Major Updates For Windows, IE, Office And Edge

During the February Patch Tuesday, Microsoft released 13 security updates for critical vulnerabilities in Windows, Internet Explorer, Microsoft Edge Office, Microsoft Server Software, the .NET Framework and Adobe Flash Player. Six of the updates are rated as critical.

In this case, an attacker could execute arbitrary code on the computer with hardly any user interaction. It involves, for example just visiting a malicious or hacked website. The remaining updates are for vulnerabilities that an attacker who already had access to a system to increase its rights or cause a denial of service.

Two of the vulnerabilities in Microsoft SharePoint and Windows, were already known before Microsoft had released an update.These vulnerabilities would not be attacked active. Most problems have been resolved in Internet Explorer. It involves a total of 13 vulnerabilities. There are also two critical vulnerabilities in the built-in PDF reader in Windows 8.1 and later. Via a malicious PDF document, it was possible for an attacker to take over your computer. An overview of all updates on this page to find. Updating is done on most Windows computers automatically.

"A Quarter Of IoT Devices Is Leak '

Connecting IoT devices in the home is like playing Russian roulette. Nearly one in four 'connected' devices for home use is not secured. Or there are errors in the firmware or the Web portal to gain access to the device is not secure enough. That's the conclusion of researchers from the French Eurecom and the Ruhr University in Bochum, Germany. They examined the firmware on routers, modems, VoIP phones, network cameras and other IoT devices that can be managed via the internet.

Attempts were made to undermine security by customizing the firmware by malicious software updates, but also to attack the web portal of the aircraft. The portals were exposed to frequent attacks such as XSS (cross-site scripting), CSRF (cross-site request forgery), SQL injection and RCE (remote code / command execution).

In total, were investigated in 1925 firmware images from 54 different manufacturers. More than 9200 vulnerabilities were found in 185 firmware images. Although only 8 percent of the firmware php code contained in the management of the portal, was found in 143 firmware images whopping 5000

XSS Vulnerabilities.

The study seems to confirm what even last week at Black Hat Europe emerged. A survey conducted by Information Week and Dark Reading which showed that IT professionals believe that in two years the security of IoT will be a top priority. Now the priority is still mainly in the security of applications and end users.

Critical Android Leak Fixes In Nexus Devices

During the patch cycle is from November Google poem multiple critical vulnerabilities in the Android version of Nexus devices, allowing an attacker to execute remote code on smartphones and tablets. Just as Microsoft is also Google each month with security updates.

It is in this case for updates to Nexus devices. The updates November fix seven vulnerabilities, two of which are labeled as critical. Through Critical vulnerabilities an attacker could execute code remotely on the device, for example by sending an MMS message, or if the user opens an e-mail or website. These are two leaks in the media server and libutils. The remaining five vulnerabilities, including one in the Stage Fright library, have a lesser impact.

According to Google, Android has several security measures that reduce the likelihood that Android leaks can be attacked successfully. For example, there are anti-exploit measures added to newer versions Android. In addition, search the Android Security Team via Verify Apps and SafetyNet to potentially harmful applications. Further send Google Hangouts, and Messenger will not automatically media to processes such as media server.

Updates are over-the-air (OTA) offered and are also available as firmware download. When the updates for the Android handsets from other manufacturers appear is unknown.

Symantec: WinRAR Flaw Less Serious Than Thought

A vulnerability in the popular WinRAR archiving progam which no update is available, and for which recently the National Cyber ​​Security Center (NCSC), the government warned is less severe than thought, say Symantec and developer RARLAB.

WinRAR is a very popular program for packing and unpacking files. Besides the standard RAR archive, the software can also make a Self Able Extract (SFX) archives. In this case the archive file is unpacked automatically when the user opens the file, regardless of whether they have installed WinRAR or not. SFX archives are basically just exe files and consist of the packed file and the un pack module WinRAR. By letting users open a malicious SFX archive an attacker could execute arbitrary code with the rights of the logged-in user, as this video shows.

The vulnerability makes it possible to be carried out when opening the SFX archive automatic code of the attacker, like downloading and installing malware. Contrary to some media reports, the problem not only for users of WinRAR, but to all Windows users who receive a malicious SFX archives. Symantec and RARLAB, developer of WinRAR, users need to open exe files, whether it is an SFX archive or not, always be careful.

RARLAB said in a statement that there are much simpler ways to attack users via a malicious SFX archive. Users also are advised not to open unexpected files or files from unknown or untrusted sources. The developer of WinRAR is therefore no plans to remove the option is now displayed where the use of attack, as this only legitimate users would hit.

Mozilla Extends Deadline For Autographed Firefox Add-ons

Developers of add-ons for Firefox more time to meet the new demands of Mozilla. For harmful Firefox add-ons to address had demanded that all Mozilla Add-ons from Firefox would be 42 signed.Unsigned extensions will not work in Firefox.

