Security News > 2023 > February
The updates are in addition to 22 flaws the Windows maker patched in its Chromium-based Edge browser over the past month. "The attack itself is carried out locally by a user with authentication to the targeted system," Microsoft said in advisory for CVE-2023-21715.
Many of these MSPs and MSSPs want to provide vCISO services - seeing the incredible benefits of offering such services - but many feel they can't, citing the risks involved. So what exactly are the risks and benefits of starting a vCISO practice?
A US federal jury in Boston on Tuesday found Vladislav Klyushin - who owned an IT biz based in Moscow called M-13 - guilty of wire and securities fraud and conspiracy after two weeks of testimony and ten hours of deliberations. Prosecutors in the case argued that Klyushin and four others broke into the networks of Donnelley Financial Solutions and Toppan Merrill, through which publicly traded entities electronically file their quarterly earnings reports with America's financial watchdog, the Securities and Exchange Commission.
The APT37 threat group uses a new evasive 'M2RAT' malware and steganography to target individuals for intelligence collection. The threat actors targeted EU-based organizations with a new version of their mobile backdoor named 'Dolphin,' deployed a custom RAT called 'Konni,' and targeted U.S. journalists with a highly-customizable malware named 'Goldbackdoor.
Intel needs its own box for its bugs.... Intel dumped more than 30 security advisories on the world today, with updates and mitigations for folks to install or follow. Vulnerabilities in the Intel Media SDK can be exploited to gain privileges or crash software.
We counted 75 CVE-numbered bugs dated 2023-02-14, given that this year's February updates arrived on Valentine's Day. We extracted a list and included it below, sorted so that the bugs dubbed Critical are at the top.
Microsoft says that some WSUS servers upgraded to Windows Server 2022 might fail to push Windows 11, version 22H2 updates released during this month's Patch Tuesday to endpoints across enterprise environments. This known issue only affects WSUS servers upgraded from Windows Server 2016 or Windows Server 2019.
"Over the past year, we've seen more attacks originate from cloud computing providers, Cloudflare researchers wrote in a report, adding that the network traffic used in the attacks over the weekend came from"numerous cloud providers. Given the increasing number of DDoS attacks coming from cloud providers, Cloudflare is trialing - what convenient timing - a free botnet threat feed to monitor attacks.
Microsoft has reminded admins that Exchange Server 2013 is reaching its extended end-of-support date in 60 days, on April 11, 2023. The first version of Exchange Server 2013 was released in January 2013, and it reached its mainstream end date four years ago, in April 2018.
The February 2023 Patch Tuesday is upon us, with Microsoft releasing patches for 75 CVE-numbered vulnerabilities, including three actively exploited zero-day flaws. "The attack itself is carried out locally by a user with authentication to the targeted system. An authenticated attacker could exploit the vulnerability by convincing a victim, through social engineering, to download and open a specially crafted file from a website which could lead to a local attack on the victim computer," Microsoft explains.