Tag: microsoft
-
A New Year’s gift from Microsoft: Surprise, your scanners don’t work
Canon confirms multifunction devices struggling with Windows 11 24H2 First seen on theregister.com Jump to article: www.theregister.com/2025/01/02/scanner_canon_windows_update/
-
Unpatched Active Directory Flaw Can Crash Any Microsoft Server
Windows servers are vulnerable to a dangerous LDAP vulnerability that could be used to crash multiple servers at once and should be patched immediately. First seen on darkreading.com Jump to article: www.darkreading.com/vulnerabilities-threats/active-directory-flaw-can-crash-any-microsoft-server-connected-to-the-internet
-
Microsoft Sentinel: A cloud-native SIEM with integrated GenAI
Tags: ai, attack, automation, breach, business, cloud, cyber, cybersecurity, data, data-breach, detection, edr, intelligence, microsoft, risk, siem, skills, soar, soc, technology, threat, tool, training, vulnerabilityIn a recent survey, 74% of cybersecurity professionals said that the threat landscape is the worst they’ve seen in 5 years.1 Escalating cyber threats, an expanding attack surface, and staffing shortages are putting tremendous pressure on the security operations center (SOC).It’s never been more important to have the right tools in place, especially when it…
-
US Treasury Department workstations breached in attack attributed to China
Tags: access, advisory, apt, attack, banking, ceo, china, cloud, cybersecurity, government, hacking, infrastructure, intelligence, microsoft, russia, saas, service, supply-chain, threat, update, vulnerabilityThe US Department of the Treasury revealed on Monday that an attacker was able to bypass security, access an undisclosed number of Treasury workstations, and steal “certain unclassified documents,” in what it called a “major cybersecurity incident”.In a letter to the US Senate’s Committee on Banking, Housing and Urban Affairs, the Treasury Department said that…
-
Immediate .NET installer link update needed
First seen on scworld.com Jump to article: www.scworld.com/brief/microsoft-immediate-net-installer-link-update-needed
-
38C3: Bitlocker über Schwachstellen ausgehebelt (Dez. 2024)
Noch ein kleiner Nachtrag vom Wochenende auf dem 38C3-Kongress des Chaos Computer Clubs hat Thomas Lambertz, ein Sicherheitsexperte, gezeigt, wie sich Microsofts Bitlocker-Verschlüsselung über ein “Downgrade” einer gepatchten Schwachstelle aushebeln lässt. Der Weg, über den Geheimdienste oder Strafverfolger an … First seen on borncity.com Jump to article: www.borncity.com/blog/2024/12/31/38c3-bitlocker-ueber-schwachstellen-ausgehebelt-dez-2024/
-
Misconfigured Kubernetes RBAC in Azure Airflow Could Expose Entire Cluster to Exploitation
Cybersecurity researchers have uncovered three security weaknesses in Microsoft’s Azure Data Factory Apache Airflow integration that, if successfully exploited, could have allowed an attacker to gain the ability to conduct various covert actions, including data exfiltration and malware deployment.”Exploiting these flaws could allow attackers to gain persistent access as shadow administrators First seen on thehackernews.com…
-
Microsoft 365: GeräteBypass in Intune
Works as designed, oder doch etwas größerer GAU? Administratoren sollen Geräte über Microsoft Intune verwalten können. Die Prüfung der Geräte-Compliance in Microsoft 365 lässt sich aber in Intune umgehen. Nachdem sich in den letzten Wochen bereits Angriffe angedeutet haben, sind … First seen on borncity.com Jump to article: www.borncity.com/blog/2024/12/31/microsoft-365-geraete-compliance-bypass-in-intune/
-
Microsoft Warns of Windows 11 24H2 Issue that Blocks Windows Security Updates
Microsoft has issued a warning about a significant issue impacting devices running Windows 11, version 24H2, that could block essential Windows Security updates. The problem arises when users install this version of the operating system using media”, such as CDs or USB drives”, containing either the October 2024 or November 2024 security updates. If affected,…
-
Microsoft adds another problem to the Windows 11 24H2 naughty list
Santa Satya pops one more issue into his sack just in time for Christmas First seen on theregister.com Jump to article: www.theregister.com/2024/12/27/microsoft_windows_11_security_update/
-
Best of 2024: CVE-2024-38063: An In-Depth Look at the Critical Remote Code Execution Vulnerability
In a recent security advisory, Microsoft disclosed a high-severity vulnerability identified as CVE-2024-38063. This critical Remote Code Execution (RCE) flaw, rated with a CVSS score of 9.8, poses a significant… First seen on securityboulevard.com Jump to article: securityboulevard.com/2024/12/cve-2024-38063-an-in-depth-look-at-the-critical-remote-code-execution-vulnerability-2/
-
Quantum Computing Advances in 2024 Put Security In Spotlight
The work on quantum computing hit some major milestones in 2024, making the path to a workable quantum computer seem closer than ever. Google, Microsoft, and other research efforts hit significant milestones this year, but is the cybersecurity world ready? First seen on darkreading.com Jump to article: www.darkreading.com/cyber-risk/quantum-computing-advances-2024-security-spotlight
-
Windows 11 installation media bug causes security update failures
Microsoft is warning of an issue when using a media support to install Windows 11, version 24H2, that causes the operating system to not accept further security updates. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/windows-11-installation-media-bug-causes-security-update-failures/
-
How are you securing your communications in the wake of the Volt Typhoon revelations?
