1 844.742.7448 
Email Us
Remote Support 
Contact
The popular continuous-delivery platform has a path-traversal bug (CVE-2022-24348) that could allow cyberattackers to hop from one application ecosystem to another.
Threatpost
Posts tagged "Security"
Office 365 unveils major email security boost
Microsoft has added a new security layer to its Office 365 email service as it looks to improve the integrity of the messages going in and out.
The company says its new protection, SMTP MTA Strict Transport Security (MTA-STS), a feature it first announced in H2 2020, will solve problems such as expired TLS certificates, problems with third-party certificates, or unsupported secure protocols.
“We have been validating our implementation and are now pleased to announce support for MTA-STS for all outgoing messages from Exchange Online,” Microsoft said in an announcement.
Extra protection
In practice, the new security layer means all emails that are sent through Exchange Online will only be delivered through connections that have both authentication and encryption.
That should render downgrade, and man-in-the-middle attacks impossible, or at least – a lot harder to pull off.
“Downgrade attacks are possible where the STARTTLS response can be deleted, thus rendering the message in cleartext. Man-in-the-middle (MITM) attacks are also possible, whereby the message can be rerouted to an attacker's server,” the announcement added.
“MTA-STS (RFC8461) helps thwart such attacks by providing a mechanism for setting domain policies that specify whether the receiving domain supports TLS and what to do when TLS can't be negotiated, for example stop the transmission.”
Those interested in adopting MTA-STS should refer to this link, where Microsoft explains the process in detail.
Read more
The company is already working on further strengthening the security of Office 365 email. DANE for SMTP (DNS-based Authentication of Named Entities), which is said to provide even better protection than MTA-STS, will be rolled out in the coming months.
“We will deploy support for DANE for SMTP and DNSSEC in two phases. The first phase, DANE and DNSSEC for outbound email (from Exchange Online to external destinations), is slowly being deployed between now and March 2022. We expect the second phase, support for inbound email, to start by the end of 2022,” BleepingComputer cited the Exchange team.
“We've been working on support for both MTA-STS and DANE for SMTP. At the very least, we encourage customers to secure their domains with MTA-STS,” Microsoft added.
“You can use both standards on the same domain at the same time, so customers are free to use both when Exchange Online offers inbound protection using DANE for SMTP by the end of 2022. By supporting both standards, you can account for senders who may support only one method.”
- Here’s our rundown of the best endpoint protection software right now
Via: BleepingComputer
Supply-Chain Security Is Not a Problem…It’s a Predicament
Despite what security vendors might say, there is no way to comprehensively solve our supply-chain security challenges, posits JupiterOne CISO Sounil Yu. We can only manage them.
Threatpost
Unpatched Security Bugs in Medical Wearables Allow Patient Tracking, Data Theft
Rising critical unpatched vulnerabilities and a lack of encryption leave medical device data defenseless, researcher warn.
Threatpost
Microsoft Edge is getting a major security boost straight out of Minority Report
Microsoft is looking to give its web browser a significant security upgrade with the release of a new build featuring some useful protection updates.
The company has revealed that Microsoft Edge v.98 will offer a boosted browsing experience that puts safety and security at the forefront, as well as “giving you an extra layer of protection when browsing the web.”
This will allow users to “enhance your security on the web”, the official entry in the Microsoft 365 roadmap says.
Step forward
There's not a lot of detail about what the “new browsing experience” in Microsoft Edge v.98 will entail just yet, but the company says it will be “a step forward”.
It will allow administrators to apply group policies to end-user desktops across not just Windows devices, but also those running macOS and Linux.
These should help protect against so-called zero-day threats, which are brand-new malware threats that typically look to take advantage of recently-discovered security flaws, and are often extremely dangerous due to a lack of reference points.
Microsoft Edge v.98 will allow users to “mitigate unforeseen active zero days”, the company says, offering an extra layer of protection to keep them safe online.
Read more
It's not clear if the new security protections form part of the long-awaited “super duper secure mode” for Microsoft Edge, which launched back in November 2021 as the company looked to boost security for the browser.
