hacking – Page 253 – STE WILLIAMS

More Than Half of Social Media Login Attempts Are Fraud

library
crime | hacking | security

Overall, account registrations for tech companies are four times more likely to be malicious than legitimate, a new report states.

Login attempts make up three of every four digital transactions a business has with its customers. Unfortunately for today’s increasingly digital organizations, not all user logins are authentic – in fact, across many industries, it’s more likely a login attempt is fake.

For its Q3 Fraud and Abuse Report, released today, Arkose Labs analyzed 1.2 billion user transactions conducted between April 1 and Jun. 30, 2019 to gain a sense of the fraud and risk landscape. These sessions span account registrations, logins, and payments from companies in the financial services, ecommerce, travel, social media, gaming, and entertainment industries.

The company discovered a mix of automated and human-driven fraud targeting business transactions across industries. Eleven percent of sessions are attacks, Arkose Labs reports, but the type of fraud and how it’s conducted vary based on time of day, industry, and geography.

Consider the tech space, where according to the report, fake login attempts make up 78.7% of fraud instances and account registrations make up the rest (21.2%). Most tech companies offer a “freemium” model with quick onboarding for users, which appeal to attackers looking to test stolen credentials or create fake accounts. Nearly 43% of all attacks on tech companies are human-driven.

Social media is another hotspot for fraud. Fake login attempts make up 89.5% of social media fraud instances, and fake account registrations make up 10.5%, explaining why automated attacks are so common. The popularity of account takeover stems from attackers’ motivation to steal personal data, the report states, and 53.3% of all social media login attempts are fraud.

Payments are more likely to be targeted in retail and travel. Automated bots aim to block inventory, a tactic that may lead to denial of inventory attacks or higher prices on tickets. Fraudsters are also after data: by taking over actual user accounts they can access individuals’ targeted recommendations, discounts, and personal information.

On a geographical level, the top originators for fraud attacks are the United States, Russia, Philippines, UK, and Indonesia. The Philippines is the single largest attack originator for both automated and human-driven fraud. China mostly relies on human-driven fraud attacks.

Man vs. Machine: Use of Human-Driven Fraud

Attack patterns evolve as businesses deploy new mitigations. When companies find a new tool to detect large-scale automated attacks, unsuccessful fraudsters shift to new, trained bot attacks. As mitigations are released for those, they are turning to human-driven attacks. A growing number of “click farms” or sweatshops employ low-paid people to attempt fraudulent transactions, write fake reviews, or create new accounts using stolen or fake credentials.

Automated attacks comprise the bulk of fraud traffic: it’s easiest to automate login attempts, which are fairly straightforward and make up 78.9% of fraud instances. In comparison, account registrations make up 14.8% of fraud attempts, and payments make up 6.3%.

“Those attacks can be carried out by these automated systems,” Arkose Labs’ vice president of strategy Vanita Pandey says of account takeover. “But then there are areas where human intervention is required.” Writing reviews, opening bank accounts, or signing up for a dating app are examples.

Human-driven attacks, while more expensive, may also lead to greater gain. Unlike bot traffic, human behavior is unpredictable and highly nuanced; for this reason, payment fraud and fake account creation are more likely to be done by people. Arkose Labs found nearly one-third of account registration attacks are from malicious humans; both individuals and organized fraud.

Most human-driven attacks are seen in retail, finance, and technology, where person-to-person interaction is typically required; for example, 53% of account registration attacks against tech companies are done by people. This type of activity also varies by time of day: while the digital economy means fraudsters can strike at any time, most human-driven attacks aim to align with the targeted time zone’s business hours so as to appear legitimate. This is why human-driven attacks are more popular in the retail industry than any other, researchers report.

Fraudsters target both mobile and desktop traffic, which make up 30.9% and 69.1% of fraudulent traffic, respectively. This also varies by industry. Mobile is hot in social media and retail; in the gaming space, much of fraud traffic comes from consoles. Finance and tech traffic primarily comes from desktop machines, likely due to their larger screen size.

Related Content:

Check out The Edge, Dark Reading’s new section for features, threat data, and in-depth perspectives. Today’s top story: “‘Culture Eats Policy for Breakfast’: Rethinking Security Awareness Training.”

