Active Directory Admins: May 2022 updates may force DCs to a boot loop (AltSecID attribute set on krbtgt)

Posted on 2022-05-18 by guenni

Windows[German]Today a short information for administrators of Active Directory Domain Controllers under Windows Server, who still have to apply the security updates for May 2022. I have come across the information that there is a bug that leads to nasty problems in Windows Server in certain configurations (which should not actually occur). Administrators should pay attention to the configuration of the AltSecID attribute on the krbtgt account before installing the update. If this attribute is set, a boot loop of the DC is imminent and the Active Directory is down. I'll post the information I picked up yesterday from a Windows Escalation Engineer and since on Twitter here.

Continue reading →

Posted in issue, Update, Windows | Tagged , , , , , | Leave a comment

Researchers: Malware can run on iPhones that are switched off

Posted on 2022-05-18 by guenni

Sicherheit (Pexels, allgemeine Nutzung)[German]A smartphone that is switched off is not off – we know this from movies where batteries are removed from smartphones and the devices are placed in a refrigerator or tin cans. It is certainly possible to run malware on an iPhone that is switched off. Security researchers from Darmstadt have just proven this in an experiment. It's a bit tricky and requires Bluetooth, NFC chips etc. in an iPhone – but it works.

Continue reading →

Posted in devices, Security | Tagged , | Leave a comment

Nvidia security updates for Kepler GTX 700/600 GPU WHQL driver (473.47) released

Posted on 2022-05-17 by guenni

Update[German]Nvidia has released a security update for the graphics driver of the Kepler GeForce GPUs on May 16, 2022, as you can read on this website. The new GeForce WHQL driver has the version 473.47 and is available for Windows 10 (64 bit) as well as Windows 11. The manufacturer writes that the security update has been released for the desktop Kepler-series GeForce GPUs, which are no longer supported by Game Ready drivers. This update fixes issues that can lead to several security compromises. Details can be found on the linked website and in the release notes.  (via)

Posted in Software, Update, Windows | Tagged , , , | Leave a comment

CISA warns against installing May 2022 updates on Windows Domain Controllers

Posted on 2022-05-17 by guenni

Windows[German]US CERT CISA (Cybersecurity & Infrastructure Security Agency) has temporarily removed vulnerability CVE-2022-26925 from its Known Exploited Vulnerabilities catalog and warns US organizations not to install the May 2022 updates for Windows on machines that act as domain controllers. This is in response to authentication issues related to the updates and DCs.

Continue reading →

Posted in issue, Security, Update, Windows | Tagged , , , , | Leave a comment

Windows 11 Update KB5013943 drops BSODs and causes issues with Sophos driver

Posted on 2022-05-17 by guenni

Windows[German]Another May 2022 patchday issue on Windows 11. Users who have been running Sophos antivirus solutions may have been seeing BlueScreens on Windows 11. The cause is the May 10, 2022 update KB5013943, which causes problems with a Sophos driver. Sophos has meanwhile released a fix to resolve this issue.

Continue reading →

Posted in issue, Update, Windows | Tagged , , , | Leave a comment

Why ISL Online: Critical factors when choosing a remote desktop solution

[Sponsored Post]In the rapidly evolving IT world, choosing the right remote desktop software is critical for organizations that value security, ease of use and reliability. One provider of secure remote access that has been on the market since 2001 is ISL Online, which presents some considerations for choosing such software below. More ...

Firefox 100.0.1

Posted on 2022-05-16 by guenni

Mozilla[German]Mozilla developers have released versions 100.0.1 of the Firefox browser on May 16, 2022. It is a maintenance update, which fixes bugs. Thanks to the reader for the tip.

Continue reading →

Posted in browser, Software, Update | Tagged | Leave a comment

Quick Assist is moved to Microsoft Store – old app out of support (May 2022)

Posted on 2022-05-16 by guenni

Windows[German]As of today, May 16, 2022, the remote support Quick Assist for Windows 10 and Windows 11 is only available in the Microsoft Store. The previous Windows 32 application for Quick Assist, which was available as a standalone application, has fallen out of support. Seems to frustrate some Windows administrators, because the whole thing is probably only half-baked implemented.

Continue reading →

Posted in Software, Windows | Tagged , , | Leave a comment

21 Million VPN User Records Leaked; will VPN be substituted by SASE?

Posted on 2022-05-16 by guenni

Sicherheit (Pexels, allgemeine Nutzung)[German]Currently, there seems to be a hitch with SSL VPN connections. Last week, a database dump was posted on Telegram with 21 million user data/login details from VPN providers SuperVPN, GeckoVPN and ChatVPN. An exploit for an unauthenticated remote code execution vulnerability exists for Cisco RV340 SSL VPN routers. In India, a VPN provider is intending withdrawal due to new laws. And Palo Alto is addressing the question of whether VPN will be replaced with SASE.

Continue reading →

Posted in Security | Tagged | Leave a comment

Microsoft has fixed the (PetitPotam) NTLM Relay Vulnerability (CVE-2022-26925) with Windows May 2022 Update

Posted on 2022-05-15 by guenni

Windows[German]Another addendum from this week: On patchday, Microsoft closed some vulnerabilities with its security update for Windows on May 10, 2022. One vulnerability (CVE-2022-26925, Windows LSA Spoofing) affects NTLM relay attacks on systems. The updates are another fix to the PetitPotam vulnerability disclosed in 2021. In the meantime, the vulnerability is being exploited for attacks against Active Directory. It should be patched in a timely manner – but update collateral damage is getting in the way in some cases.

Continue reading →

Posted in Security, Update, Windows | Tagged , , , | Leave a comment

Info stealer campaign targets German Car Dealerships and Manufacturers

Posted on 2022-05-15 by guenni

Sicherheit (Pexels, allgemeine Nutzung)[German]Security specialists from Check Point Software Technologies have come across an one years-long running cyber attack campaign that targeted German car dealerships and makers as a cover. The goal of the attacks was to use various types of malware to steal information. The actors behind the campaign initially registered several similar-looking domains, all of which imitated existing German car dealerships. The domains were later used to send phishing emails and host the malware infrastructure. Check Point traced the malware and came across an Iranian website that was being used as a hosting site and was not run by a government.

Continue reading →

Posted in Security | Tagged | Leave a comment