NIST Site Search
Search NIST.GOV
Custom Search
[Official NIST.GOV TIME]
Product Research

Advertise on this site
Microsoft’s Zero Day Event
print the content item {PDF=create pdf file of the content item^plugin:content.9}
in Regulatory Compliance > Security

Microsoft’s Zero Day Event

A Zero Day event in computer speak means in short “you have no time to react”. Security types simply refer to it as “0day”. On November 21st the Information Technology (IT) security world learned of yet another 0day event. As with most such events it involves Microsoft, and like many such recent vulnerabilities the problem is with Internet Explorer (IE 5.5 and 6 are vulnerable, even if service packed and patched). But what makes this 0day different from the most of them is that this one is so easy that a child can exploit it. Literally our children can, and surely will, take advantage of this problem and wreak total havoc on our computer systems.

The original problem was discovered back in June by Benjamin Tobias Franz (a German security expert). Mr. Franz did the right thing and reported the bug to security experts around the world, and thus to the attention of Microsoft. Yet in the following 5 ½ months no patches or warnings were issued by Microsoft. On November 21st a British security group released “Proof of Concept” code for the world to see. What this means is that our children now have sample code (pretty much step by step instructions) that they can use to “own” your computer (in other words, they can do what they want to it. Including completely destroying it should they wish too).

The sample code is non-destructive. In its released form it simply pops up your Windows calculator. No big deal. But by simply replacing the code where it says “calc.exe” with something more destructive they can cause your computer a world of pain. The possibilities are endless. They can turn your computer in to “spam bot” where its used to transmit millions of pieces of spam (before your service provider shuts you down). They could format your hard drive, thus wiping out all your data. They could use it to stage further attacks on government owned computer systems. Or they can load it up with kiddie porn and tell your modem to dial 911 over and over until the police show up. These are not new ideas, all of them have been done before.

With the current 0day vulnerability all they need is a delivery mechanism. This is not a worm or a virus, the exploit has no way to travel to you like a network worm would. It needs a way to get you to come to it. But this does not mean you can relax, far from it. All they need to use is their imaginations, and an email program. For this vulnerability to work all they need is for you to click a link. So they use what security experts call “social engineering”, in other words they trick you. “Phishing” scams do it all the time. Those are those emails that look like they come from your bank, Paypal, eBay, etc. but are actually coming from bad guys looking for your account information. But a lot of people have gotten wise to those scams. Not because they’ve become technically proficient, but because they know the bad guys are looking for money. Therefore J.Q. Public has learned not to trust any email from someplace that controls their money. But what if you received an email from save-the-children@feedkids.com and it contained pictures of hungry kids. The message says that Big Greedy Corporation has promised to send them one dollar for every person that clicks on the picture of the hungry child featured so prominently in the email. Would you click the picture? Many people would. Probably most people would. Well if you do and the link was to one of these rouge websites than your computer is now “owned” by some14 year old kid. Or worse by a group of hackers that install a “keylogger” on your computer to capture your banking information. All you did was click on a picture. You didn’t have to click “OK” after that, you didn’t have to click “Yes” to install anything. The hackers took care of all of that for you.

So what can you do? To start with until Microsoft releases fix for this problem don’t trust any email unless you were expecting it (don’t click the links). You can also turn off “Active Scripting” in your Internet Explorer browser (Tools, Internet Options, Security, Custom Level, set “Active Scripting” to Disable). However, this may cause some websites to not load properly. Or you can switch to another browser, such as Firefox (www.mozilla.org/firefox), which would not be vulnerable to this exploit (in fact Firefox is safer than IE in many ways). Be sure to let Microsoft know how you feel about them taking their sweet time releasing a fix and be nice to that 14 year old geek down the street. They may very well “own” your computer.