Kelly Sheridan is the Staff Editor at Dark Reading, where she focuses on cybersecurity news and analysis. She is a business technology journalist who previously reported for InformationWeek, where she covered Microsoft, and Insurance Technology, where she covered financial … View Full Bio

Article source: https://www.darkreading.com/cloud/more-than-half-of-social-media-login-attempts-are-fraud/d/d-id/1335647?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple

Apple Releases Emergency Patch for iPhone Jailbreak Flaw

library
crime | hacking | security

iOS version 12.4.1 fixes the “use after free” vulnerability.

Apple today released a security patch for a critical jailbreak vulnerability in iOS 12.4 exposed a week ago by a security researcher who released an exploit for it.

The new iOS 12.4.1 release fixes a flaw introduced in version 12.4 of the software: Version 12.4 inadvertently left the OS open to the bug that Apple previously had corrected.

Some security researchers had warned that attackers could abuse the flaw and attack iPhone users remotely or using malicious apps, while others called dismissed concerns over actual attacks.

Apple’s update today confirms the use-after-free (CVE-2019-8605) vulnerability, discovered by Ned Williamson, working with Google Project Zero.

Humor

library
crime | hacking | security

Article source: https://www.darkreading.com/humor/d/d-id/1334297?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple

Cryptography & the Hype Over Quantum Computing

library
crime | hacking | security

It’s not time to move to post-quantum cryptography yet — too many things are still up in the air. But you can start to become prepared by making sure your infrastructure is agile.

If you believe the quantum computing hype, within a few years we will have achieved “quantum supremacy” — meaning that quantum computers will be able to carry out computations not possible with classic computing infrastructure — and within 10 years all cryptography will be broken as a result. This hype is fed by researchers vying for grant money, companies selling post-quantum secure encryption, and the fact that no one can say that they are actually wrong.

Personally, I’m a semi-skeptic. On the one hand, I’m not convinced that quantum computers at scale (at least at a scale large enough to break cryptography) will ever be built. On the other hand, they are possible, but I don’t think they will happen anytime soon.

What about those who tell us that quantum supremacy is around the corner and all cryptography is about to be broken? I think they’re fearmongers. First, quantum supremacy doesn’t mean that computers will be strong enough to break cryptography. Second, reliable researchers that I have listened to and spoken with say that there are still very significant problems to be solved in quantum computing. But if they continue to use the word “possible” when describing quantum computing, I can’t actually say that they’re wrong.

So, what should we be doing now about the potential “quantum threat”? First, the cryptography research community should be focused on post-quantum secure cryptography. The good news is that this effort has been going on for years and is ongoing. The role of this research community is to make sure that we have the cryptography we need in the decades to come, and they are taking the issue seriously. (As a side note, symmetric encryption and message authentication codes are not broken by quantum computers, to the best of our knowledge.) Second, the cryptography research community should start thinking about standardization so that businesses are ready if the quantum threat does prove real. Once again, the good news is that NIST has already begun the process.

But all of this is about what the “community” should do. What should you — as someone who uses cryptography to secure your business — do? Let’s start with what you shouldn’t be doing. You shouldn’t buy post-quantum encryption and the like before standardization is complete. What if you need to encrypt something that has to remain secret for 20 years? In my opinion, you should still hold off. However, if you are very concerned, you can encrypt using a method that combines post-quantum and classical schemes. Such a method requires an attacker to break both schemes in order to learn anything.

This is the proposed method since although we have confidence in post-quantum secure schemes that have been proposed, they are less well-studied than RSA and ECC. Among other things, this affects our understanding of the required key sizes. If you do insist on moving forward now, I recommend using an academically validated post-quantum scheme combined with a classical scheme, as explained above.

While I don’t think most organizations should deploy post-quantum secure cryptography now, there is one thing that everyone should do: transition your cryptographic infrastructure to one that is “agile” — that is, one that makes it possible to relatively easily switch algorithms, key lengths, and so on. When the algorithm and lengths are hard-wired into the code, the cost and complexity of changing can be overwhelming. This is why people continued using MD5 and SHA1 years after they were broken.

Cryptographic agility is an important property even aside from the issue of quantum computing because algorithms are sometimes broken, and key and other lengths sometimes need to be updated. You will therefore be doing yourself a favor even if quantum computing never happens. But if it does, you’ll be ready, and you’ll be able to replace your existing schemes with the best known at that time. This is my recommendation to everyone.

