 Microsoft’s Azure cloud services have become an attractive option for cybercriminals to store malicious content. From phishing templates to malware and command and control services, it seems that crooks found a new place for them. Just this month, BleepingComputer reported on two incidents related to malware on Azure. In one case there were about 200 websites showing tech-support scams that were hosted on the platform. Another article, published this week, informs of Azure being used of hosting a phishing template for Office 365. Being both products from Microsoft, the scam appears as a legitimate login request, increasing the success rate. It appears that these are not isolated incidents. Security researchers JayTHL and MalwareHunterTeam found malware on Azure and reported it to Microsoft on May 12. According to AppRiver cybersecurity company, the reported piece of malware along with other samples that were uploaded at a later time was still present on Microsoft’s Azure infrastructure on May 29. “It's evident that Azure is not currently detecting the malicious software residing on Microsoft's servers,” says David Pickett of AppRiver. One of the samples, ‘searchfile.exe,’ was indexed by VirusTotal scanning service on April 26, and Windows Defender detects it. The same goes for the malware found by the two researchers, ‘printer/prenter.exe,’ which is an uncompiled portable executable file, specifically so to avoid gateway and endpoint security solutions detecting it upon download. However, Windows Defender will kick in and block the malicious file when users try to download them on the machine. JayTHL details that the sample appears to be a simple agent that runs any command it receives from the command and control server. He determined that there could be as many as 90 bots under control if their ID numbers were generated in sequential order. Follow this security threat on OUR FORUM.  Microsoft has issued a second security warning over BlueKeep, a recently discovered vulnerability in its Remote Desktop Protocol service that could enable attackers to use a worm-like exploit to take over devices running unpatched older Windows operating systems. The software giant took the unusual step Thursday of issuing a second alert within a month concerning the BlueKeep flaw as security researchers expressed growing concerns that bad actors are rapidly developing exploits and that proof-of-concept code has already leaked online. In a new message, Simon Pope, director of incident response for the Microsoft Security Response Center, compared BlueKeep to EternalBlue, the Windows vulnerability that later opened the door to the WannaCry and NotPetya ransomware attacks of 2017. Pope warned that with reports of nearly 1 million Windows devices vulnerable to this flaw, security teams need to apply the patch that Microsoft issued with its first warning on May 14. "It's been only two weeks since the fix was released and there has been no sign of a worm yet. This does not mean that we're out of the woods," Pope warns. "If we look at the events leading up to the start of the WannaCry attacks, they serve to inform the risks of not applying fixes for this vulnerability in a timely manner." The vulnerability affects only older versions of Microsoft's Windows operating system, some of which are no longer supported by the company. The flaw affects Windows XP, Windows 7, Windows 2003 and Windows Server 2008, the company notes. Newer versions of Windows, including Windows 8 and Windows 10, are not affected. Follow this on OUR FORUM.  Microsoft and Intel discovered that on some computers with Intel display drivers users might have issues adjusting their display's brightness because of a driver compatibility issue after applying the Windows 10 May 2019 Update. "After updating to Window 10, version 1903, brightness settings may sometime appear as if changes applied took effect, yet the actual display brightness doesn't change," says Microsoft. To make sure that user experience is not affected, Microsoft has added a compatibility hold on devices with certain incompatible Intel display drivers from being offered the latest Windows 10 release until the issue is resolved. Until a resolution for the driver compatibility issue will be offered with an upcoming Windows 10 release, Microsoft advises all users to "not attempt to manually update using the Update now button or the Media Creation Tool until this issue has been resolved." In addition, a range of Intel Display Audio device drivers has also been found to cause problems leading to higher than normal battery drain. Microsoft also says that, in order to prevent any issues stemming from incompatible Intel Display Audio device drivers, a compatibility hold has been put in place to block the Windows 10 May 2019 Update from being offered until users have installed updated device drivers. Affected Windows users are advised to not apply the Windows 10 May 2019 Update manually before updating their system's Intel Display Audio device drivers and the update is being automatically provided via the Windows Update system. For more turn to OUR FORUM. |
Latest Articles
|