STE WILLIAMS

While education and efforts around online credentials are improving, password hygiene still has problems

The lines drawn between personal digital space and work digital space are all but disintegrated as the traditional 40-hour work week in a confined office dissolves away in this gig economy. This makes life difficult when it comes to accessing and securing data. A survey out recently by Ping Identity shows how even though companies my have good credential policies in place, and employees are made aware of security, their password safety still lags. Here’s a look at some of the relevant stats. 

 

Ericka Chickowski specializes in coverage of information technology and business innovation. She has focused on information security for the better part of a decade and regularly writes about the security industry as a contributor to Dark Reading.  View Full Bio

Article source: http://www.darkreading.com/the-employee-password-habits-that-could-hurt-enterprises/d/d-id/1323476?_mc=RSS_DR_EDT

Remote attackers could snoop on or corrupt the systems that collect and store radar images, vessels’ position and speed, and audio recorded in the ships’ bridge or engine room.

The researcher who has discovered security weaknesses in satellite communications is now uncovering vulnerabilities in voyage data recorder systems (VDRs) used by cargo ships, cruise ships, and other sea craft. Remote, unauthenticated attackers might exploit the weaknesses to spy on crew’s conversations and tamper with “black box” data investigators would use to discover the cause of an accident — including radar images, the vessel’s position and speed, and audio recorded in the ship’s bridge or engine room.

Ruben Santamarta, principal security consultant for IOActive, wrote today about his findings from static analysis and QEMU emulation of the Furumu VR-3000 VDR firmware and sotware.

Although the VDR is the closest thing seacraft have to an aircraft’s “black box,” it’s very different in terms of access controls. An aircraft’s system is intended to be tamper-proof, inaccessible by the pilot and the rest of the crew. Conversely, says Santamarta in an interview with DarkReading, “It [a VDR] shouldn’t be used by everybody but technically the VDR belongs to the vessel’s owner. So this basically means that the captain and certain members of the crew have to know how to operate it in case of an emergency. It may be locked but still accessible for authorized personnel.”

In his blog today, Santamarta notes two prior examples of VDR tampering. In February 2012, two Indian fishermen were shot by Italian marines who said they thought the fishermen were pirates. The incident caused a diplomatic conflict and an investigation into whether what the Italian marines said was true. The VDR recordings on the Italian craft could have substantiated or discredited the marines’ claims, but the Indian Times reported “a preliminary probe into the incident found that the VDR was tampered with” and the records corrupted.

The following month, there was a hit-and-run incident off the southern coast of India. Again, VDR files were tampered with, apparently because a member of the crew inserted a pen drive into the device, leading to rewriting of files and loss of voice data.

As Santamarta writes:

From a security perspective, it seems clear VDRs pose a really interesting target. If you either want to spy on a vessel’s activities or destroy sensitive data that may put your crew in a difficult position, VDRs are the key.

Unfortunately, according to Santmarta, in his blog, “almost the entire design [of the VDRs] should be considered insecure.” Altogether they contributed to cause a vulnerability he found in the Furumu VR-3000’s firmware upgrade process that allows remote, unauthenticated attackers to execute arbitrary commands with root privileges. 

“The design allows unauthenticated users to install a malicious firmware due to multiple weaknesses,” says Santamarta, “weak encryption, unsigned firmware files, privileged endpoints and services exposed.”

Although the vulnerability can be exploited by “remote” attackers, it is not directly via the Internet. “VDRs are not connected to the Internet (at least, they shouldn’t),” says Santamarta. “The remote vector is related to the network onboard. Also, if this network is not properly segmented this may pose an attack vector for malware located in crew laptops or any other personal device.”

Santamarta recommends that any data collected from these devices for forensic purposes should be carefully evaluated for signs of tampering.

“There is no standard way to store data [on VDRs] as the only requirement from the [International Maritime Organization] is that manufacturers should provide software to extract and playback the data,” says Santamarta. “So each model should be analyzed separately.”

Sara Peters is Senior Editor at Dark Reading and formerly the editor-in-chief of Enterprise Efficiency. Prior that she was senior editor for the Computer Security Institute, writing and speaking about virtualization, identity management, cybersecurity law, and a myriad … View Full Bio

Article source: http://www.darkreading.com/iot/sea-craft-voyage-data-systems-vulnerable-to-tampering-spying/d/d-id/1323495?_mc=RSS_DR_EDT

It’s a scene that many of us in a certain age group can relate to: a mom and dad sit on a couch, flanking their pale, silent son.