Related Content:

Check out The Edge, Dark Reading’s new section for features, threat data, and in-depth perspectives. Today’s top story: Haas Formula 1 CIO Builds Security at 230 Miles per Hour

Yehuda Lindell is the CEO and Co-Founder of Unbound Tech (previously, Dyadic Security) as well as professor in the Department of Computer Science at Bar-Ilan University. Prior to Bar-Ilan in 2004, he was a Raviv Postdoctoral fellow in the Cryptographic Research Group at the … View Full Bio

Article source: https://www.darkreading.com/risk/cryptography-and-the-hype-over-quantum-computing/a/d-id/1335551?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple

IRS Alerts Taxpayers to New Email Scam

library
crime | hacking | security

A spoofed IRS.gov link leads victims to a fraudulent Web page where they are prompted to download malware.

The Internal Revenue Service (IRS) is warning taxpayers and tax professionals of a new impersonation scam in which fraudsters send unsolicited emails containing malicious links.

Emails contain links to a website resembling IRS.gov with details seemingly related to the recipient’s tax refund, electronic return, or account. A “one-time password” is provided so the victims can access their refund information. Recipients who enter the password unintentionally download malware that could let attackers take control of their systems or install software that could track keystrokes. As a result, they could give away the passwords to sensitive accounts.

Subject lines for these emails vary. The IRS says recent examples use phrases like “Automatic Income Tax Reminder” or “Electronic Tax Return Reminder.” It may not be tax season, but this campaign serves as a reminder that tax scams are a yearlong initiative for cybercriminals.

This scam is tricky to shut down because it leverages several compromised websites and Web addresses to pose as IRS.gov. The IRS emphasizes it does not send unsolicited emails and never contacts taxpayers via email, text message, or social media to request personal data. It won’t ask for a PIN number, password, or similar access information for credit cards or bank accounts.

Further, the IRS will not call to demand immediate payment using a specific method (gift card or wire transfer, for example). If someone owes taxes, they usually receive a bill in the mail.

Biz forked out $115k to tout ‘Time AI’ crypto at Black Hat. Now it sues organizers because hackers heckled it

library
crime | hacking | security

Crown Sterling, a Newport Beach, California-based biz that calls itself “a leading digital cryptographic firm,” is suing UBM, the UK-based owner of the Black Hat USA conference, in America for allegedly violating its sponsorship agreement.

The complaint [PDF], filed late last week in a New York district court, blames the conference organizers for allowing Black Hat attendees to disrupt Crown Sterling’s talk about supposedly disruptive cryptographic technology – a presentation Crown Sterling paid $115,000 to present to hackers. The heckling then spilled online.

“This small group of detractors used this staged ‘event’ to initiate a smear campaign on social media during the conference and immediately after,” the complaint stated. “In that campaign, these detractors defamed Crown Sterling, questioning both its integrity and its cryptography solutions, which they described in one publication as ‘Snake Oil Crypto.'”

In a phone interview with The Register, Dan Guido, CEO of infosec biz Trail of Bits, who attended the Black Hat presentation, barracked the presentation, and was removed from the room by conference security, argued Crown Sterling was trying to “mix mysticism and magic into science” and that “none of it made any sense.”

“The kinds of things they were discussing can’t be found in the realm of reality,” he said.

Social network posts alleging as much can still be found on Twitter.

The lawsuit names up to 10 “Doe” defendants, placeholders presumably for individuals who could face defamation lawsuits for disparaging Crown Sterling’s technology.

The Register asked the Cali outfit’s spokesperson whether the company intends to pursue social media critics or fault-finding conference attendees, however our query went unanswered. We doubt, however, the crypto biz will carry through on its implied threat against individual critics in California due to the US state’s anti-SLAPP statute. We’ve seen businesses aggrieved by criticism punished for trying to silence unfavorable opinions.

Asked to comment on why the company’s presentation was so poorly received, Crown Sterling’s spokesperson replied with an excerpt from the organization’s press release about its lawsuit:

“As with any disruptive technology, we anticipated a degree of pushback from industry participants and competitors also attending the conference,” said Joseph Hopkins, chief operating officer of Crown Sterling.

“We were assured by Black Hat and its public Code of Conduct that our presence would be treated openly and fairly. That did not happen. The fact is, we relied upon these representations by Black Hat and we attended the conference in good faith, strictly adhering to the Black Hat stipulations for both exhibition and sponsored sessions.”

One obstacle to Crown Sterling’s claim will be UBM’s Terms and Conditions agreement, which includes a liability limitation and indemnity clause that protects the event organizer.

Open Source Security hit with bill for defamation claim

The crypto biz’s video announcing its technology, dubbed TIME AI, is four minutes and thirty-nine seconds you’ll never get back. Just know that it involves “multidimensional encryption technology including time, music’s infinite variability, artificial intelligence, and most notably mathematical constants to generate entangled key pairs.” Yes, music.

