Blog

Cybersecurity Digest #2: 13/04/2020 – 24/04/2020

27 April 2020

Intel addressed nine security vulnerabilities with the April 2020 Platform Update, all of them being high and medium severity security flaws impacting multiple software products, firmware, and platforms.
Сybersecurity experts at ReversingLabs revealed over 700 malicious gems — packages written in Ruby programming language — that supply chain attackers were caught recently distributing through the RubyGems repository. The malicious campaign leveraged the typosquatting technique where attackers uploaded intentionally misspelled legitimate packages in hopes that unwitting developers will mistype the name and unintentionally install the malicious library instead.
A proof-of-concept remote code execution (RCE) exploit for the Windows 10 CVE-2020-0796 ‘wormable’ pre-auth remote code execution vulnerability was developed and demoed today by researchers at Ricerca Security. The security vulnerability, also known as SMBGhost, was found in the Microsoft Server Message Block 3.1.1 (SMBv3) network communication protocol and it only impacts systems running Windows 10, version 1903 and 1909, as well as Server Core installations of Windows Server, versions 1903 and 1909.
The OpenSSL Project released a security update for OpenSSL that patches a high-severity vulnerability, tracked as CVE-2020-1967, that can be exploited by attackers to launch denial-of-service (DoS) attacks.

13 April 2020

FBI Warns of Teleconferencing and Online Classroom Hijacking During COVID-19 Pandemic and gives some recommendations. The FBI has received multiple reports of conferences being disrupted by pornographic and/or hate images and threatening language. Due to these problems, different companies and organizations decided not to use Zoom. For example, Elon Musk’s SpaceX recently banned its employees from using Zoom, citing “significant privacy and security concerns,” while Taiwan’s cabinet has told government agencies to stop using the app.
Microsoft announced that its plan to disable the security protocols TLS 1.0 and TLS 1.1 in the company’s browsers has been postponed in light of current global events. Initially the company wanted to disable the security protocols in the first half of 2020 . Newer versions of the TLS protocol enable more modern cryptography and are broadly supported across modern browsers.
Security researcher Bill Demirkapi publicly disclosed several critical vulnerabilities on most HP machines running Windows. As he said that there were still unpatched vulnerabilities after some his reports. So, a patch was released on April 1 that the HP Product Security Response Team (PSRT) said fixes “potential escalation of privilege and arbitrary file deletion”