Available for Edge v.96 and upwards, the new platform offers two separate configurations – Balanced and Strict – which determine the level of additional protection the user receives.
Balanced mode learns which sites the user frequents and loosens restrictions on these domains, whereas Strict mode applies restrictions across all websites, which may mean some elements no longer work as intended. Users can also create exceptions manually for websites they would like to be exempt from the extra security measures.
How to Secure Your SaaS Stack with a SaaS Security Posture Management Solution
SaaS Security Posture Management (SSPM) named a must have solution by Gartner. Adaptive Shields SSPM solution allows security teams full visibility and control.
Threatpost
TrickBot Crashes Security Researchers’ Browsers in Latest Upgrade
The malware has added an anti-debugging tool that crashes browser tabs when researchers use code beautifying for analysis.
Threatpost
Apple Fixes 2 Zero-Day Security Bugs, One Exploited in the Wild
iOS 15.3 & iPadOS 15.3 fix the Safari browser flaw that could have spilled users’ browsing data, plus a zero day IOMobileFrameBuffer bug exploited in the wild.
Threatpost
The Log4j Vulnerability Puts Pressure on the Security World
It’s time to sound the alarm for Log4Shell. Saryu Nayyar, CEO at Gurucul, discusses what actions you should be taking.
Threatpost
Microsoft has uncovered loads of Windows 11 security threats – here’s what you need to do
Microsoft has revealed that it has discovered several serious security vulnerabilities in Windows 11, as well as other versions including Windows 10.
The revelations came as part of January 2022’s ‘Patch Tuesday’ – the day of the month that Microsoft releases a swathe of patches to fix issues in its software.
While many of the vulnerabilities, which don’t just affect new versions of Windows, but also older versions such as Windows 8, Windows 7 and Windows Server 2019, were fixed with patches, six of the threats were highlighted as zero day threats.
While many security vulnerabilities are thankfully found and fixed before malicious users find and exploit them, zero day threats are vulnerabilities that are already out in the wild, which means they are particularly worrying.
In total, Microsoft announced the existence of 97 new exploits – which is certainly a troubling number. As a report in Forbes explains, Microsoft has limited the information about the zero day exploits to ensure it has time to address them before they are exploited. Microsoft believes that so far, there have not been any attacks using the vulnerabilities. Obviously, though, time is of the essence.
The zero day vulnerabilities are:
- Critical – CVE-2021-22947 – Open Source Curl Remote Code Execution Vulnerability
- Important – CVE-2021-36976 – Libarchive Remote Code Execution Vulnerability
- Important – CVE-2022-21919 – Windows User Profile Service Elevation of Privilege Vulnerability
- Important – CVE-2022-21836 – Windows Certificate Spoofing Vulnerability
- Important – CVE-2022-21874 – Windows Security Center API Remote Code Execution Vulnerability
- Important – CVE-2022-21839 – Windows Event Tracing Discretionary Access Control List Denial of Service Vulnerability (limited to Windows 10 and Windows Server 2019)
Of the 97 vulnerabilities, eight are labeled as ‘critical’, with 88 labeled as ‘important’. This means they are particularly dangerous, so users should make sure they are protected against them as soon as possible.
What should you do?
Microsoft’s warning is certainly troubling, but there’s no need to panic, as long as you take some precautionary steps. While the zero day threats are in the wild, they’ve not been used and Microsoft is actively working on fixes.
Meanwhile, it has also created patches for many of the other vulnerabilities. So, the best thing you can do right now is ensure that Windows 11 (or whichever version you have installed) is updated with the latest security patches.
They should download automatically, and If that’s the case you may see a prompt in the taskbar to restart your PC. You may also notice when you go to turn off your PC that there are options to ‘Update and restart’ and ‘Update and shut down’ – make sure you pick one of those.
You should also check to make sure there are no updates waiting for you. To do this, open up Settings and go to Windows Update > Check for Updates. If any are found, download and install them.
If you have any anti-virus or anti-malware software installed, make sure they are updated as well.
Hopefully Microsoft will continue to investigate and fix these vulnerabilities ASAP.
- These are the best free antivirus software tools