Archives
-
Microsoft Releases Security Advisory 2914486
Today we released Security Advisory 2914486 regarding a local elevation of privilege (EoP) issue that affects customers using Microsoft Windows XP and Server 2003. Windows Vista and later are not affected by this local EoP issue. A member of the Microsoft Active Protections Program (MAPP) found this issue being used on systems compromised by a third-party remote code execution vulnerability. These limited, targeted attacks require users to open a malicious PDF file. The issues described by the advisory cannot be used to gain access to a remote system alone.
-
Security and policy surrounding bring your own devices (BYOD)
As the proliferation of devices continues to capture the imagination of consumers, and has ignited what is referred to as bring your own device (BYOD) revolution, many IT departments across the globe are now facing increased security considerations. While organizations encourage BYOD for cost savings and productivity, it is also important to have robust security policies supporting BYOD.
-
Download Windows Server 2012 R2 and Get Free Training on the New Capabilities from MVA
As announced on the Windows Server blog last month, the team has released Windows Server 2012 R2 for General Availability. Download the Windows Server 2012 R2 evaluation or use our free Windows Server 2012 R2 Virtual Labs to test the product online without installation.Then, learn directly from Microsoft's product experts with a series of new Windows Server 2012 R2 courses on Microsoft Virtual Academy:View all of the latest courses on Windows Server 2012 on the MVA Windows Server Topic Page. -
Gobble gobble! 8 apps you need to make it through Thanksgiving!
-
Microsoft Cybersecurity Report: Top 10 Most Wanted Enterprise Threats
In my travels abroad over the years, I have had the great opportunity to meet with many enterprise customers to discuss the evolving threat landscape. In addition to helping inform customers, these meetings have provided me with an opportunity to learn more about how customers are managing risk within their environments. Many of these customers are interested in learning about the top threats found in enterprise environments. Visibility into what threats are most common in enterprise environments helps organizations assess their current security posture and better prioritize their security investments. Given the high level of interest in this information, I thought it would be helpful to take a close look at the top 10 threats facing enterprise customers based on new intelligence from the latest Microsoft Security Intelligence Report (SIRv15).
-
The R2 is available at Tech Showcase!
Windows Server 2012 R2 is available at Tech Showcase. The new R2 offers exciting features and enhancements across virtualization, storage, networking, virtual desktop infrastructure, access and information protection, and more. Attend a Microsoft Tech Showcase event and explore what R2 has to offer you and your organization. Register at http://aka.ms/Yclp43Tech Showcase events, hosted by Microsoft Learning Partners, are intended for senior technical experts and IT professional. Attend an event to review new, breakthrough features and capabilities important to you as an It Professional. Plan ahead and help you and your team get skilled and ready for the latest Windows release. -
Ransomware is on the Rise, Especially in Europe
The recently published Microsoft Security Intelligence Report (SIRv15) contains a section on ransomware. Ransomware is a type of malware that is designed to render a computer or its files unusable until the computer user pays the demanded amount of money to the attacker. It often masquerades as an official-looking warning from a well-known law enforcement agency, such as the US Federal Bureau of Investigation (FBI) or the Metropolitan Police Service of London. Some examples are provided in Figure 1.
-
MBSA 2.3 and the November 2013 Security Bulletin Webcast, Q&A, and Slide Deck
Today we’re publishing the November 2013 Security Bulletin Webcast Questions & Answers page. The majority of questions focused on the ActiveX Kill Bits bulletin (MS13-090) and the advisories. We also answered a few general questions that were not specific to any of this month’s updates, but that may be of interest.
-
EMET 4.1 Released
One of the tools I get asked most about when I’m with customers is the Enhanced Mitigations Experience Toolkit (EMET). EMET is a free mitigation tool designed to help IT Professionals and developers prevent vulnerabilities in software from being successfully exploited. The tool works by protecting applications via the latest security mitigation technologies built into Windows, even in cases where the developer of the application didn’t opt to do this themselves. By doing so, it enables a wide variety of software to be made significantly more resistant to exploitation – even against zero day vulnerabilities and vulnerabilities for which an update has not yet been applied.