Such a clever boy! Spends all night on his computer, they say in unison, chuckling.

The other day he was using one of those shooter games, and he was losing, so he crashed the server!

And what do they call it on the telly, d-dosing? He’s no dosser, though: 100% in maths!

And so clever with his money: “He’s got more in his account than me!” his mother whispers, as the video shows the kid in front of a screen with a list of accounts transferring money.

“Anyway, that’s probably enough of us rambling on,” the actress says.

The camera turns to a couple of NCA agents on a couch. “No, not at all,” one says while the other takes notes. “In fact, best if we start again.”

The video is part of the UK National Crime Agency’s (NCA’s) attempt to address the fact that when it comes to technology, kids are getting smarter at ever younger ages.

Unfortunately, that means that ever-younger children are slipping over the line that separates exploration and pranks from major cybercrime.

The average age of suspected cyber offenders has dropped precipitously – from 24 to 17 – over the past year, the NCA says.

On Tuesday, the agency launched a campaign to get through to those kids’ parents, who, just like the parents in that dramatization, might not have a clue what kids are up to as they tap away on digital devices behind closed doors.

It’s called the #CyberChoices campaign, and it’s aimed at educating the parents of 12 to 15-year-old boys.

#CyberChoices highlights the type of illegal online activity children can become involved in, seeks to help parents and other caregivers to spot signs of potential problems, understand what the consequences could be, and suggests better ways for young people to use their technology skills and interest.

The NCA says that asking these questions can help to spot behaviors that can be warning signs:

• Is your child spending all of their time online?
• Are they interested in coding? Do they have independent learning material on computing?
• Do they have irregular sleeping patterns?
• Do they get an income from their online activities? If so, do you know why and how?
• Are they resistant when asked what they do online?
• Do they use the full data allowance on the home broadband?
• Have they become more socially isolated?

The NCA has commissioned research that’s shown that the majority of young people and their parents aren’t even aware of what constitutes a cybercrime or the consequences of engaging in it.

In fact, young people who get involved in cybercrime could face these repercussions:

• A visit and warning from police or NCA officers
• Being arrested
• Their computers being seized and being prevented from accessing the internet
• A penalty or fine
• Up to 10 years in prison for serious offenses.

There are a number of youngsters facing those consequences now.

In August, six UK teenagers between the ages of 15 and 18 were arrested as part of an operation targeting users of LizardStresser, an online tool for attacking websites.

The NCA says that among younger users, Remote Access Trojans (RATs) are also popular.

One high-profile creep who used the Blackshades RAT – along with another RAT called Darkcomet – was Jared James Abrahams: a 20-year-old who was sentenced in 2014 to 18 months in federal prison for spying on and extorting Miss Teen USA, Cassidy Wolf, plus 150 others.

But 20 is actually a little ripe for RAT aficionados. The NCA says that in an operation targeting Blackshades users, the average age of 22 people arrested was only 18.

The youngest Blackshades buyer was only 12 years old.

The TalkTalk breach is another case in point.

Four out of five suspects arrested in connection with the breach are in their teens: a 15-year-old Northern Irish schoolboy, a 16-year-old London boy, a 16-year-old boy in Norwich, and an 18-year-old male from Wales.

The #CyberChoices campaign offers resources including guidance for parents, an educational unit for teachers, video resources featuring an ex-hacker discussing the consequences of his crimes, as well as the video for parents to watch with their children to help provoke discussion of the issue.

Richard Jones, Head of the National Cyber Crime Unit’s Prevent team:

We have aimed the campaign initially at parents, because we know from research that they often are unaware of what their children are doing online. These individuals are really bright and have real potential to go on to exciting and fulfilling jobs. But by choosing the criminal path they can move from low level ‘pranking’ to higher level cybercrime quite quickly, sometimes without even considering that what they’re doing is against the law.

We want these young people, and their parents, to understand that choosing that path can result in a criminal record, can limit their choices for their future, and can put restrictions on their daily lives including the loss of access to the internet.

