline.org/

This year’s theme, “Own IT. Secure IT. Protect IT.,” focuses on promoting personal accountability and positive behavior when it comes to cybersecurity.   CISA encourages organizations to see the NCSAM 2019 webpage and the NCSAM 2019 Toolkit for ways to participate in and promote NCSAM.