John Herron, CISSP
Translate to: {GOOGLETRANS}
Google Ads




Headlines

»CVE-2012-5361 (ffmpeg)
Libavcodec in FFmpeg before 0.11 allows remote attackers to cause a denial of service (memory corrup ...
»CVE-2013-6446
The JobHistory Server in Cloudera CDH 4.x before 4.6.0 and 5.x before 5.0.0 Beta 2, when using MRv2/ ...
»CVE-2014-0229
Apache Hadoop 0.23.x before 0.23.11 and 2.x before 2.4.1, as used in Cloudera CDH 5.0.x before 5.0.2 ...
»CVE-2014-7279
The Konke Smart Plug K does not require authentication for TELNET sessions, which allows remote atta ...
»CVE-2014-8731
PHPMemcachedAdmin 1.2.2 and earlier allows remote attackers to execute arbitrary PHP code via vector ...
»CVE-2014-9832 (imagemagick)
Heap overflow in ImageMagick 6.8.9-9 via a crafted pcx file.
»CVE-2014-9833 (imagemagick)
Heap overflow in ImageMagick 6.8.9-9 via a crafted psd file.
»CVE-2014-9834 (imagemagick)
Heap overflow in ImageMagick 6.8.9-9 via a crafted pict file.
»CVE-2014-9835 (imagemagick)
Heap overflow in ImageMagick 6.8.9-9 via a crafted wpf file.
»CVE-2014-9836 (imagemagick)
ImageMagick 6.8.9-9 allows remote attackers to cause a denial of service via a crafted xpm file.
»CVE-2014-9838 (imagemagick)
magick/cache.c in ImageMagick 6.8.9-9 allows remote attackers to cause a denial of service (crash).
»CVE-2014-9839 (imagemagick)
magick/colormap-private.h in ImageMagick 6.8.9-9 allows remote attackers to cause a denial of servic ...
»CVE-2014-9840 (imagemagick)
ImageMagick 6.8.9-9 allows remote attackers to cause a denial of service (out-of-bounds access) via ...
»CVE-2014-9841 (imagemagick, leap, opensuse, suse_linux_enterprise_desktop, suse_linux_enterprise_server, suse_linux_enterprise_software_development_kit, suse_linux_enterprise_workstation_extension, ubuntu_linux)
The ReadPSDLayers function in coders/psd.c in ImageMagick 6.8.9.9 allows remote attackers to have un ...
»CVE-2014-9842 (imagemagick, leap, opensuse, suse_linux_enterprise_debuginfo, suse_linux_enterprise_desktop, suse_linux_enterprise_server, suse_linux_enterprise_software_development_kit, suse_linux_enterprise_workstation_extension, ubuntu_linux)
Memory leak in the ReadPSDLayers function in coders/psd.c in ImageMagick 6.8.9.9 allows remote attac ...


Date published: 2017-03-25T14:00:01Z
Details

»Apple Releases Security Update for iTunes
Original release date: March 24, 2017 Apple has released a security update for Apple iTunes t ...
»Aviation Phishing Scams
Original release date: March 23, 2017 US-CERT has received reports of email-based phishing ca ...
»Cisco Releases Security Updates
Original release date: March 22, 2017 Cisco has released security updates to address vulnerab ...
»Vulnerabilities Identified in Network Time Protocol Daemon (ntpd)
Original release date: March 22, 2017 The Network Time Foundation's NTP Project has has relea ...
»Cisco Releases Security Updates
Original release date: March 21, 2017 Cisco has released security updates to address vulnerab ...
»IRS Warns of Last-Minute Tax Scams
Original release date: March 17, 2017 The Internal Revenue Service (IRS) has released an aler ...
»Mozilla Releases Security Updates
Original release date: March 17, 2017 Mozilla has released security updates to address a vuln ...
»Microsoft Ending Support for Windows Vista
Original release date: March 17, 2017 All software products have a lifecycle. After April 11, ...
»Microsoft SMBv1 Vulnerability
Original release date: March 16, 2017 Microsoft has released a security update to address a v ...
»Cisco Releases Security Updates
Original release date: March 15, 2017 Cisco has released several updates to address vulnerabi ...


Date published: not known
Details

»Mostly blocked, but still good enough: Necurs sending pump-and-dump spam
The Necurs botnet has started sending pump-and-dump spam. Almost al ...
»Why the SHA-1 collision means you should stop using the algorithm
Realistically speaking, if your software or system uses the SHA-1 h ...
»VB2017 Call for Papers: frequently asked questions
The call for papers for VB2017, which takes place 4 to 6 October i ...
»Throwback Thursday: Michelangelo - Graffiti Not Art
This week marked the 25th anniversary of the trigger date of the in ...
»How are you defending your network? Come and tell us at VB2017!
Is it your job to defend your company’s network? Are you defending ...
»Quick impressions from BSides Budapest
At Virus Bulletin, we love the BSides concept and we have attended ...
»First sponsors of VB2017 announced
We are excited to announce the first five sponsors of VB2017, compa ...
»Security products and HTTPS: let's do it better
A recent paper showed that many HTTPS-intercepting security solutio ...
»The SHA-1 hashing algorithm has been 'shattered'
Researchers from Google and CWI Amsterdam have created the first kn ...