Follow @NakedSecurity

Follow @LisaVaas

Image of cyber criminal courtesy of Shutterstock.com

Article source: http://feedproxy.google.com/~r/nakedsecurity/~3/TtGJA3x50aY/

Prostitution may be the world’s oldest profession, but technology increasingly has it on the run.

A few weeks ago, it was license plate reader technology that lawmakers were thinking of using to determine who owns vehicles that cruise neighborhoods known for prostitution – the idea being to send “John letters” to vehicle owners suspected of soliciting sex.

Cities including Minneapolis, Des Moines and Oakland, California, are already sending this type of letter, but Los Angeles’s possible use of license plate reader technology would automate and broaden the scope of public surveillance considerably.

Now, it appears that drones are the new prostitution-fighting surveillance tool.

A 75-year-old man from the US state of Oklahoma, Douglas Blansett, was arrested and prosecuted after an anti-prostitution vigilante used his drone to capture footage of the man in a car with a suspected sex worker, allegedly in flagrante delicto.

The man was arrested and released on Thursday, as was the woman involved, Amanda Zolicoffer.

The charge for both was engaging in a misdemeanor act of lewdness.

The drone was dispatched to spy on the couple by Brian Bates, a self-styled Video Vigilante® (yes, he’s apparently registered the title) whose site says that since 1996 he’s been documenting the realities of street prostitution to expose johns on his website.

Bates conducted the drone surveillance in March 2015 and posted the footage in August 2015.

The drone begins its flight at minute 4:09 in the video. Within seconds, it’s hovering over a white pickup truck.

By minute 4:31, the drone’s floating down to the truck.

By 5:15, the peeping drone is hovering in front of the windshield, focused on the driver, who’s leaning over the woman in the passenger’s seat.

At some point, perhaps realizing that he was being surveilled, he straightens up, then drives off at 5:49.

JohnTV turned the video over to police.

According to the video, JohnTV.com has in the past twice been granted permission to access the private commercial property – a tire yard – he drives onto.

In Bates’s post, he suggests that viewers probably have some good questions, including “Is this even legal?” and “Are we going to see more videos like this?”

Good questions.

His answers: yes, and probably not.

NBC affiliate KFOR News Channel 4 touched on the legality and privacy issues on the same day that JohnTV announced it was posting the video.

The station quoted Oklahoma City Police Department Captain Paco Balderrama:

We have yet to see how this is going to play out, but at this time, there is no city ordinance against flying a drone.

A local district attorney, Scott Rowland, confirmed the legality, telling News 9 that it’s perfectly legal for private citizens to take footage via drone and turn it over to the police.

When a civilian uses a drone and then provides the video to law enforcement, there are no search and seizure or other Constitutional issues, because the Constitution does not protect against the actions of private persons – only government actors.

In the US, the Federal Aviation Administration (FAA) has been scampering to prepare for flocks of drones expected to be unwrapped next month over the holidays.

Last month, the FAA released a list of recommendations for how to better monitor recreational use of the machines.

For now, the FAA’s guidance advises drone operators to not fly anything that weighs more than 55 pounds; to fly drones only within line of sight and below 400 feet; to stay at least 5 miles away from an airport or manned aircraft; to avoid flying near people, stadiums or other crowded places; to take classes or join a club for extra safety; and to always inspect the craft before you fly.

How do prostitution vigilantes justify flying drones over sex workers and their customers, given the possible dangers of the potential juggernauts plunging from the sky due to possible operator error, collision with obstacles, or drone malfunction?

To his credit, Bates acknowledges the risks and difficulty of what he did. He isn’t advocating that others send their drones to spy on people, for several sound reasons.

He writes:

For one, all those obstacles you can safely avoid at 200 feet are now a potential lethal hazard to your drone when you drop to say 30 feet. And, because you’re now flying so low, you need to either be on public property or private property you have permission to be on.

The most concerning element though is the physical safety of anyone in the immediate area. So, if your suspects are out of their car you need to stay way back and not fly directly over them.

Follow @NakedSecurity

Follow @LisaVaas

Image of prostitute and john courtesy of Shutterstock.com

Article source: http://feedproxy.google.com/~r/nakedsecurity/~3/vXsieob7Pt4/

After five hours of negotiations on 7 December, members of the European Parliament and Council finally settled on the wording of the EU’s Network and Information Security (NIS) Directive.