TIME.AI is, we’re told, based on a paper, “Accurate and Infinite Prime Prediction from Novel Quasi-Prime Analytical Methodology,” by Crown Sterling founder and CEO Robert Grant and physicist and number theorist Talal Ghannam. The paper is distributed through preprint server ArXiv, which accepts submissions, without peer review, from anyone who chooses to register.

Social networks similarly have few limitations on what people can say. And there you can find a math-literate security researcher who suggests the paper’s math doesn’t add up.

UBM, through a spokesperson, said it was aware of the lawsuit, and declined to comment. ®

Article source: http://go.theregister.com/feed/www.theregister.co.uk/2019/08/26/black_hat_sued/

Hacktivist skids nip at Mounties’ ankles, Emotet ransomware rides again, and more

library
crime | hacking | security

Roundup Summer is winding down, although there are plenty of computer security news bits and bytes to go around.

Eco-warriors pick a cyber-fight with Canadian Mounties

The Royal Canadian Mounted Police (RCMP) was targeted last week by hacktivists angry over Canada’s issuing of permits to hunt polar bears.

The so-called National Frog Agency, a script-kiddie group that told The Register it focuses on animal rights, publicly shared about 120 RCMP staff email addresses and associated passwords, hashed and unhashed, on two websites. The group claimed it had 950 or so sets of credentials for some of the police force’s employees, and has revealed only a small fraction so far. The gang alleged one in nine of the logins is or was known to work, though there is no reason to believe this boast.

Jason Coulls – a Reg reader, Brit abroad in the Great White North, and serial CTO known in Toronto for spotting bank cybersecurity blunders – raised the alarm to Vulture West after being given the runaround by the Mounties: he had tried to report the leaks more than a week ago, and was ignored.

“Taking four days to open a ticket and nine days to act on a potential national threat, means either nobody knows how to open a ticket, or nobody knows how to deal with a potential national threat,” Coulls said of his experience. “In an environment where Canada has tensions with China over Huawei, border disputes of the North West passage with the USA, arctic tensions with Russia, and so on, you’d think they’d move a little faster when faced with a potential breach.”

Fortunately, this credential disclosure appears to be less serious than first feared. The RCMP told us the passwords were not directly lifted from its servers.

After some digging around, it appears the credentials were collected from account databases that were previously stolen from other websites and shared among hackers. In other words, the hacktivists in this case got their hands on a bunch of credentials leaked from other servers by other miscreants, and searched them for RCMP email addresses. They then leaked the passwords, either the hashes or cracked hashes, and email addresses in hope someone else would try to log into services where the credentials had been reused by police staff.

The RCMP told us it has already taken measures to “mitigate” any danger; presumably any of the staff listed in the public posts have changed their passwords on any systems where they reused the exposed credentials. Also, one of the public posts containing the leaked details was removed within 24 hours of El Reg contacting the Mounties. The other post remains online to this day.

The slow response of the RCMP is worrying, Coulls told us. “The RCMP were lucky this was just a badly handled false alarm,” Coulls tells us. “If it was a badly handled real event, well, that would be… bad.”

In any case, do not use the same password and username or email address combination across more than one website. If one gets hacked, and the credentials leaked, miscreants can use this information to break into your other accounts.

This week’s reminder to patch your AV software comes courtesy of BitDefender

Here’s another reminder that even security software needs patches. For proof, we have this month’s update from BitDefender to address a vulnerability in its Antivirus Free 2020 offering. Bug hunters with SafeBreach sussed out and reported CVE-2019-15295, an elevation of privilege flaw due to the ability to load arbitrary DLLs in the AV suite’s update tool.

Fortunately this is not a particularly serious vulnerability (you need to already be running malware on the target machine) but it’s a good reminder that it is not just your operating system that needs to be regularly updated.

Don’t forget… to update your Nest Cam IQ Indoor firmware. Cisco’s Talos team have found and documented various bugs in the network-connected, wireless CCTV devices that, while not terribly serious, have the potential to be exploited, so make sure you’re running the latest version.

Similarly, please, please make sure you have patched your Pulse Connect Secure and Pulse Policy Secure VPN gear where possible: fixes were emitted in April to close up critical remotely exploitable holes, and now proof-of-concept exploit code for CVE-2019-11510 to seize control of systems is live.

