# data[].attributes.body
Here is an article We found concerning an exploit for Windows Defender, thankfully it was fixed.

A file would be downloaded and then the vulnerability would be exploited only when Defender scanned the file.

# data[].attributes.attachment_link.readable_text
Microsoft has issued an advisory and patched a remote code execution vulnerability in its Microsoft Malware Protection Engine after the flaw was spotted by a Google Project Zero bug hunter.

The critical vulnerability, CVE-2017-8558, was patched on June 23 for Windows Defender in the 32- and 64-bit versions of Windows Server 2008, Windows 10, 8.1, and 7. It was discovered by Tavis Ormandy, databreachtoday.com reported.

"To exploit this vulnerability, a specially crafted file must be scanned by an affected version of the Microsoft Malware Protection Engine," Microsoft wrote, adding the specially crafted file could be sent via a website through a drive by attack, email, instant message or through a website that hosts user-provided content.

The vulnerability actually kicks in when Windows Defender begins to do its job of scanning for potential problems.

"If the affected antimalware software has real-time protection turned on, the Microsoft Malware Protection Engine will scan files automatically, leading to exploitation of the vulnerability when the specially crafted file is scanned. If real-time scanning is not enabled, the attacker would need to wait until a scheduled scan occurs in order for the vulnerability to be exploited," Microsoft wrote.

# data[].attributes.attachment_link.title
Microsoft Windows Defender flaw found and fixed | SC Media

# data[].attributes.attachment_link.description
Microsoft has issued an advisory and patched a remote code execution vulnerability in its Microsoft Malware Protection Engine after the flaw was spotted by a Google Project Zero bug hunter. The critical vulnerability, CVE-2017-8558, was patched on June 23 for Windows Defender in the 32- and 64-bit versions of Windows Server 2008, Windows 10, 8.1, and 7.

# data[].attributes.body
The GLA's Met police have recently upgraded 8,000 of their computers from an outdated operating system, Windows XP that no longer received updates, to one of Window's latest operating system, 8.1 leaving nearly 30,000 computers still using the outdated XP operating system. One of the 6 main hardening categories is to "apply updates" that applies to software and hardware. The Met police were and still are largely susceptible to attacks do to the fact they haven't updated all of their operating systems. Upgrading their network security could beef up their defenses to ensure that all of their data cant be breached from a remote device with access to their network.

# data[].attributes.attachment_link.readable_text
Nearly 30,000 London Metropolitan police computers are still using Windows XP, raising eyebrows among cyber-security experts who point out that XP no longer receives security updates from Microsoft.

The Met arrived at this number after upgrading 8000 computers to Windows 8.1, slashing the number of XP reliant computers from 35,000 last year to 27,000. The final migration of Met computers was, according to The Register, supposed to be completed in March this year.

The contention was raised by London councillor Andrew Boff, a Conservative member of the Greater London Assembly (GLA).

Boff addressed the GLA saying, "Operating systems age more like milk than wine, and Windows XP is well past its sell-by date."

Boff went on to say that the fact 27,000 Met police computers are still using the OS is "worrying". Of principal concern is the security of Londoner's data on such an old OS.

Not only did XP suffer from a number of security problems in its lifetime, but Microsoft also ceased supporting it as far back as March 2014.

It was at that point, however that the Met extended its support contract with Microsoft until April 2017, at a cost of £1.65 million, which, according to the service "means we have no security concerns as a result of our continued use of XP".

"Most organisations have less than half a dozen Windows XP computers, or none at all," said Justin Harvey, CSO at Fidelis Cybersecurity. "Even with Microsoft creating the occasional patch, Windows XP has proven to be extremely insecure and should be replaced with Windows 10 with haste."

"I would also advise the Met Police to 'assume compromise,' which means that with this amount of legacy systems, there stands a very high probability that it's been breached. Until the Met Police gets all of its Windows XP systems upgraded, I would also recommend doubling down on monitoring the network and hunting for threats as a possible mitigation strategy."

A spokesperson for the Met police told SC,"The MPS is undergoing a complete refresh of its information technology processes, infrastructure, and equipment - including its desktop computers."

However, he added: "The upgrade programme is not as simple as it would be for many other organisation due to the amount of specialist legacy software upon which parts of the MPS still rely."

With the recent upgrade of 8000 machines, the Met plans to replace many computers with laptops and tablets. Another 6000 will be upgraded by December, leaving 21,000 machines languishing in the senile grip of XP.

Boff was however sceptical of that decision too: "This is neither the newest version of Windows nor the most used version of the software. Staff are likely to be more familiar with Windows 10, but most importantly it will be supported further into the future."