Tags: access, advisory, android, apple, apt, attack, authentication, business, china, cisa, cisco, cloud, communications, computer, control, cyber, cybersecurity, detection, email, endpoint, espionage, exploit, firewall, firmware, government, group, Hardware, infrastructure, Internet, Intruder, microsoft, network, phishing, ransomware, risk, service, software, technology, threat, tool, update, vpn, vulnerability, windows, zero-dayThe FBI recently released information that text messages between Apple and Android texting systems were insecure and that attackers could listen in and access those communications, more fallout from the revelation that a Chinese-affiliated threat actor had breached telecommunications companies.The announcement that the group known as Salt Typhoon had compromised networks of major global telecommunications…
-
Channel Brief: Microsoft Reportedly Diversifying Copilot with ‘Home-Grown’ Models
Tags: microsoftFirst seen on scworld.com Jump to article: www.scworld.com/news/channel-brief-microsoft-reportedly-diversifying-copilot-with-home-grown-models
-
Why Cloud Identity Attacks Outpace On-Premises Risks
Blackpoint Cyber CEO Jon Murchison on MSP Cloud Identity Risks. With a 30-to-1 ratio of cloud to on-premises attacks, Blackpoint Cyber CEO Jon Murchison stresses the importance of enhanced identity detection and AI-driven solutions. He also outlines strategic moves for managed service providers to align with Microsoft’s ecosystem. First seen on govinfosecurity.com Jump to article:…
-
7 biggest cybersecurity stories of 2024
Tags: access, ai, alphv, at&t, attack, authentication, breach, business, china, cio, ciso, citrix, cloud, credentials, crowdstrike, crypto, cyber, cybercrime, cybersecurity, data, data-breach, deep-fake, detection, email, espionage, exploit, extortion, finance, google, government, group, hacking, healthcare, incident response, infection, insurance, intelligence, international, jobs, lockbit, malicious, malware, mandiant, mfa, microsoft, network, nis-2, north-korea, office, phishing, phone, privacy, ransomware, regulation, risk, risk-management, scam, service, software, strategy, tactics, technology, threat, ukraine, update, vulnerability, windowsCybersecurity headlines were plenty this year, with several breaches, attacks, and mishaps drawing worldwide attention.But a few incidents in particular had far-reaching consequences, with the potential to reshape industry protections, shake up how vendors secure customers’ systems, or drive security leaders to reassess their strategies.Longer-term trends such as increased cybersecurity regulations and the impact of…
-
Microsoft fixes bug behind random Office 365 deactivation errors
Microsoft has rolled out a fix for a known issue that causes random “Product Deactivated” errors for customers using Microsoft 365 Office apps. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/microsoft/microsoft-fixes-bug-behind-random-office-365-deactivation-errors/
-
New FlowerStorm Microsoft phishing service fills void left by Rockstar2FA
A new Microsoft 365 phishing-as-a-service platform called “FlowerStorm” is growing in popularity, filling the void left behind by the sudden shutdown of the Rockstar2FA cybercrime service. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/new-flowerstorm-microsoft-phishing-service-fills-void-left-by-rockstar2fa/
-
SECURITY AFFAIRS MALWARE NEWSLETTER ROUND 25
Security Affairs Malware newsletter includes a collection of the best articles and research on malware in the international landscape. Vishing via Microsoft Teams Facilitates DarkGate Malware Intrusion Spyware distributed through Amazon Appstore BADBOX Botnet Is Back Supply Chain Attack on Rspack npm Packages Injects Cryptojacking Malware 4.5 Million (Suspected) Fake Stars in GitHub: A Growing…
-
US order is a reminder that cloud platforms aren’t secure out of the box
