Update MS Office, Paint 3D to plug RCE vulnerabilities

Wednesday, 22 April 2020 / Published in Hacking

A week after the April 2020 Patch Tuesday, Microsoft has released out-of-band security updates for its Office suite, to fix a handful of vulnerabilities that attackers could exploit to achieve remote code execution. At the same time, a security update has also been released for Paint 3D, the company’s free app for creating 3D models, because the source of the fixed vulnerabilities is something that both Office and Paint 3D have in common: the Autodesk … More →

The post Update MS Office, Paint 3D to plug RCE vulnerabilities appeared first on Help Net Security.

Help Net Security

Weekly Update 187

Wednesday, 22 April 2020 / Published in Hacking

Presently sponsored by: SecurityFWD. A brand new YouTube show from Varonis. Watch Episode 1: How Far can Wi-Fi Travel?

Weekly Update 187

Spiders! Ok, not your normal start to a weekly update but yeah, we had a bit of an infestation this week which did take the mind of other current events for a while. Much of what’s happened beyond that this week has resulted in various tweet storms; the Zoom credential stuffing situation, the Coronavirus tracking app (holy cow that has some “robust” debate around it) and the (seemingly endless) thread of progress as I build up my Ubiquiti network. All that and more in the vid below ?

Weekly Update 187
Weekly Update 187
Weekly Update 187
Weekly Update 187

References

  1. If you don’t like spiders then don’t click this link (wonder how many of them are still crawling around in the air conditioning unit…)
  2. No, there isn’t a “Zoom data breach” and yes, people keep using shitty passwords (c’mon media, it’s not hard to report on this accurately!)
  3. The Coronavirus tracking app tweet storm (less than a day on and apparently, it’s had 125k impressions so it’s clearly getting some traction, but it’s divisive)
  4. Speaking of tweet storms, check out my Ubiquiti build! (this project has brought me so much joy ?)
  5. The Icelandic government is now on Have I Been Pwned (they’re the 10th national government to have full access to query their gov domains)
  6. Sponsored by: SecurityFWD. A brand new YouTube show from Varonis. Watch Episode 1: How Far can Wi-Fi Travel?


Troy Hunt’s Blog

Weekly Update 164

Thursday, 14 November 2019 / Published in Hacking

Presently sponsored by: IVPN. Mass surveillance is a reality. A VPN can’t solve this issue, but it’s a great first step. Use one that puts principle before profit.

Weekly Update 164

It’s a late, early in the day, hazy, bush-firey Aussie weekly update with a whole bunch of various bits and pieces of interest from throughout the week. The references below will give you a sense of how much I’ve jammed into this week so I won’t repeat it all here in the intro, but I reckon it’s a really interesting mix of different things across the industry. Enjoy ?

Weekly Update 164
Weekly Update 164
Weekly Update 164
Weekly Update 164

References

  1. Nord has had a heap of credential stuffing attacks (or at least a heap of Pastebin entries with creds from attacks)
  2. Whilst it sucks for Nord, they do also have some accountability here (the FTC says that “businesses will no longer be able to play the victim-card”)
  3. Veritas (DNA testing) had a breach (whilst DNA data wasn’t breached, it begs the question – what would the impact be if it was?)
  4. Finally – free SSL on the Azure app service for custom domains! (non-apex domains only at present, but it’s still preview for now so hopefully that’s only a temporary restriction)
  5. Sectigo – seriously guys, WTF is this garbage about?! (just read it and shake your head…)
  6. LinkedIn now has a security.txt file! (if your site doesn’t have one already, do it because it’s free and it’s awesome)
  7. Do HSTS from top to bottom or GTFO (this week’s blog post was a perfect illustration of why you need it everywhere)
  8. Varonis. Free Video Course: 7 Hidden Office 365 Security Settings You Can Only Unlock with PowerShell


Troy Hunt’s Blog

Weekly Update 162

Saturday, 09 November 2019 / Published in Hacking

Presently sponsored by: Varonis. Free Video Course: 7 Hidden Office 365 Security Settings You Can Only Unlock with PowerShell

Weekly Update 162

Ah, impending summer on the Gold Coast! It’s that time of year when you can just start to sense those warm beach days and it’s absolutely my favourite time of year here. Which means… it’s time to head off to other events again. Fortunately it’s all domestic this time as I head south to Sydney and Melbourne and maintaining my “no fly unless I absolutely have to” stance, it’s long, open road drives, copious podcasts and lots of thinking time.

On the infosec side of things, there’s a a bunch of HTTPS related content this week plus a couple of (really) sensitive data breaches. I do give a warning at the beginning of this week’s update that one of them in particular is pretty, uh, “edgy” and may not be something you want to listen to, but it consumed a bunch of cycles this week and IMHO is worthy of discussion. It’s a weird, weird world out there on the web…

Weekly Update 162
Weekly Update 162
Weekly Update 162
Weekly Update 162

References

  1. I’m at Ping IDENTIFY in Sydney on Tuesday
  2. And then Ping IDENTIFY in Melbourne on Thursday
  3. Chrome is changing the way it handles mixed content (good steps forward which amount to eventually upgrading all insecure subresource requests)
  4. Some people actually think that Firefox has killed EV (EV still works just fine, it’s only the visual indicator that’s gone)
  5. The Zooville breach taught me that zoophilia and bestiality laws are really, really weird (I learned – and saw – many things whilst process this one)
  6. Sponsored by Varonis. Free Video Course: 7 Hidden Office 365 Security Settings You Can Only Unlock with PowerShell


Troy Hunt’s Blog