-
The Threat Landscape in South America: Chile and Colombia
In this fourth and final part of our series on the threat landscape in South America, we examine threats in Chile and then Colombia. As illustrated in Figure 1, both of these regions have had periods where their malware infection rates were above the worldwide average, and have more recently trended down. Read more
-
Authenticity and the November 2013 Security Updates
If you haven't had a chance to see the movie Gravity, I highly recommend you take the time to check it out. The plot moves a bit slowly at times, but director Alfonso Cuaron's work portrayal of zero gravity is worth the ticket price alone. Add in stellar acting and you end up with an epic movie that really makes you miss the shuttle program. Still, the movie has its detractors. Specifically, astrophysicist and geek icon Neil deGrasse Tyson has been critical about the movie's authenticity. To deGrasse Tyson, a lack of authenticity disrupts the movie-going experience.
Similarly, a lack of authenticity can disrupt your computing experience, which leads me to a couple of interesting items in this month's release. Two advisories this month deal with authenticity by focusing on certificates and cryptography. The first is Security Advisory 286725, which disables the use of the RC4 stream cipher. As computing power increases, cryptographic attacks that were once only theoretical become practical - this is the case with RC4, which was originally designed in 1987. That's the same year The Simpsons first appeared as shorts on The Tracy Ullman Show. Computing has changed somewhat in that time.
We've already taken this step in Windows 8.1 and Internet Explorer 11, and now we're providing an update to disable its use in other operating systems as well. Rather than automatically disable the cipher, the update provides a registry key that allows developers to eliminate RC4 as an available cipher in their applications. The SRD blog provides a deep dive into RC4 and the implications of disabling it.
Security Advisory 2880823 also impacts cryptography and authenticity but addresses SHA1. We aren't going to surprise the world by saying we're turning off support for SHA1 today, but we are announcing a new policy for Certificate Authorities (CAs) that deprecates the use of the SHA1 algorithm in SSL and code signing certificates in favor of the SHA2 algorithm. After January 2016, only SHA2 certificates can be issued. The good folks over on the PKI blog go into more detail about the change.
We have an update regarding a cryptographic function as well, MS13-095 addresses an issue in Digital Signatures that could cause a web service to stop responding if it receives a specially crafted X.509 certificate. Since these certificates are used to ensure authenticity, having the web service go down during negotiation is suboptimal.
Of course, another way to help ensure authenticity throughout your computing experience is to use EMET. An updated version of the program is available today. Of the many improvements, there is an update to the default settings that includes two new application protection profiles for applications. There's also an update for the Certificate Trust profile that offers more applications protection. Full details about this release can be found on the SRD blog. It may not patch any holes, but it can make it harder to reach any issue that may exist on a system and, if your family is like mine, it will significantly reduce calls from relatives looking for tech support.
Of course it takes more than just authenticity to make a secure computing experience, which leads us to the other updates for November. Today, we released eight bulletins, three Critical and five Important, addressing 19 unique CVEs in Microsoft Windows, Internet Explorer, and Office. For those who need to prioritize their deployment planning we recommend focusing on MS13-090, MS13-088, and MS13-089.
Our Bulletin Deployment Priority graph provides an overview of this month's priority releases (click to enlarge).
MS13-090 | Cumulative Security Update of Active X Kill Bits
This update addresses a remote code execution issue in an ActiveX control by providing a kill bit for associated ActiveX controls. We are aware of limited attacks that exploit this issue. The code execution occurs at the level of the logged on user, so non-admin users would face less of an impact. The remote code execution vulnerability with higher severity rating be fixed in today's release and we advise customers to prioritize the deployment of MS13-090 for their monthly release. As usual, customer with Automatic Updates enabled will not need to take any action to receive the update. Additional information about this vulnerability is available on the Security Research & Defense blog.
MS13-088 | Cumulative Update for Internet Explorer
This security update resolves ten privately reported vulnerabilities in Internet Explorer. The most severe vulnerabilities could allow remote code execution if a user views a specially crafted webpage using Internet Explorer. An attacker who successfully exploited the most severe of these vulnerabilities could gain the same user rights as the current user.
MS13-089 | Vulnerability in Windows Graphics Device Interface Could Allow Remote Code Execution
This update addresses one privately reported vulnerability in Microsoft Windows. The vulnerability could allow remote code execution if a user views or opens a specially crafted Windows Write file in WordPad. An attacker who successfully exploited this vulnerability could gain the same user rights as the current user.
Last but not least, we are also providing an update for users of DirectAccess (DA) through Security Advisory 2862152. This security feature bypass issue would require a man-in-the-middle attacker to be successful, but if someone can snoop on your DA connection, it's possible they could impersonate a legitimate DA server in order to establish connections with legitimate DA clients. The attacker-controlled system could then intercept the target user's network traffic and potentially determine the encrypted domain credentials. This update, along with the new configuration guidelines available in KB2862152, helps ensure the authenticity of DA connections.
