Microsoft Previews Centralized Windows Update Platform; OneDrive Files Exposed by File Picker Flaw; Reset ASUS Routers to Fix Persistent Backdoor

A system like this is overdue. I am always impressed by how much easier it is to patch Linux systems, with most updates being available from a single source. Windows has some catching up to do.

Johannes Ullrich

While this is a welcome move and one that should make patching and updating third-party applications much more effective, I do sincerely hope that Microsoft will provide appropriate controls and measures to ensure third-party vendors are not compromised to enable malicious code to be delivered via this solution.

Brian Honan

Having fewer tools to coordinate, install, and update products is a win for both IT and security, and many shops have solutions in play for this reason. The update orchestration platform handles both Microsoft and third-party updates, including apps and drivers, and provides services for scheduling updates/reboots during less impactful times, as you get with Windows update services today. Compare this to your current update orchestration service, particularly if you're a Windows-only shop.

Lee Neely

This could be huge news for the cybersecurity industry. Whether you like it or not, Windows is the dominant operating system used by both the consumer and enterprise market. Consumers are notoriously bad at handling software updates, especially if dealing with multiple update services. Centralizing this service perhaps removes some of the burden for those users. More to follow I suspect, on both risk and reward.

Curtis Dukes

Who in the audience is a Red Teamer who just realized that we have a new way of delivering implants, like a Microsoft-sanctioned version of Evilgrade? Am I the only one?

Moses Frost

Probably worth waiting for release and testing of Microsoft's fix to the Open Drive issue before committing to putting all your eggs in the Windows Update basket.

John Pescatore

Beyond making sure guidance and policy about sharing files is in place, it's not a bad idea to review current sharing settings. When was the last time you looked at what you were sharing or what's shared with you? Consider time limiting shared items, inbound or outbound.

Lee Neely

This seems to be an issue with the OAuth Scopes that are being asked for by the system. The workaround, which is 'don't use it,' appears to be, um, well, insufficient?

Moses Frost

Oasis says they notified Microsoft and that 'Microsoft is considering future improvements, including more precise alignment between what OneDrive File Picker does and the access it requires.' Just over one year ago, Satya Nadella, Microsoft Chairman and CEO, told all Microsoft employees 'If you're faced with the tradeoff between security and another priority, your answer is clear: *Do security*. In some cases, this will mean prioritizing security above other things we do, such as releasing new features or providing ongoing support for legacy systems.' Sounds like the captain said 'Turn!' and the ship kept steaming forward, at least for OneDrive.

John Pescatore

These types of attacks have been happening for at least 20 years. Adding 'backdoor keys' to an authorized_keys file is a classic Linux persistence technique. For Linux systems, it is best to manage these keys centrally and have detection mechanisms in place to alert you if the file was altered.

Johannes Ullrich

Beyond making sure you are keeping routers actively updated, review contents of SSH key files as well as making sure ssh is off if you're not using it or that access to the service is tightly controlled where you are. Remember if compromised, you'll be doing a factory reset/reconfiguration. Rescan after the reset to be sure you're clean.

Lee Neely

A full factory reset solves many security ills. That said, the reset also needs to be augmented with patching to bring it up to the latest software version. Unfortunately, the customer base for this product isn't the most adept at managing the security of their system. I suspect these backdoored routers will be around for a while longer.

Curtis Dukes

Beyond making sure threat detection, MFA and training are in place, to include validation of callers, resist the temptation to think you can't talk yourself out of whatever happens because of your background/profession. Talk to your MSP to make sure you have sufficient protection and response for the current threat environment.

Lee Neely

If you are in Industry X and need backup for convincing management, just do a web search for 'Cyberthreat Actor Group is Targeting Industry X,' and you will find headlines. If you are responsible for protecting client legal information, I hope you don't need to use articles like this one.

John Pescatore

Law firms have always been close to the top of the list of potential targets. They often deal with clients' intellectual property and are typically ill-prepared to adequately safeguard the data, making them the weak point in an organization's cyber defense. Vet your law firms carefully and ask questions as to staffing of their cyber defense and breach preparation, just like you should do for any vendor.

Johannes Ullrich

Criminals simply go where the money is. The attack techniques they employ are generally the same. The alert does reinforce the need for companies to understand how law firms secure their data. In essence, what does the law firm's cyber security program look like and how is it managed?

Curtis Dukes

Your EDR should be hip to these malicious packages. Make sure EDR is provided without user interaction as the fake domain and download (BitDefender.zip) will likely fool unwary users. Bitdefender is working to 86 the fake download site and domain.

Lee Neely

Hey, it sounds silly and old, but if it works right?

Moses Frost

Fascination with AI hasn't escaped the notice of threat actors, and of course they are seeking to weaponize that trend. The blog includes IoCs for your threat hunters, but this is going to keep evolving as the trend continues. Provide vetted AI solutions to offset risks as well as training on choosing wisely online.

Lee Neely

The MathWorks status site is being continuously updated as the outage is resolved and provides a link to subscribe to updates you may wish to leverage. Most recently their license server, file exchange and accounts services are back, which should help your users immensely. Unfortunately, they don't have an overall indication of what remains offline. No ransomware gang has taken credit for the attack.

Lee Neely

Most ransomware reports talk about the effect on the cyber underserved, this one demonstrates that even large, well-resourced companies can be a victim. Let's hope that they're more forthcoming with post event analysis than they have been about the event, as we all could learn from their misfortune.

Curtis Dukes

The Adidas breach amounted to contact information: name, email, etc. which could be leveraged for order related phishing scams. This is similar to the recent Coinbase breach, reminding us to keep an eye on third-party security, particularly as unlike Coinbase, you likely can't just fire them if an incident happens. You should have the conversation about what would trigger a switch of providers and how your data would be transferred and disposed of.

Lee Neely

Not the first time an organization has been tripped up by a third-party service provider security failing. The incident presents an opportunity for CISOs to use as part of a table-top exercise for the executive team. You might also want to include on the risk register for managing third-party data spillage.

Curtis Dukes

Both Chrome CVEs have a CVSS score of 8.8, and appear to be not too difficult to compromise, so keep an eye on the update rollout. Firefox critical flaws are addressed in Firefox 139, ESR 115.24 and 128.11. Note there are also critical fixes in Thunderbird 139 and 128.11.

Lee Neely

The Cellcom attack likely involved a DDoS attack, which regional providers like them may not be able to mitigate. On the other hand, these smaller providers are not targeted the way large providers like Verizon, AT&T and T-Mobile are. Consider the ability to defend, react and respond to threats when evaluating provider options, including service delivery targets and exact requirements to change if needed.

Lee Neely