Date published: not known
Details
Main Menu
· Home
Current Security News
 
US-CERT Current Activity

» Apple Releases Security Update for iTunes
[24 Mar 2017 12:07pm]

» Aviation Phishing Scams
[23 Mar 2017 02:27pm]

» Cisco Releases Security Updates
[22 Mar 2017 04:02pm]

» Vulnerabilities Identified in Network Time Protocol Daemon (ntpd)
[22 Mar 2017 11:20am]

» Cisco Releases Security Updates
[21 Mar 2017 09:57am]

» IRS Warns of Last-Minute Tax Scams
[17 Mar 2017 09:21pm]

» Mozilla Releases Security Updates
[17 Mar 2017 06:54pm]

» Microsoft Ending Support for Windows Vista
[16 Mar 2017 10:45pm]

» Microsoft SMBv1 Vulnerability
[16 Mar 2017 04:12pm]

» Cisco Releases Security Updates
[15 Mar 2017 06:26pm]

***
US-CERT Alerts

» TA17-075A: HTTPS Interception Weakens TLS Security
[16 Mar 2017 06:40am]

» TA16-336A: Avalanche (crimeware-as-a-service infrastructure)
[30 Nov 2016 10:00pm]

» TA16-288A: Heightened DDoS Threat Posed by Mirai and Other Botnets
[14 Oct 2016 05:59pm]

» TA16-250A: The Increasing Threat to Network Infrastructure Devices and Recommended Mitigations
[06 Sep 2016 04:29pm]

» TA16-187A: Symantec and Norton Security Products Contain Critical Vulnerabilities
[05 Jul 2016 08:50am]

» TA16-144A: WPAD Name Collision Vulnerability
[23 May 2016 05:38am]

» TA16-132A: Exploitation of SAP Business Applications
[11 May 2016 05:31am]

» TA16-105A: Apple Ends Support for QuickTime for Windows; New Vulnerabilities Announced
[14 Apr 2016 01:48pm]

» TA16-091A: Ransomware and Recent Variants
[31 Mar 2016 04:00pm]

» TA15-337A: Dorkbot
[03 Dec 2015 04:40pm]

***
Computerworld Security

» How to protect yourself from ATM crime
[25 Mar 2017 05:00am]

» CIA, WikiLeaks and Doctor Who?
[24 Mar 2017 03:55pm]

» Apple: Macs and iPhones are safe from newly revealed CIA exploits
[24 Mar 2017 01:11pm]

» Google Play faces cat-and-mouse game with Android malware
[24 Mar 2017 12:16pm]

» To punish Symantec, Google may distrust a third of the web's SSL certificates
[24 Mar 2017 11:32am]

» FBI director floats international framework on encrypted data access
[23 Mar 2017 04:21pm]

» Leaked iCloud credentials came from third parties, Apple says
[23 Mar 2017 03:13pm]

» Google: Half of Android devices haven’t been patched in a year or more
[23 Mar 2017 01:41pm]

» Newly leaked documents show low-level CIA Mac and iPhone hacks
[23 Mar 2017 12:53pm]

» Senate votes to kill FCC's broadband privacy rules
[23 Mar 2017 11:13am]

» Snowden's ex-boss offers advice on stopping insider threats
[23 Mar 2017 11:10am]

» Look before you leap: 4 hard truths about IoT
[23 Mar 2017 06:21am]

» LastPass fixes serious password leak flaws
[22 Mar 2017 03:21pm]

» iPhone, Mac owners: How to stymie hackers extorting Apple, threatening to wipe devices
[22 Mar 2017 02:23pm]

» Google cites progress in Android security, but patching issues linger
[22 Mar 2017 01:41pm]

***
Microsoft Security Advisories

» 3123479 - SHA-1 Hashing Algorithm for Microsoft Root Certificate Program - Version: 2.0
[14 Mar 2017 11:00am]

» 4010983 - Vulnerability in ASP.NET Core MVC 1.1.0 Could Allow Denial of Service - Version: 1.0
[27 Jan 2017 11:00am]

» 3214296 - Vulnerabilities in Identity Model Extensions Token Signing Verification Could Allow Elevation of Privilege - Version: 1.0
[10 Jan 2017 11:00am]

» 3181759 - Vulnerabilities in ASP.NET Core View Components Could Allow Elevation of Privilege - Version: 1.0
[13 Sep 2016 11:00am]

» 3174644 - Updated Support for Diffie-Hellman Key Exchange - Version: 1.0
[13 Sep 2016 11:00am]