Boff did not respond to requests for comment.
This article originally appeared on - SC Magazine UK

# data[].attributes.attachment_link.title
Most Met police computers still using Windows XP | SC Media

# data[].attributes.attachment_link.description
Nearly 30,000 London Metropolitan police computers are still using Windows XP, raising eyebrows among cyber-security experts who point out that XP no longer receives security updates from Microsoft. The Met arrived at this number after upgrading 8000 computers to Windows 8.1, slashing the number of XP reliant computers from 35,000 last year to 27,000.

# data[].attributes.body
MacOS security reputation challenged by new ransomware-as-a-service

This article is about how recently more malware has been targeting MacOS as its market share increases, the benefits of targeting them increases, in this case .25BTC(Bitcoin) to recover files encrypted by this ransomware. With this I think the ideas of MacOS being more secure is going away, as the article says all OS's are imperfect and have vulnerabilities, and we as users need to do a better job of securing our private data.

https://www.scmagazine.com/home/security-news/ransomware/macos-security-reputation-challenged-by-new-ransomware-as-a-service/

# data[].attributes.body
The recent patch for iOS 12.1 allows attackers to see all contact information of other people by using the group facetime feature, including all the contacts in the other user's phone book.

# data[].attributes.attachment_link.readable_text
A researcher has apparently found a way to exploit the new Group FaceTime feature in iOS 12.1 in order to access iPhone users' contact information.

The Hacker News has reported that Spanish researcher Jose Rodriguez made the discovery just hours after the release of version 12.1 last Oct. 31, and subsequently created a video of his technique, which he posted online.

The "hack" works by calling one person's iPhone from another iPhone, then upon connection launching the FaceTime video call option and selecting "Add Person" from the menu. Doing so will reveal to the attacker the other phone's full contact list. Using the 3D Touch option on each contact reveals even more information.

The Hacker News reports that Rodriguez has previously uncovered other iPhone passcode bypass hacks, including two that leverage Siri and the VoiceOver screen reader in iOS versions 12 and 12.0.1, respectively.

Apple's last update to iOS version 12.1 included fixes to 32 vulnerabilities found in a number of features and components, including AppleAVD, Contacts, CoreCrypto, FaceTime, the Graphics Driver, ICU, IOHIDFamily, IPSec, the Kernel, Messages, NetworkExtension, Notes, Safari Reader, Security, VoiceOver, WebKit and WiFi. However, a new update to address this apparent oversight in FaceTime may soon be in order.

SC Media has contacted Apple for comment.

# data[].attributes.attachment_link.title
Group FaceTime for iOS exposes users' full contact info | SC Media

# data[].attributes.attachment_link.description
A researcher has apparently found a way to exploit the new Group FaceTime feature in iOS 12.1 in order to access iPhone users' contact information. The Hacker News has reported that Spanish researcher Jose Rodriguez made the discovery just hours after the release of version 12.1 last Oct.

# data[].attributes.body
This article shows how overlooking something very basic in your OS can lead to potentially catastrophic consequences.

# data[].attributes.attachment_link.readable_text
A root access flaw in Apple's macOS High Sierra 10.13.1 makes it possible for anyone to log into the system by typing "root" into the name field.

"We noticed a *HUGE* security issue at MacOS High Sierra," tweeted security researcher Lemi Orhan Ergin, who first discovered the flaw. "Anyone can login as 'root' with empty password after clicking on login button several times."

Ergin noted in another tweet that "You can access it via System Preferences>Users & Groups>Click the lock to make changes. Then use 'root' with no password."

"The MacOS High Sierra vulnerability is alarming because it makes it seamless for someone to log into a system as root. While there are other methods that can provide bad actors with access and password reset capabilities via physical access, these require some technical knowledge and time," said JASK Director of Cybersecurity Rod Soto, who has tested and verified the flaw. "The severity of this is how simple and quick anyone can execute the method and log in to reset and access user information even if their passwords are complicated."

Once in, bad actors could "also install backdoors and disable any other protections on the device," Soto said.

However, he noted, "it is expected that every corporate department that issues these types of devices would add passwords to root accounts as standard operating procedure."

" This incident is a good reminder that system admins need to be prepared for worst-case scenarios by layering multiple digital security systems," said Mike Buckbee, security engineer at Varonis.

"Modern computing is built up with layers upon layers of different interacting software systems," said Buckbee. "With so many interactions, this virtually guarantees that serious vulnerabilities are going to be present."