The directive was first proposed in 2013 as a means of forwarding the European Union’s cybersecurity strategy. As it is a directive, rather than a regulation, member states will have to meet its demands by passing their own domestic laws.

The Network and Information Security Directive targets critical national infrastructure – or operators in energy, transport, health, and banking – and requires them to report cyber security breaches almost as soon as they are discovered or else risk regulatory fines and other sanctions from national authorities who will be given powers to enforce the rules.

Though the NIS directive’s final text has not yet been released, The Register understands it may make its way into the public domain by 18 December – and an EU press release has offered details regarding the “first ever EU rules on cybersecurity”.

While ostensibly focused on those using computer networks to manage critical national infrastructures across the EU, the directive will affect digital services such as the cloud, search engines and marketplaces. “Micro and small” services will be exempt from the directive, however.

Phil Lee, partner in the Privacy, Security and Information group at European law firm Fieldfisher, commented: “This is an entirely new obligation for businesses that are within the Directive’s ambit. We are highly likely to see companies having a serious look at their preparedness for preventing, managing and responding to a cybersecurity breach, and this will necessitate system-wide security reviews and the creation of cyber breach management policies, incident response teams and awareness-raising programs. This is of course the reaction the EU is looking for.”

The directive appears to cover cloud-based business but how this will work in practice remains more than a little unclear, according to the privacy law expert.

Luke Scanlon, technology lawyer at Pinsent Masons said: “Until now, most businesses have been under no obligation to report incidents of this type, so this legislation will likely expose in more concrete terms the sheer scale of the cyber security issue of which we are all aware.”

The new law will introduce mandatory data breach notifications for a range of critical infrastructure companies and is the first EU-wide cybersecurity ruling. Critical infrastructure providing firms will be obliged to ensure that the digital infrastructure used to deliver essential services, such as traffic control or electricity grid management, is robust enough to withstand attacks by hackers.

“However, outside of certain identified sectors, it’s also reported that the agreement reached will extend the scope of the Directive to cloud-based businesses, and it’s unclear quite what is meant by this. The reality is that the vast majority of businesses have a cloud-based element to their services these days,” Fieldfisher’s Lee explained.

The US already has state-level data breach reporting requirements in most states and a federal level cybersecurity strategy, so it could be argued that the EU is playing catch-up on data privacy and security regulation. “This is one step in ongoing changes to wider ongoing regulatory reform around digital platform regulation and data privacy rules,” he concluded.

“An EU-wide initiative has been a long time coming,” said Ross Brewer, vice president and managing director for international markets at security tools firm LogRhythm. “The Network and Information Security Directive will further enforce what is now so important; the ability to identify threats as quickly as possible.

“From Vtech to JD Wetherspoons, to the disaster that was TalkTalk, you can pick up any newspaper and see that organisations are still failing when it comes to cyber defences. Perhaps hitting them with eye-watering financial penalties and stricter regulations will help change that,” he added.

Member states will also be required to establish Computer Security Incident Response Teams (CSIRTs), who will be responsible for handling cybersecurity incidents and risks.

Nigel Hawthorn, Skyhigh Networks’ European spokesperson, said the ruling is goof news for consumers because it will boost confidence that firms will have to take measures to protect their information, boosting data privacy in the process.

“For too long businesses have tried to tip-toe their way out of notifying customers about data breaches, worried about the damage it can have on reputation and sales,” Hawthorn commented. “Banks especially have been guilty of trying to keep ‘mum’ whenever they can. While this directive is aimed at critical infrastructure companies, it will still provide customers with greater confidence and, more importantly, raises their expectations of privacy.”

Chris Wysopal, CTO and CISO at secure coding firm Veracode, added: “Any legislation needs to be prescriptive to create a baseline for what’s considered reasonable security, otherwise it will be difficult to drive change. One way to do this would be taking the Network and Information Security Directive one step further and crafting some form of liability to enforce reasonable efforts are being taken to secure systems.”

At national legislatures’ discretion, member states will additionally be required to adopt a national NIS strategy establishing cybersecurity objectives, policy, and regulatory measures. As with the Information Commissioner’s Office in the UK, which is the national authority for implementing and enforcing the EU data protection regulation, the cybersecurity regulation will likely be enforced by a commissioner in Blighty – though whether that will be an existing commissioner, or whether a new commissioner’s office will be established, is unclear. ®

Sponsored:
Data Loss Prevention Data Theft Prevention

Article source: http://go.theregister.com/feed/www.theregister.co.uk/2015/12/09/eu_network_information_security_directive_finalised/

Sophos has settled a patent infringement lawsuit with US competitor Fortinet, in a case that also involved allegations of staff poaching.

