Tag: Microsoft

Ephemeral, In-Memory Attack Used With New IE 0Day

Ephemeral, In-Memory Attack Used With New IE 0Day

It was just last week that we wrote about research from the security firm Triumfant that found evidence for the growing use of ephemeral “diskless” malware. That point was driven home over the weekend, with a report from the firm Fireeye that found a new Internet Explorer zero day vulnerability was being used in conjunction with a disk-less variant of the Hydraq (aka “McRAT”) Trojan horse program.   Fireeye first called attention to the existence of attacks exploiting new, “zero day” (or previously unknown) vulnerabilities in the Internet Explorer web browser on Friday. The company discovered the malicious activity on the web site of a “strategically important website” that was being used as a “watering hole” to attack visitors who were “interested in national and international security policy.” The company described two IE vulnerabilities: an information leakage hole and an IE out-of-bounds memory access vulnerability. The information leak affects Windows XP […]

Windows XP Users Six Times More Likely To Be Infected By Malware

Windows XP Users Six Times More Likely To Be Infected By Malware

Microsoft came out with a new edition of its Security Intelligence Report today, saying that company data shows that Windows XP machines are much more likely to be infected in encounters with malicious software on the Internet. Windows XP machines were six times more likely to be infected than machines running Windows 8, the latest version of Microsoft’s operating system, the company said. The Security Intelligence Report (or SIR) is a unique window into the malicious activity online, given Microsoft’s massive footprint of more than 1 billion systems running versions of the Windows operating system, and the detailed data it collects from them through its automatic update patching- and malware removal features. This is the 15th such report Microsoft has issued.  The company used the latest report to hammer home a message about the need for Windows XP users to move off that system to a newer version of the […]

Will this decade see the end of IT security as we know it? Gartner thinks so.

Gartner: Traditional IT Security Dead By End of Decade?

The analyst firm Gartner Inc. prides itself on its ability to identify emerging technology trends and talking up what’s next before it has even happened. The firm’s Hype Cycle maps the familiar path from promising new technology to ‘hot technology buzz word du jour,’ and (maybe) on to useful, less buzzy technology that’s actually being used. More important: the Gartner Magic Quadrant rates  technology companies (and their products) according to a set of criteria that includes how forward-looking (or “visionary”) the company is. Given the sway Gartner’s ratings have in companies’ willingness to invest in products, it’s a foregone conclusion that companies Gartner picks to ‘do well’ end up…umm…doing well. Gartner has an interest in finding the next big thing in every market – but also of preserving as much of the status quo as possible. (All those quadrants generate some serious cash!!) So I was interested to read about […]

Microsoft Tests Glass Competitor. But Do Wearables Threaten Privacy, Social Norms?

Microsoft Tests Glass Competitor. But Do Wearables Threaten Privacy, Social Norms?

Forbes has a really interesting article a couple of days back that posited the huge dislocations caused by wearable technology – including front-on challenges to social norms that are thousands of years in the making and contemporary notions of privacy. The applications for wearable technology like Google Glass are too numerous to mention. Just a few include “heads up” displays for surgeons in the operating room. Teachers (or their students) could benefit from having notes displayed in their field of vision, rather than having to resort to printed notes or the (dreaded) Powerpoint slide. But the devil is in the details of the wearable technology, Forbes argues. Unlike external devices – pagers, mobile phones, smart phones – wearable tech is more intimately connected to ourselves: in constant contact with our bodies and notifying us with vibrations and sounds in ways that it may be difficult to ignore, Forbes argues. Indelicately implemented, […]

Microsoft Bug Bounties Flowing To Googlers

Microsoft Bug Bounties Flowing To Googlers

Two Google employees earned the distinction of receiving some of the first monetary rewards (a.k.a. “bounties”) issued under the company’s newly minted bounty program. Fermín Serna, a researcher in Google’s Mountain View, California headquarters, told The Security Ledger that he received a bounty issued by Microsoft this week for information on an Internet Explorer information leak that could allow a malicious hacker to bypass Microsoft’s Address Space Layout Randomization (or ASLR) technology. His bounty followed the first ever (officially) paid to a researcher by Microsoft: a bounty that went to Serna’s colleague, Ivan Fratic, a Google engineer based in Zurich, Switzerland, for information about a vulnerability in Internet Explorer 11 Preview. Fratic (@ifsecure) acknowledged the honor in a July 11 post on his Twitter account. In an e-mail exchange with The Security Ledger, Serna declined to discuss the details of his discovery until Microsoft had a patch ready to release. But […]