Even with massive efforts to QA and harden systems" inevitably "something, somewhere is going to be missed," he said. "For an enterprise to be secure it can't focus solely on the systems and vulnerabilities, but needs to look at the behavior of accounts, traffic and data on individual computing devices and the network."

Buckbee said the flaw also underscored the threat that physical access poses. "If left for just a few moments in the wrong hands, your device could easily be compromised," he said.

# data[].attributes.attachment_link.title
Flaw in macOS High Sierra allows easy access | SC Media

# data[].attributes.attachment_link.description
A root access flaw in Apple's macOS High Sierra 10.13.1 makes it possible for anyone to log into the system by typing "root" into the name field. "We noticed a *HUGE* security issue at MacOS High Sierra," tweeted security researcher Lemi Orhan Ergin, who first discovered the flaw.

# data[].attributes.body
This article shows how overlooking something very basic in your OS can lead to potentially catastrophic consequences.

# data[].attributes.attachment_link.readable_text
A root access flaw in Apple's macOS High Sierra 10.13.1 makes it possible for anyone to log into the system by typing "root" into the name field.

"We noticed a *HUGE* security issue at MacOS High Sierra," tweeted security researcher Lemi Orhan Ergin, who first discovered the flaw. "Anyone can login as 'root' with empty password after clicking on login button several times."

Ergin noted in another tweet that "You can access it via System Preferences>Users & Groups>Click the lock to make changes. Then use 'root' with no password."

"The MacOS High Sierra vulnerability is alarming because it makes it seamless for someone to log into a system as root. While there are other methods that can provide bad actors with access and password reset capabilities via physical access, these require some technical knowledge and time," said JASK Director of Cybersecurity Rod Soto, who has tested and verified the flaw. "The severity of this is how simple and quick anyone can execute the method and log in to reset and access user information even if their passwords are complicated."

Once in, bad actors could "also install backdoors and disable any other protections on the device," Soto said.

However, he noted, "it is expected that every corporate department that issues these types of devices would add passwords to root accounts as standard operating procedure."

" This incident is a good reminder that system admins need to be prepared for worst-case scenarios by layering multiple digital security systems," said Mike Buckbee, security engineer at Varonis.

"Modern computing is built up with layers upon layers of different interacting software systems," said Buckbee. "With so many interactions, this virtually guarantees that serious vulnerabilities are going to be present."

Even with massive efforts to QA and harden systems" inevitably "something, somewhere is going to be missed," he said. "For an enterprise to be secure it can't focus solely on the systems and vulnerabilities, but needs to look at the behavior of accounts, traffic and data on individual computing devices and the network."

Buckbee said the flaw also underscored the threat that physical access poses. "If left for just a few moments in the wrong hands, your device could easily be compromised," he said.

# data[].attributes.attachment_link.title
Flaw in macOS High Sierra allows easy access | SC Media

# data[].attributes.attachment_link.description
A root access flaw in Apple's macOS High Sierra 10.13.1 makes it possible for anyone to log into the system by typing "root" into the name field. "We noticed a *HUGE* security issue at MacOS High Sierra," tweeted security researcher Lemi Orhan Ergin, who first discovered the flaw.

# data[].attributes.body
The Linux Mint ISO on the distro's website was altered to include an IRC backdoor known as Tsunami, which gives the hacker shell access on infected systems. The hack could have been caught by a well-defined web application layer inspection rule set and profile, and users who downloaded the infected ISO image could have checked the MD5 hash and found it was compromised as well. The forum database was stolen as well and contained username and passwords for members. The hacker claims to have just been poking around and happened to find a way into the server, and that this was not a targeted attack.
Further research into this story the site was hacked through its outdated WordPress installation. If the network admins practiced a better hardening plan and updated their services this attack would have easily been prevented.
This technology lacked the essential hardening tools that it needed to protect it's defenses. Had there been the principle of least privilege set up, this user would not have been able to stumble on access to the backdoor. This system is highly capable of having a Host Intrusion Detections System embedded into it, as well as exploit frameworks to make sure the system was working properly and to prevent exploits that could have risked the security of several users and the creators of the OS itself.

# data[].attributes.attachment_link.readable_text
The Linux Mint operating system software download has been hacked on the community-driven distribution's own website. The Linux Mint ISO 'disk image' data contents were maliciously altered, meaning than anyone downloading and installing the software over the weekend of 20/21 February 2016 will find that their machine has been compromised.

The Linux Mint operating system, which is a 'variant' based upon Debian and Ubuntu (two other popular Linux OS distributions), has enjoyed popularity as a result of its combination of packaged software, its focus on desktop functionality and its appealing graphical user interface (GUI).