» 3179528 - Update for Kernel Mode Blacklist - Version: 1.0
[09 Aug 2016 11:00am]

» 2880823 - Deprecation of SHA-1 Hashing Algorithm for Microsoft Root Certificate Program - Version: 2.0
[18 May 2016 11:00am]

» 3155527 - Update to Cipher Suites for FalseStart - Version: 1.0
[10 May 2016 11:00am]

» 3152550 - Update to Improve Wireless Mouse Input Filtering - Version: 1.1
[22 Apr 2016 11:00am]

» 3137909 - Vulnerabilities in ASP.NET Templates Could Allow Tampering - Version: 1.1
[10 Feb 2016 11:00am]

» 2871997 - Update to Improve Credentials Protection and Management - Version: 5.0
[09 Feb 2016 11:00am]

» 3109853 - Update to Improve TLS Session Resumption Interoperability - Version: 1.0
[12 Jan 2016 11:00am]

» 3118753 - Updates for ActiveX Kill Bits 3118753 - Version: 1.0
[12 Jan 2016 11:00am]

» 2755801 - Update for Vulnerabilities in Adobe Flash Player in Internet Explorer and Microsoft Edge - Version: 53.0
[05 Jan 2016 11:00am]

» 3123040 - Inadvertently Disclosed Digital Certificate Could Allow Spoofing - Version: 1.0
[08 Dec 2015 11:00am]

***
WIRED

» Security News This Week: FedEx Offered Customers Five Bucks to Re-Install Flash
[25 Mar 2017 05:00am]

» Instagram Has Two-Factor Authentication Now, So Turn It On
[23 Mar 2017 01:30pm]

» WikiLeaks Reveals How the CIA Can Hack a Mac’s Hidden Code
[23 Mar 2017 12:09pm]

» The Clever ‘DoubleAgent’ Attack Turns Antivirus Into Malware
[23 Mar 2017 09:33am]

» Don’t Buy the Latest Trump Surveillance Hype
[22 Mar 2017 04:18pm]

» Good News: Android’s Huge Security Problem Is Getting Less Huge
[22 Mar 2017 08:00am]

» A Cybersecurity Arsenal That’ll Help ‘Protect Your Election’
[21 Mar 2017 05:00am]

» Inside the Hunt for Russia’s Most Notorious Hacker
[21 Mar 2017 04:00am]

» Russia? Nah. The House GOP Goes After Leakers Instead
[20 Mar 2017 04:02pm]

» Trump’s TSA Budget Fails to Cut the Obvious: Air Marshals
[20 Mar 2017 12:00pm]

***
Network World Security

» Consultant urges never pay ransomware demands
[24 Mar 2017 03:40pm]

» Apple: Macs and iPhones are safe from newly revealed CIA exploits
[24 Mar 2017 12:58pm]

» IDG Contributor Network: 7 best practices for securing your cloud service
[24 Mar 2017 12:36pm]

» Google Play faces cat and mouse game with sneaky Android malware
[24 Mar 2017 12:16pm]

» Review: Canary Flex security camera lives up to its name
[24 Mar 2017 07:01am]

» Smackdown: Office 365 vs. G Suite management
[16 Mar 2017 07:01am]

» Zix wins 5-vendor email encryption shootout
[13 Mar 2017 04:00am]

» Review: vArmour flips security on its head
[06 Mar 2017 03:50am]

» 5 open source security tools too good to ignore
[21 Feb 2017 07:12am]

» Review: Samsung SmartCam PT network camera
[15 Feb 2017 07:00am]

» Review: Arlo Pro cameras offer true flexibility for home security
[09 Feb 2017 07:01am]

» Face-off: Oracle vs. CA for identity management
[26 Jan 2017 10:30am]

» 6 steps to secure a home security camera
[23 Jan 2017 04:00am]

» CIA, WikiLeaks and Doctor Who?
[24 Mar 2017 03:55pm]

» Apple: Macs and iPhones are safe from newly revealed CIA exploits
[24 Mar 2017 12:58pm]

***


More IT Security
News Feeds
More Sponsors

Advertise on this site
RSS Feeds
Our news can be syndicated by using these rss feeds.
rss1.0
rss2.0
rdf

NIST.org is in no way connected to the U.S. government site NIST.gov

This site is © John Herron, CISSP. All Rights Reserved.

Please visit daily to stay up to date on all your IT Security compliance issues.

http://www.nist.org -
Hosted by BlueHost. We've never had a better hosting company.
{THEMEDISCLAIMER}