The recently listed UK company, a cloud and network security solutions outfit, paid an undisclosed sum to Fortinet to settle the dispute, as a brief statement (below) explains.

Sophos Group and Fortinet Inc have signed a settlement in respect of all outstanding litigation, including respective patent claims the parties had asserted against each other.

The settlement was reached through mediation and neither party admitted any liability.

The Financial Times adds (subscription needed) that the suit, which was filed in 2013, featured three patent infringement claims as well as allegations that “Sophos poached Fortinet’s employees and tried to convince others to jump ship”.

Fortinet and Sophos lock horns most closely in the Unified Threat Management (all-in-one security appliance) sub-market of the infosec business. ®

Sponsored:
Data Loss Prevention Data Theft Prevention

Article source: http://go.theregister.com/feed/www.theregister.co.uk/2015/12/09/sophos_fortinet_settle_legal_bunfight/

Before we pronounce the death of static analysis, let’s raise the bar with a modern framework that keeps pace with the complexity and size found in today’s software.

Static analysis isn’t dead like some have suggested.  Has static analysis lost some of it’s luster?  Absolutely! Many of the studies would suggest that static analysis tools (commercial and open-source) are underperforming on certain types of bugs or weakness classes. But one of the reasons why I like tool studies is because they help you understand what a tool can and cannot do — provided that you have developed the test cases to measure whether or not the tool actually detected the coding issue or violation. 

Tool studies also help you better understand the behavior and characteristics of static analysis tools for a given code construct or different styles of coding.  Static analysis tools perform differently on different program structures, and understanding why tools fail on certain types of code is important to know (with confidence) if we are going to raise the bar in static analysis capabilities and innovate. 

The results of many of these tool studies haven’t been favorable. In fact, one could argue that given the simplicity of the test cases used, static analysis tools should be performing much better. For instance, the Juliet Test Case suite that was funded by NSA Center for Assured Software is a collection of Java and C/C++ synthetic, meaning they are created as examples with well-characterized weaknesses. 

A criticism of Juliet is that the test cases don’t represent “real” world software. Given that the test cases are less complex than real-world programs, and are synthetic, you might expect that tools would perform much stronger, but that hasn’t been the case. I’m aware of at least four tool studies where the test results have been mediocre across the board — OWASP Benchmark, NIST Static Analysis Tool Exposition (SATE), NSA Center for Assured Software, and a project funded at IUPUI, led by Dr. James Hill. 

One revelation from the tool studies is that each tool does something really well; a “sweet spot.”  Most of the tools have several sweet spots, but outside of them, the tools tremendously underperform. It should be noted that overall, the commercial static analysis tools fair better than the open-source tools, but some studies suggest that open-source tools may be better at finding a particular weakness.    

Improving static analysis

Static analysis tools are not dead; they just need to be updated to keep pace with modern-day software. There needs to be more emphasis and investment in research and development by the software assurance community to find new breakthroughs and advancements in techniques to improve static analysis capabilities.  

Organizations who buy static analysis tools have to put more pressure on commercial tool vendors to invest more in RD so that tools can be modernized and improved. Adding rules and heuristics is not fixing the problem long-term, nor does it provide the innovation to keep pace with the evolution in software. We’ve seen with the Heartbleed vulnerability in OpenSSL, that vendors can add rules and heuristics to identify the weakness that exposed the Heartbleed vulnerability (after the fact).  The fact that none of the tools were able to detect the weakness that exposed the vulnerability can be summarized as the crux of the problem with static analysis tools and capabilities. 

I want to share with you a research project that I’m funding to push forward the state-of-the-art in static analysis capabilities. The Static Analysis Tool Modernization Project (STAMP) research is an attempt to address the lack of innovation around static analysis tools. The goal of STAMP is to modernize static analysis tools, creating better techniques that can scale the complexity and size of today’s software. The inspiration for STAMP came from the HGTV show, Property Brothers, where brothers find neglected homes and infuse money into the homes to renovate them. STAMP has the potential to renovate (re-innovate) static analysis capabilities. STAMP will focus on four key areas:

1. Develop improved code constructs and test cases that represent “real” world programs (modern software). This will address some of the shortcomings of Juliet, and to a certain extent some of the new test case suites such as the OWASP Benchmark project. The next generation of test cases developed in STAMP will help baseline existing state-of-the-art static analysis tools. 

