Security, FUD, and Windows TCO
Forbes ☛ New Chrome Warning For 3.2 Billion Windows, Mac, Linux, Android Users [Ed: The typical clickbait nonsense/noise from Microsoft's longtime propagandist Dave Winder]
-
Bleeping Computer ☛ Microsoft November 2024 Patch Tuesday fixes 4 zero-days, 91 flaws
Today is Microsoft’s November 2024 Patch Tuesday, which includes security updates for 91 flaws, including four zero-days, two of which are actively exploited.
-
Krebs On Security ☛ An Interview With the Target & Home Depot Hacker
In December 2023, KrebsOnSecurity revealed the real-life identity of Rescator, the nickname used by a Russian cybercriminal who sold more than 100 million payment cards stolen from Target and Home Depot between 2013 and 2014. Moscow resident Mikhail Shefel, who confirmed using the Rescator identity in a recent interview, also admitted reaching out because he is broke and seeking publicity for several new money making schemes.
-
Windows TCO
-
Security Week ☛ Windows Zero-Day Exploited by Russia Triggered With File Drag-and-Drop, Delete Actions
Tracked as CVE-2024-43451, the zero-day is a medium-severity flaw that impacts the MSHTM engine, which continues to be used through WebBrowser control by Edge in Internet Explorer mode and other applications, exposing them to any security defects plaguing the component.
Successful exploitation of CVE-2024-43451 allows threat actors to steal a victim’s NTLMv2 hash and then use it to authenticate as the targeted user by performing pass-the-hash attacks.
-
Tripwire ☛ ShrinkLocker Ransomware: What You Need To Know
ShrinkLocker is a family of ransomware that encrypts an organisation's data and demands a ransom payment in order to restore access to their files. It was first identified by security researchers in May 2024, after attacks were observed in Mexico, Indonesia, and Jordan.
So far, so normal. What makes it noteworthy?
The ShrinkLocker ransomware is unusual because it uses VBScript and Microsoft Windows's legitimate security tool BitLocker to assist with the encryption of victims' files.
-
-
Integrity/Availability/Authenticity
-
The Record ☛ Malware being delivered by mail, warns Swiss cyber agency
According to OFCS, “by scanning the QR code in the letter, the phone user downloads malware known as ‘Coper’ and ‘Octo2’. When installing the fake app, the program attempts to steal sensitive data such as login details for more than 383 mobile apps, including e-banking apps.”
The use of real-world lures to infect people with malware is unusual due to the additional overheads that physical operations involve compared to online [cracking].
-