And the same goes for the FortiOS SSL VPN web portal, patched in May, and now proof-of-concept exploit code is available.

Both VPN bugs are under active attack right now, so if you haven’t patched, your kit is about to belong to someone else.

80 charged in massive cyber-fraud takedown

Hundreds of charges have been filed in the US against 80 people accused of being part of a massive online scam operation.

It’s said that 252 charges have already been slapped on suspected fraudsters operating in America and Nigeria. While these appear to be your run-of-the-mill social engineering scams, in which victims were duped into wiring money orders and account information to con men, the scale is eye-popping. Prosecutors say that the group either moved or attempted to move some $40m.

Texas mass-hacker’s $2.5m ransomware demand

The wide-reaching malware invasion that has hit nearly two dozen government offices in the US state of Texas now has a price tag.

The mayor of Keene, one of the cities infected, said the software nasty’s masterminds are demanding a $2.5m ransom payout to provide decryption keys for the scrambled data. It is highly unlikely the extortionists will see that dosh, however, as officials would rather opt to simply restore from backup or wipe their systems.

Emotet rides again

The notorious Emotet Windows ransomware appears to be gearing up to cause some significant mayhem. Infosec bods have logged dozens of new command-and-control servers firing up, leading them to believe that a sharp spike in infection rates is on the horizon.

“Emotet continues to be among the most costly and destructive malware affecting state, local, tribal, and territorial governments. Its worm-like features result in rapidly spreading network-wide infection, which are difficult to combat,” US-Cert says of the infection. “Emotet infections have cost governments up to $1 million per incident to remediate.”

Card sharks royally flushed by PokerTracker MageCart infection

Unlucky poker players may want to keep a close eye on their bank statements following the disclosure that the popular app PokerTracker was seeded with MageCart, steals payment card details typed into pages the malicious JavaScript code lurks on.

A website used by the PokerTracker app’s site was infected, meaning that anyone visiting the PokerTracker website would pull in code from the infected site, which would run MageCart in the visitor’s browser, and siphon off any bank card details typed into the page to fraudsters.

MoviePass popped for customer data

MoviePass leaked tens of thousands of customer account details, including payment cards numbers and mistyped passwords, via a poorly secured public-facing database that appears to have been used for logging account activity. The system has since been secured.

Moscow voting system compromised

A French egghead has claimed a $15,000 prize after exposing security holes in Moscow’s blockchain-based voting system.

Pierrick Gaudry claimed the prize after showing how the private keys for the Moscow Duma election system could be decrypted. The voting system, presumably with more security protections in place, will be going live next month. Then again, this is Russia we’re talking about. Everyone knows who’s going to win. ®

Article source: http://go.theregister.com/feed/www.theregister.co.uk/2019/08/26/security_roundup/

Ransomware Trains Its Sights on Cloud Providers

library
crime | hacking | security

Ransomware writers are now targeting cloud service providers with network file encryption attacks as a way to hold hostage the maximum number of customers that they can, notes Chris Morales, head of security analytics for Vectra. He also discusses Vectra’s new ransomware report, which offers tips for protecting against virtual hostage taking.

Article source: https://www.darkreading.com/ransomware-trains-its-sights-on-cloud-providers/v/d-id/1335638?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple

Here’s a top tip: Don’t trust the new person – block web domains less than a month old. They are bound to be dodgy

library
crime | hacking | security

IT admins could go a long way towards protecting their users from malware and other dodgy stuff on the internet if they ban access to any web domain less than a month old.

This advice comes from Unit 42, the security branch of networking house Palo Alto Networks. To be exact, the recommendation is that any domain created in the past 32 days ought to be blocked. This comes after the gang studied newly-registered domains – NRDs for short – and found that more than 70 per cent fell under the classification of “suspicious,” “not safe for work,” or “malicious.”

“While this may be deemed a bit aggressive by some due to potential false-positives, the risk from threats via NRDs is much greater,” noted Unit 42’s Zhanhao Chen, Jun Javier Wang, and Kelvin Kwan. “At the bare minimum, if access to NRDs are allowed, then alerts should be set up for additional visibility.”

According to Unit 42’s study of new domains created on 1,530 different top level domains (TLDs) from March to May of this year, just 8.4 per cent of NRDs could be confirmed as hosting only benign pages. 2.32 per cent were confirmed not safe for work, while 1.27 per cent of the domains were classified as malicious, meaning they were found to host malware, phishing, or botnet, command and control tools.