All add-ons that are available on the Mozilla website, addons.mozilla.org (AMO), will be automatically signed and verified.Extensions which are offered through other channels must first be checked by AMO and signed. Add-ons that can not request a manual check by the automatic control haven. Mozilla late now that the deadline of Firefox 42 has shifted to Firefox 43. This version is scheduled for December 15th.

According to Lisa Brewster Mozilla had many developers indicated that they did not have sufficient time to meet the new requirements. Originally had the signings of add-ons for September 22 have been processed, if the beta version of Firefox 42 will appear. In addition to the extra time to get Mozilla developers will also make it clearer as an add-on for control is offered where exactly to meet.

Microsoft Emergency Patch For Active Attacked IE Flaw

Microsoft has released an emergency patch released for a critical vulnerability in Internet Explorer that is actively used to infect computers with malware. Visiting a hacked or malicious Web site or see the getting infected ads is sufficient to execute the attacker to run arbitrary code on the computer.

It should be noted that the attacker could execute code with the rights of the logged in user. The impact may therefore be less if users who have an account with reduced logging rights, Microsoft said. The vulnerability was already attacked before the patch was available from Microsoft. What kind of attack it is and who the target was not reported.

The vulnerability, which was reported to Microsoft by a Google researcher, is present in IE7 on Windows Vista to IE11 on Windows 10. Because of the impact users get the advice Security Bulletin MS015-093 install immediately. On most computers, however, will automatically happen.

Mozilla Firefox Is Harmful Tackle Add-ons

Mozilla has announced a plan to which the browser developer harmful Firefox add-ons is targeting. One of the strengths of Firefox is the ability to support enhancements. Extensions through both Mozilla's own website addons.mozilla.org (AMO) and other channels can be spread. This gives developers a lot of flexibility and options, but also provides an opportunity rotten apples.

"We are responsible for our add-ons ecosystem and can not simply look at the side as our users affected by malicious add-ons," said Mozilla's Jorge Villalobos . This relates to extensions that injecting ads or execute scripts on social networking sites. Mozilla has follows guidelines, but keep the malicious extensions are not there and are usually spread outside the duct from Mozilla. Mozilla does have the ability to block these add-ons, but finding it is becoming impractical. Villalobos notes that Mozilla as only Google could offer add-ons through its own channel, but that is too easy an option.

Therefore, there is now announced another plan which henceforth only signed add-ons are accepted. All add-ons on AMO will be signed automatically. Extensions offered through other channels must first be checked and signed by AMO. Add-ons that can not request a manual check by the automatic control haven. Transition will occur whereby unsigned apps for a period of 12 weeks will give a warning. After that it will no longer be possible to install these extensions.

To give developers still some freedom will it be possible to install unsigned extensions in early test versions of Firefox.Ultimately, the measure must ensure that extensions that fully audited and signed are simpler and more user-friendly can be installed wherever they are offered. The plan now is to begin the transition phase in the second quarter of this year, which means that the extension warnings are likely to appear in Firefox 39.

Vulnerability: Thousands Of WordPress Sites Vulnerable Fancybox Leak

The developer of the fancybox plugin for WordPress has an emergency patch for a vulnerability that in recent days has been used to provide all kinds of WordPress sites from malicious code. On the affected sites was placed an iframe that tried to infect visitors with malware.

Fancybox for WordPress is a plugin for viewing images. With 550,000 downloads, it's a pretty popular plugin. According to security firm Sucuri that the attacks were discovered many websites through the plug-in have been hacked. On the WordPress forum complain several users that their website via the plug-in malicious code is provided. Some websites would since last Christmas through fancybox been hacked.

After discovery of the vulnerability of the plug-in was temporarily by WordPress.org team removed from their repository.Meanwhile, who is available again, where users get urgent advice currently available update to version 3.0.4 to install.Google would now block the website where the iframe pointing and where the malware is loaded.

Google Pays Researchers 4 Million For Bug Reports

Since Google in 2010 with a program in which the researchers began paying for reporting vulnerabilities and other security issues in their own software has more than 4 million dollars paid to rewards. Last year, more than $ 1.5 million to more than 200 different researchers made. The highest reward was an amount of $ 150,000 , for the well-known hacker George Hotz. Hotz was then invited to walk in the Project Zero Team Google internship that is actively looking for leaks in many popular programs.

Through the rewards Google hopes to find vulnerabilities that might otherwise be missed. Last year more than 500 bugs were discovered in this way and rewarded. This year, Google continues to expand the reward program, as the search giant announced . There is also monetize vulnerabilities in Google applications on Android and iOS and come and scholarships for security researchers. In this case, Google will pay the investigator for his research, even if no vulnerabilities found.

The reward programs would ensure that it is becoming increasingly difficult to find vulnerabilities, which can discourage researchers to invest their time. Therefore now started this experimental program in which researchers already before they have examined a scholarship one line of code, with a maximum amount of $ 3113.70. Research fellows will also find that leak still qualify for the applicable bugbeloning.