2. Conduct an in-depth tool study to understand what tools can and cannot do it terms of tool coverage across the various weakness classes. By identifying the gaps and strengths in static analysis tools, this will help identify the areas where static analysis capabilities need to be “modernized”.

3. Develop a modernization framework to improve the capabilities in static analysis tools.  Engaging in RD to develop a framework to explore new techniques, methods, and services will help make static analysis tools more precise and sound and achieve what many call “security at-speed.” 

4. Score and label static analysis tools and capabilities based on areas where tools perform well, and areas where tools struggle in regards to tool coverage. A consumer report will be developed to better educate and guide the software assurance community in purchasing and procuring static analysis capabilities. Oftentimes when you purchase or procure a static analysis tool, you don’t really know what the tools missed. The scoring and labeling will help organizations mix and match features in static analysis to leverage the strength of each tool(s) to cover a wider attack surface.  

One of the interesting and unique aspects of working with researchers and computer scientists who study the area of static analysis, users of commercial static analysis tools, and the commercial tool vendors, is that I get so much useful information about problem areas. One common theme that I hear is that no one tool can give you the coverage you need. Organizations should be able to read a label on a given static analysis tool (the same way nutrient labels are on foods) to understand the strengths, the “sweet spots” of static analysis tools. 

Before we pronounce the end or death of static analysis, let’s see what innovation and improvements STAMP will provide to help raise the bar in static analysis tools and capabilities. Static analysis is just one context —  like DAST and IAST — that can be leveraged to help reduce false positives, but also provide more visibility into “real” bugs and potential vulnerabilities that exist in software. 

All application security testing approaches have their limitations; to think that one is superior than the other is a bit naive. I’ve funded research that’s shown how Hybrid Analysis Security Testing (HAST) can really improve software analysis capabilities, by infusing the context of SAST and DAST together for better applications security situational awareness. There is no uber approach or tool!  We are seeing in other technology areas where vendors are opening up their platforms with APIs because customers are wanting better situational awareness across their technology investments to improve overall threat management. I see the same happening with the resurrection of static analysis and a shift from relying on a “black box” technology solution. 

With more than 17 years of information assurance and security experience in security program management, assessment, auditing, and testing, Kevin Greene brings valuable skills and capabilities to the federal government. Kevin works in the area of research and development, … View Full Bio

Article source: http://www.darkreading.com/vulnerabilities---threats/re-innovating-static-analysis-4-steps/a/d-id/1323486?_mc=RSS_DR_EDT

Maybe it sounds obvious, but oversharing on social media is a BAD idea.

Remember when Jim Carrey tweeted a picture of a child without getting his parents’ permission? Bad idea, Jim.

Or the woman who posted a photo of a “creep” to Facebook that she thought was taking photos of her kids. He was actually taking a selfie with Darth Vader. Sadly, she’d already done the damage with her Facebook-shaming before the man could explain what he was really up to.

But it’s not just oversharing photos of people.

Remember the @NeedADebitCard Twitter account? It named, retweeted and shamed anyone who posted pictures of their credit or debit cards on Twitter. There were a lot of tweets.

Then there was the boy who accidentally set his Facebook party event to “public” and ended up with a very trashed family home.

So whether it’s photos of other people, your credit card details, the fact that you’re HOLDING A REALLY AMAZING PARTY ON FRIDAY NIGHT or anything else, stop and think before you share.

Once it’s out there on the internet it’s hard to take it back.

Follow @AnnaBrading

Follow @NakedSecurity

Images of Christmas tree and Advent calendar courtesy of Shutterstock.

Article source: http://feedproxy.google.com/~r/nakedsecurity/~3/Hyklc0q930M/

Patch Tuesday Microsoft is closing out the year with a fix for 71 security vulnerabilities in Windows Server, client-side Windows, Office, Internet Explorer, and Edge.

Among the patches are two vulnerabilities that are already being exploited in the wild for elevation of privilege and remote code execution.