In what can be regarded as something of a setback for fans of free and open source software (FOSS) distributions, the only compromised version was Linux Mint 17.3 Cinnamon edition.

According to the Linux Mint official blog, "We were exposed to an intrusion today. It was brief and it shouldn't impact many people. Hackers made a modified Linux Mint ISO, with a backdoor in it and managed to hack our website to point to it."
Who is NOT affected?
The team points out that users who downloaded another release or another edition are not affected. Users who downloaded Linux Mint via torrents or via a direct HTTP link are also not affected.

The Linux Mint blog is currently visible and details the specific technical reasons behind the attack. However, the Linux Mint website itself is offline at the time of writing. The process for checking whether an ISO file installation has a valid MD5 signature is detailed at the aforementioned blog link.

For those with an interest, an MD5 (message-digest algorithm) is a cryptographic technique used to check whether a file has been altered.

As Tim Anderson explains, "The infected ISOs installed the operating system complete with the IRC (Internet Relay Chat) backdoor Tsunami, giving miscreants access to infected systems via IRC servers."

Tsunami is a manually configurable bot that talks to an IRC server to send a 'flood' of traffic to compromised websites and servers. As detailed by F-Secure, it acts as a distributed denial-of-service (DDoS) flooder that is also capable of downloading files and executing shell commands in an infected system.

Creator of Linux Mint, Clem Lefebvre, has said that the hack is connected to Sofia, Bulgaria and his team has pinpointed the names of three possible perpetrators. It later transpired that this might simply be the location of the file server used to store the hack's details.

"We don't know their roles in this, but if we ask for an investigation, this is where it will start. What we don't know is the motivation behind this attack. If more efforts are made to attack our project and if the goal is to hurt us, we'll get in touch with authorities and security firms to confront the people behind this," said Lefebvre.
User forum details also hacked
This is not the only element in the Linux Mint hack story. Lefebvre has also confirmed that hackers have stolen a complete copy of the site's forum login details. Members' passwords, addresses, birthdates and profile pictures are all thought to have been copied.

The Linux Blog states, "It was confirmed that the forums database was compromised during the attack led against us yesterday and that the attackers acquired a copy of it. If you have an account on forums.linuxmint.com, please change your password on all sensitive websites as soon as possible."

If the Linux Mint team remains clueless then they should perhaps talk to ZDNet's Zack Whittaker who claims to have already had an encrypted chat with the hacker responsible, who goes by the name 'Peace'.

Peace told Whittaker on Sunday that a "few hundred" Linux Mint installs were under his control and that this is 'a significant portion' of the thousand-plus downloads during the day.

According to ZDNet's Whittaker, "Peace declined to give their name, age, or gender, but did say they lived in Europe and had no affiliations to hacking groups. The hacker, known to work alone, has previously offered private exploit services for known vulnerabilities services on private marketplace sites he is associated with."

Peace was apparently 'just poking around' on the Linux Mint site when he or she found the vulnerability granting unauthorised access.

An external view

Richard Cassidy, technical director EMEA at Alert Logic, told SC this particular exploit strikes at the very core of open source and will go some way in affecting user confidence in this specific distro.

"What is very interesting is that the exploit is attributed to an IRC botnet enabling DDoS attacks; we've seen a stark rise in popularity of DDoS from bad-actor groups. Infecting core distros of popular open source software is a very effective way to spread a Botnet network very rapidly and effectively; furthermore it'll remain in the public domain for some time, given file-sharing sites and torrent download areas," he said.

"The challenge is that open source technologies and sites are far less funded and, as such, maintaining high-levels of protection with limited funds is always going to be a challenge. This particular exploit would have been effectively detected and thwarted through a well defined web application layer inspection rule set and profile, but users would have been easily able to detect something amiss through MD5 hash checking of the downloaded image - unfortunately not a process followed often enough by average users of open source software," added Cassidy.

Overall though, Cassidy asserts that this will not affect confidence in the Mint distro.

"Not least given the sites forum details being stolen and many users details compromised. It's time for open source providers to take note and understand that open source does not imply security by any stretch," he added.

In line with other media covering this story, at the time of writing SCMagazineUK.com has not been able to confirm when the Linux Mint project will be fully functional again.
This article originally appeared on - SC Magazine UK

# data[].attributes.attachment_link.title
Linux Mint operating system maliciously hacked | SC Media

# data[].attributes.attachment_link.description
The Linux Mint operating system software download has been hacked on the community-driven distribution's own website. The Linux Mint ISO 'disk image' data contents were maliciously altered, meaning than anyone downloading and installing the software over the weekend of 20/21 February 2016 will find that their machine has been compromised.