Tags: access, best-practice, breach, business, cisa, ciso, cloud, control, cyber, cybersecurity, defense, fedramp, google, government, guide, identity, incident, incident response, infrastructure, intelligence, international, login, mfa, microsoft, monitoring, network, risk, saas, service, software, toolThis week’s binding directive to US government departments to implement secure configurations in cloud applications, starting with Microsoft 365 (M365), is a reminder to all CISOs that cloud platforms, even from major providers, aren’t completely secure out of the box.”Cloud stuff is easy to manage, easy to deploy,” said Ed Dubrovsky, chief operating officer and…
-
Microsoft coughs up yet more Windows 11 24H2 headaches
Users report the sound of silence from operating system update First seen on theregister.com Jump to article: www.theregister.com/2024/12/19/windows_11_24h2_issues/
-
Newly uncovered attack exploits Microsoft’s UI Automation framework
First seen on scworld.com Jump to article: www.scworld.com/brief/newly-uncovered-attack-exploits-microsofts-ui-automation-framework
-
Enhance Microsoft security by ditching your hybrid setup for Entra-only join
Tags: ai, authentication, business, cloud, compliance, conference, credentials, email, firewall, group, identity, infrastructure, intelligence, Internet, microsoft, network, ntlm, office, powershell, risk, service, switch, technology, tool, vpn, windowsArtificial intelligence is top of mind for nearly everything Microsoft is doing these days, but there’s another goal the company would like to see its users strive to attain, one that may not be easily obtained, and that’s to be Entra-joined only.That means no more Active Directory (AD) and no more traditional domain: instead, your…
-
Cybersecurity Snapshot: CISA Hands Down Cloud Security Directive, While Threat from North Korean IT Workers Gets the Spotlight
Tags: access, ai, authentication, best-practice, business, china, cisa, cisco, cloud, computer, control, cyber, cybersecurity, data, data-breach, email, extortion, finance, framework, fraud, google, government, guide, hacker, identity, incident, incident response, infrastructure, intelligence, international, Internet, jobs, korea, kubernetes, law, lessons-learned, linux, login, malicious, microsoft, mobile, monitoring, network, north-korea, office, password, regulation, risk, risk-management, russia, service, software, tactics, technology, threat, tool, updateCheck out the new cloud security requirements for federal agencies. Plus, beware of North Korean government operatives posing as remote IT pros. Also, learn how water plants can protect their HMIs against cyberattacks. And get the latest on the U.S. cyber incident response framework; the CIS Benchmarks; and local and state governments’ cyber challenges. Dive…
-
Passkeys: Microsoft kämpft weiter gegen das traditionelle Passwort
Ob Windows-User wollen oder nicht: Microsoft will das traditionelle Passwort weiterhin komplett abschaffen. Die Lösung: Passkeys. First seen on golem.de Jump to article: www.golem.de/news/passkeys-microsoft-kaempft-weiter-gegen-das-traditionelle-passwort-2412-191911.html
-
Russia fires its biggest cyberweapon against Ukraine
Tags: access, attack, breach, cisa, communications, country, cyber, cyberattack, defense, email, governance, government, group, incident response, infrastructure, intelligence, microsoft, mitigation, mobile, risk, russia, service, strategy, threat, ukraine, vulnerability, warfareUkraine has faced one of the most severe cyberattacks in recent history, targeting its state registries and temporarily disrupting access to critical government records.Ukrainian Deputy Prime Minister Olga Stefanishyna attributed the attack to Russian operatives, describing it as an attempt to destabilize the country’s vital digital infrastructure amid the ongoing war.”It’s already clear that the…