Millions of computers powered by Intel processors are affected by vulnerabilities that can be exploited by malicious actors to obtain potentially sensitive information. The side-channel attack methods, named ZombieLoad, Rogue In-Flight Data Load,(RIDL) and Fallout, are similar to the notorious Meltdown and Spectre. The attack methods work against both PCs and cloud environments, and they can be launched against most Intel CPUs.
The techniques can be used to get applications, the operating system, virtual machines and trusted execution environments to leak information, including passwords, website content, disk encryption keys and browser history. An attacker can perform an MDS-based attack from user space, with unprivileged instructions. As the leakage occurs from stale data latched in buffers in the pipeline, the only defence is to flush the buffers before moving to a less privileged context. For example, hackers can use the ZombieLoad attack, which is a subclass of RIDL, to obtain a user’s browsing history even if the victim surfs the web from a virtual machine or uses the Tor anonymity network.
If you find that a computer is susceptible to ZombieLoad, you may want to avoid using it as a multi-user system. ZombieLoad breaches the CPU's memory protection. On a machine that is susceptible to ZombieLoad, one process can potentially read all data used by other processes or by the kernel.
This issue can be mitigated with a combination of software, firmware and configuration changes. Note that some affected processors are not expected to receive microcode updates. For these processors, there is no mitigation available. Users with workloads of concern on these processors should move the workload elsewhere. If you have any untrusted code running in VMs, and need to prevent the risk of data leakage, the only available option at the moment is to disable hyper-threading. This is preferably done in the BIOS, but can also be done by Xen at boot time by specifying `smt=no` on the command line.
ESXi Remote Code Execution Vulnerability
Investigation revealed that the vulnerability ESXi versions 6.0, 6.5 and 6.7 running on any platform, and the Horizon cloud desktop-as-a-service (DaaS) platform version 8.x. could be exploited to perform remote code execution.
A vulnerability in the REST API of Cisco Prime Infrastructure (PI) and Cisco Evolved Programmable Network Manager (EPNM) releases prior to 3.0.2 could allow an unauthenticated remote attacker to execute arbitrary code with root privileges on the underlying operating system.
ngCERT Advisory on Scranos Malware
Scranos is a Trojan horse that steals information from the compromised computer. It may also download potentially malicious files. Scranos cloaks itself as cracked software or apps that pose as legitimate programs, such as ebook readers, video players, drivers, and even security products. Upon execution, a rootkit driver is installed to hide the malware.
Windows 10 Task Scheduler Zero-Day Vulnerability
Microsoft Windows Task Scheduler is a set of Microsoft Windows components that allows for the execution of scheduled tasks. The exploit "functions reliably on 32- and 64-bit Windows 10 platforms, as well as Windows Server 2016 and Windows Server 2019.
Millions of computers powered by Intel processors are affected by vulnerabilities that can be exploited by malicious actors to obtain potentially sensitive information. The side-channel attack methods, named ZombieLoad, Rogue In-Flight Data Load,(RIDL) and Fallout, are similar to the notorious Meltdown and Spectre. The attack methods work against both PCs and cloud environments, and they can be launched against most Intel CPUs.
Windows BlueKeep Vulnerability
BlueKeep Vulnerability exists within the Remote Desktop Protocol (RDP) used by the Microsoft Windows Operating Systems (OSs). An attacker can exploit this vulnerability to perform remote code execution on an unprotected system.
ngCERT Advisory 19-years-old WinRAR vulnerability leads to over 100 malware exploits
ngCERT Advisory 19-years-old WinRAR vulnerability leads to over 100 malware exploits
ngCERT Advisory Microsoft Exchange 2013 and Newer are vulnerable to NTLM relay attacks
ngCERT Advisory Microsoft Exchange 2013 and Newer are vulnerable to NTLM relay attacks