Watch the bulletin overview video below for a brief summary of today's releases.
Our risk and impact graph shows an aggregate view of this month's Security and Exploitability Index (click to enlarge).
For more information about this month's security updates, including the detailed view of the Exploit Index broken down by CVE, visit the Microsoft Bulletin Summary Webpage.
Jonathan Ness and I will host the monthly bulletin webcast, scheduled for Wednesday, November 13, 2013, at 11 a.m. PST. I invite you to register here and tune in to learn more about this month's security bulletins and advisories. We'll provide authentic answers to your update deployment questions, but no zero gravity effects will be employed.
For all the latest information, you can also follow the MSRC team on Twitter at @MSFTSecResponse.
I look forward to hearing your questions in the webcast tomorrow.
Thanks,
Dustin Childs
Group Manager, Response Communications
Microsoft Trustworthy Computing -
ActiveX Control issue being addressed in Update Tuesday
Late last Friday, November 8, 2013, a vulnerability, CVE-2013-3918, affecting an Internet Explorer ActiveX Control was publically disclosed. We have confirmed that this vulnerability is an issue already scheduled to be addressed in “Bulletin 3”, which will be released as MS13-090, as listed in the November Advanced Notification Service (ANS). The security update will be distributed to customers tomorrow via Windows Update at approximately 10:00 AM PDT. Customers who have Automatic Updates enabled will not need to take any action to receive the update.
-
The Threat Landscape in South America: Argentina and Uruguay
In this third part of our series on the threat landscape in South America, we examine threats in Argentina and Uruguay. Of the locations represented in Figure 1, Argentina and Uruguay are among the locations with the lowest malware infection rates in South America. Read more
-
Clarification on Security Advisory 2896666 and the ANS for the November 2013 Security Bulletin Release
Today, we’re providing advance notification for the release of eight bulletins, three Critical and five Important, for November 2013. The Critical updates address vulnerabilities in Internet Explorer and Microsoft Windows, and the Important updates address issues in Windows and Office.
-
The Threat Landscape in South America: Examining Brazil’s Dramatic Improvement
This article, part 2 of a series on the threat landscape in South America, focuses on Brazil. Brazil has had one of the most active threat landscapes in the world for many years. As seen in Figure 1, in the first quarter of 2011 (1Q11), Brazil’s infection rate (19.18) was over double that of the worldwide average (8.65). But Brazil’s infection rate dramatically improved over the following nine quarters, ending the second quarter of 2013 (2Q13) at 6.7 compared to the worldwide average of 5.8. Read more
-
Maslow and Malware: Developing a Hierarchy of Needs for Cybersecurity
Posted by: Kevin Sullivan, Principal Security Strategist, Trustworthy Computing
-
The Threat Landscape in South America
One region of the world I haven’t written extensively about before is South America. Recently I had the opportunity to visit a couple of countries in South America to visit customers and discuss the threats they see in their environments. This is part 1 in a series of articles that will focus on threats found in several locations including Argentina, Brazil, Chile, Colombia and Uruguay. All of these articles are based on new data published in the Microsoft Security Intelligence Report volume 15 and previous volumes.
-
Microsoft Releases Security Advisory 2896666
Today we released Security Advisory 2896666 regarding an issue that affects customers using Microsoft Windows Vista and Windows Server 2008, Microsoft Office 2003 through 2010, and all supported versions of Microsoft Lync. We are aware of targeted attacks, largely in the Middle East and South Asia. The current versions of Microsoft Windows and Office are not affected by this issue. The exploit requires user interaction as the attack is disguised as an email requesting potential targets to open a specially crafted Word attachment. If the attachment is opened or previewed, it attempts to exploit the vulnerability using a malformed graphics image embedded in the document. An attacker who successfully exploited the vulnerability could gain the same user rights as the logged on user.
While we are actively working to develop a security update to address this issue, we encourage our customers concerned with the risk associated with this vulnerability, to deploy the following Fix it from the advisory: -
The Threat Landscape in the European Union at RSA Conference Europe 2013
We had the opportunity to present new findings from the Microsoft Security Intelligence Report volume 15 at RSA Conference Europe last week in Amsterdam. Jeff Jones and I presented some of the new data from the report.
-
Observations from the FedRAMP Certification Process
Posted by Scott Charney, Corporate Vice President, Trustworthy Computing, Microsoft
-
Updates: RAMMap v1.32, Sigcheck v2.01
RAMMap v1.32: This fixes a bug in v1.30 that caused RAMMap to fail on Windows 8.
