[German]Security researchers from CyberArk have managed to trick Windows 10's Hello login (also included in Windows 11) in terms of logging in via facial recognition. All they needed was an infrared photo of the face in question, used on a fake usb device acting as an IR camera. Here's some information on the facts of the matter.
[German]The release of Firefox version 90.0.0 lasted just a week. Now the Mozilla developers have released July 19, 2021 version 90.0.1 as a maintenance update of the Firefox browser. Here is some information about what has been fixed.
[German]Regarding the problem, originally called PrintNightmare, that Windows systems are vulnerable via the print spooler service, there is a new warning. A remote print server that can be accessed by unauthorized parties allows arbitrary malicious files to be installed on clients via point-and-print. The US-CERT has issued a new warning about this. However, there is a possibility to mitigate this vulnerability via group policies.
[German]After I just reported about spy Trojans of the Israeli NSO Group on smartphones (see Pegasus spy software of NSO Group on many smartphones), I can also reveal the second case. The Israeli company Candiru exploited vulnerabilities in Windows to install their spyware called DevilsTongue. However, the vulnerabilities have been fixed in the meantime.
[German]It started with a leaked list of about 50,000 phone numbers. Investigative research by the media then shed light on the surveillance of smartphone users by governments and private organizations. Numerous people around the world were spied on using Pegasus spy software from Israel's NSO Group. The company seems to provided authoritarian states with the opportunity to surveil journalists, human rights activists and members from NGOs.
[Sponsored Post]In the rapidly evolving IT world, choosing the right remote desktop software is critical for organizations that value security, ease of use and reliability. One provider of secure remote access that has been on the market since 2001 is ISL Online, which presents some considerations for choosing such software below. More ...
[German]Zero Trust is a timely approach to addressing the cybersecurity challenges posed by the rise of telecommuting, the proliferation of personal devices and outdated physical security perimeters. At Microsoft, they have taken this step and learned various lessons, which Abbas Kudrati, Cloud & Cybersecurity Strategist, summarized in an article.
[German]Security is at the forefront of many administrator's minds and with Failover Clustering. Microsoft did some improvements with Windows Server 2019 and Azure Stack HCI with regards to security.
[German]As of July 13, 2021, Microsoft has released security updates for Exchange Server 2013, Exchange Server 2016 and Exchange Server 2019. These July updates are intended to address vulnerabilities reported by external security partners and found by Microsoft's internal processes on Exchange Server on-premises installations. However, on some systems, installing the security updates causes the Exchange Control Panel (OWA) and Outlook Web App (OWA) to stop working. Microsoft has since confirmed the issue (seems an OAuth certificate thing).
[German]Microsoft Defender for Identity (formerly Azure Advanced Threat Protection or Azure ATP) has been given the ability by Microsoft to detect and defend against attacks via the PrintNightmare vulnerability. This primarily affects exploitation of vulnerabilities in the Windows Print Spooler service (including the actively exploited CVE-2021-34527).
[German]Google has released Google Chrome 91.0.4472.164 for Windows, Mac and Linux on July 15, 2021. It is a security update that fixes 7 vulnerabilities in older browser versions at once. The browser should be patched quickly, as a 0-day vulnerability CVE-2021-30563, rated as high, is already being exploited in the wild.
MVP:
2013 – 2016
WIMVP:
2017 – 2020