‘Suspicious’

The solid majority of the domains, 69.73 per cent to be exact, fell under the label of “suspicious,” meaning the domains appear to have been parked, had insufficient content to be verified as legit, or were considered “questionable,” or “high risk,” but not flat-out malicious. 18.2 per cent were classified as just “other,” rather unhelpfully.

In other words, just under three quarters of new domains are used for sites that vary from completely empty, to shady at best, to verified as attack sites.

Sea Turtle hackers head to the Mediterranean, snag Greece’s TLD registrar as a souvenir

The numbers can also vary by TLD, with “.com” or “.org” sites far more likely to be hosting legit content than lesser-known TLDs where it is easier to acquire a domain.

Given these numbers, the Unit 42 crew concluded that when it comes to blocking new domains, the potential benefits far outweigh the risks. As a rule, they believe newly created domains ought to be walled off from end users for 32 days.

“Our own analysis has indicated that the first 32 days is the optimal time frame when NRDs are detected as malicious,” the team explained, noting that after 32 days most scams and attack sites have run their course and moved on, meaning the domains in use become far more likely to be legit.

Those who want to go even further, and aren’t as bothered by the prospect of blocking legit sites, could even apply the rules to entire top level domains, such as “.to”, “.ki” and “.nf” that are, by and large, much more likely to host malicious sites. ®

Article source: http://go.theregister.com/feed/www.theregister.co.uk/2019/08/21/palo_alto_domain_blocking/

Security gone in 600 seconds: Make-me-admin hole found in Lenovo Windows laptop crapware. Delete it now

library
crime | hacking | security

Not only has a vulnerability been found in Lenovo Solution Centre (LSC), but the laptop maker fiddled with end-of-life dates to make it seem less important – and is now telling the world it EOL’d the vulnerable monitoring software before its final version was released.

The LSC privilege-escalation vuln (CVE-2019-6177) was found by Pen Test Partners (PTP), which said it has existed in the code since it first began shipping in 2011. It was bundled with the vast majority of the Chinese manufacturer’s laptops and other devices, and requires Windows to run. If you removed the app, or blew it away with a Linux install, say, you’re safe right now.

“The bug itself is a DACL (discretionary access control list) overwrite, which means that a high-privileged Lenovo process indiscriminately overwrites the privileges of a file that a low-privileged user is able to control,” PTP explained. “In this scenario, a low-privileged user can write a ‘hardlink’ file to the controllable location – a pseudofile which really points to any other file on the system that the low-privileged user doesn’t have control of.”

LSC runs a high-privileged scheduled task ten minutes (600 seconds) after a user logs onto the machine. The binary executed by the scheduled task overwrites the DACL of the Lenovo product’s logs folder, PTP said, giving everyone in the Authenticated Users usergroup full read/write access to them. As all accounts are members of Authenticated Users, this means anyone can mess around with the logs.

Remember when Lenovo sold PCs with Superfish adware? It just got a mild scolding from FTC

By dropping a hardlink file into the logs folder pointing elsewhere on the target system, the LSC scheduled task can be used to escalate privileges for any file or executable. From there it’s a short stretch to running arbitrary code with administrator-level privileges, and pwning the whole system in ten minutes. To be clear, to exploit this, you must already have access to the machine, either as a rogue logged-in user or with malware on the thing.

The solution? Uninstall Lenovo Solution Centre, and if you’re really keen you can install Lenovo Vantage and/or Lenovo Diagnostics to retain the same branded functionality, albeit without the priv-esc part.

All straightforward. However, it went a bit awry when PTP reported the vuln to Lenovo. “We noticed they had changed the end-of-life date to make it look like it went end of life even before the last version was released,” they told us.

Screenshots of the end-of-life dates – initially 30 November 2018, and then suddenly April 2018 after the bug was disclosed – can be seen on the PTP blog. The last official release of the software is dated October 2018, so Lenovo appears to have moved the EOL date back to April of that year for some reason.

“Sweeping a bug under the carpet?” mused PTP’s Ken Munro to El Reg.

We have asked Lenovo why they changed the EOL date on the Lenovo Solution Centre page to make it look like they were releasing updates for a product they had already EOL’d.

“It’s often the case for applications that reach end of support that we continue to update the applications as we transition to new offerings is to ensure customers that have not transitioned, or choose not to, still have a minimal level of support, a practice that is not uncommon in the industry,” was the response. ®

Article source: http://go.theregister.com/feed/www.theregister.co.uk/2019/08/23/lenovo_solution_centre_cve_2019_6177/