The December Patch Tuesday load contains the following updates:

• MS15-135 Addressing four flaws in the Windows kernel-mode drivers, one of which (CVE-2015-6175) is being targeted in the wild for an elevation of privilege exploit.
• MS15-131 A fix for multiple flaws in Office, including the CVE-2015-6124 flaw currently being targeted in the wild for remote code execution. The update patches Microsoft Office 2007 and later, including Office 2011 for Mac.
• MS15-128 A fix for three CVE-listed memory corruption flaws (CVE-2015-6106, CVE-2015-6107, CVE-2015-6108) in Windows that could be exploited by visiting a specially crafted webpage or document containing a corrupted font. All systems from Windows Vista through Windows 10 and Server 2008 through Server 2012 are vulnerable.
• MS15-124 A cumulative Internet Explorer update addressing 30 security flaws including remote code execution, information disclosure, and elevation of privilege flaws in Internet Explorer versions 7 through 11 on Windows Vista through Windows 10.
• MS15-125 A cumulative update for Microsoft Edge browsers on Windows 10 addressing a total of 16 CVE-listed flaws allowing for remote code execution, elevation of privilege, information disclosure, and security bypass.
• MS15-126 Addresses an information disclosure flaw and a remote code execution vulnerability in Microsoft JScript and VBscript for Internet Explorer versions 7 through 11.
• MS15-127 Addresses a use-after-free vulnerability in Windows DNS (CVE-2015-6125) that would allow remote code execution attacks on Windows Server 2008, Windows Server 2012, and Server Core installations.
• MS15-129 An update for Silverlight to patch one CVE-listed flaw (CVE-2015-6166) allowing remote code execution and two (CVE-2015-6114, CVE-2015-6165) allowing for information disclosure in Silverlight for both Windows and OS X. No exploits reported.
• MS15-130 Addresses one flaw (CVE-2015-6130) allowing remote code execution via a webpage with a corrupted font on Windows 7, Server 2008 R2, and Server Core.
• MS15-132 Addressing three remote code execution vulnerabilities (CVE-2015-6128, CVE-2015-6132, CVE-2015-6133) that could be exploited by opening a malicious application in Windows. All versions from Vista through Windows 10 and Server through Server 2012 are vulnerable.
• MS15-133 An elevation of privilege vulnerability (CVE-2015-6126) found in the Windows PGM protocol that could be exploited by running an application. All Windows builds Vista and later and Server 2008 and later are vulnerable.
• MS15-134 One remote code execution (CVE-2015-6131) and one elevation of privilege flaw (CVE-2015-6127) in Windows Media Center for Windows Vista, Windows 7, and Windows 8/8.1.

The Microsoft update comes on the heels of a massive Flash update from Adobe. Together, the patches cover more than 150 CVE-listed security flaws. As such, users and administrators are being advised to update their systems as soon as possible. ®

Sponsored:
IT evolution to a hybrid enterprise

Article source: http://go.theregister.com/feed/www.theregister.co.uk/2015/12/08/patch_tuesday_december2015/

Redmond is scrambling to propagate a new certificate for the *.xboxlive.com domain, having “inadvertently disclosed” the certificate’s contents.

In its advisory, Microsoft says the accidental disclosure of the cert’s private keys could expose customers to man-in-the-middle attacks, although the cert “cannot be used to issue other certificates, impersonate other domains, or sign code”.

Redmond doesn’t say how many people may have seen the certificate.

All supported releases of Microsoft Windows carry the Xboxlive certificate, but revocation – which the company has in hand, it says – should propagate to everybody automatically.

If you’re using anything from Windows 8 onwards, the process will be automatic. Users of Vista, Windows 7, Windows Server 2008 or Windows Server 2008 R2 will be covered if they use the automatic certificate updater, which Microsoft points to here.

If you’re not covered by the automatic update, Microsoft says you should add this to your untrusted certificates, using the Certificates MMC snap-in:

IMAGE

It’s unlikely that the leak has been used in any active attacks.

The certificate slip is in addition to Microsoft’s mammoth 71-bug salute to Patch Tuesday. ®

Sponsored:
Evolution of the Hybrid Enterprise

Article source: http://go.theregister.com/feed/www.theregister.co.uk/2015/12/09/microsoft_leaks_xboxlive_ssl_server_cert/