Articles for February 2017

Last weekend a security researcher publically disclosed a zero-day vulnerability in Windows 10, Windows 8.1 and Server editions after Microsoft failed to patch it in the past three months.

The zero-day memory corruption flaw resides in the implementation of the SMB (server message block) network file sharing protocol that could allow a remote, unauthenticated attacker to crash systems with denial of service attack, which would then open them to more possible attacks.

According to US-CERT, the vulnerability could also be exploited to execute arbitrary code with Windows kernel privileges on vulnerable systems, but this has not been confirmed right now by Microsoft.

Source: Windows SMB Zero-Day Exploit Released in the Wild after Microsoft delayed the Patch

Make sure you keep Office patched to protect against malicious Word documents generated by the AKBuilder exploit kit

Source: AKBuilder is the latest exploit kit to target Word documents, spread malware – Naked Security

Freedom Hosting II sites defaced by hackers who claim to have 75GB of data from more than 10,000 onion sites
Someone using the Anonymous tag has torn a gaping hole in a major Tor dark web host accused of being a home for thousands of child abuse websites.

At the weekend, visitors to websites hosted by the Freedom Hosting II service were reportedly greeted by a blunt defacement: “Hello, Freedom Hosting II, you have been hacked. We are disappointed,” it began before getting to the point: “We have a zero tolerance policy to child pornography – but what we found while searching through your server is more than 50% child porn…”

Source: Hackers take down dark web host linked with child abuse images – Naked Security

Version 4.7.2 fixed an unauthenticated privilege escalation vulnerability so serious it was deployed in total silence

Source: Critical WordPress update fixes zero-day flaw unnoticed – Naked Security

Hackers are likely exploiting the easy-to-find vulnerabilities, according to the security researcher who warned the Pentagon of the flaws months ago.

Source: Security flaws in Pentagon systems “easily” exploited by hackers | ZDNet