Security News
US tech giant Microsoft pledged Thursday to process and store all European cloud-based client data in the European Union amid unease in the region over the reach of US legislation on personal data collection. Microsoft's European clients have long been concerned over the legal status of data they store with US companies in the cloud and the extent to which they could be scrutinized by US authorities.
A trio of researchers at Palo Alto Networks has detailed vulnerabilities in the JET database engine, and demonstrated how those flaws can be exploited to ultimately execute malicious code on systems running Microsoft's SQL Server and Internet Information Services web server.In a talk today at Black Hat Asia titled Give Me a SQL Injection, I Shall PWN IIS and SQL Server, the three explained they found the JET engine - for years an underlying tech for Microsoft Access and other products, and still downloadable today - has many vulnerabilities.
Semperis announced the general availability of Directory Services Protector 3.5, which includes DSP Intelligence, a new module that provides automated security assessments of Microsoft Active Directory. DSP Intelligence proactively uncovers dangerous vulnerabilities that arise from external threat actors, systemic weaknesses in default identity and access settings, and even internal configuration drift that leads to security regression.
If you received an email in April stating that your active Microsoft Teams Free account is being deleted, this email was sent by mistake and Microsoft is not deleting your data. In a new article posted yesterday by Microsoft Product Manager Sam Cosby, Microsoft explains that these emails were sent by mistake and active Microsoft Teams Free organizations will not be deleted if they are actively used.
Microsoft Research's Project Freta aims to find invisible malware running on the cloud. Attackers have invested in smarter malware that can get around traditional security tooling, hiding underneath the operating system in memory, masking tell-tale signatures, and even deleting itself as soon as it detects security systems in action.
FireEye announced that Mandiant Managed Defense, Mandiant's managed detection and response service, now supports Microsoft Defender for Endpoint. "With threat conditions changing constantly, companies require trusted expertise with powerful analytical capabilities to ensure accurate and decisive execution - this is where Mandiant shines," said Marshall Heilman, Executive Vice President, Managed Defense and Advanced Practices, FireEye.
Technical documentation and proof-of-concept exploit code is available for a high-severity vulnerability in Microsoft Exchange Server that could let remote attackers execute code on unpatched machines. A technical write-up is available since April 26 from security researcher Nguyen Jang, who released in the past a short-lived PoC exploit for ProxyLogon vulnerabilities.
Microsoft quietly revealed its plans to remove the Adobe Flash plugin from Windows 10, with mandatory removal starting in July 2021. In a quiet update to their end of support for Adobe Flash blog post, Microsoft has outlined their further plans on how they will begin distributing the Windows 10 KB4577586 update.
Like other antivirus programs, Microsoft Defender will upload suspicious files to Microsoft to determine if they are malicious. "When Microsoft Defender scans your device, by default, it will use the"Automatic sample submission' feature to upload files to Microsoft's servers when a file is suspected to be malicious.
Microsoft has added AAC support for Bluetooth audio devices to the latest Windows 10 build released for Insiders in the Dev Channel. AAC is a lossy audio codec used by Apple devices and audio streaming platforms to provide high-quality audio streaming at low bitrates.