The latest vulnerabilities in the network stack

[Susan Bradley]

PATCH WATCH The latest vulnerabilities in the network stack By Susan Bradley Focusing on business risk For this week’s security focus, I’m going to ho
[See the full post at: The latest vulnerabilities in the network stack]

Susan Bradley Patch Lady

4 users thanked author for this post.

AlexEiffel, deuce120, abbodi86, Fred

Reply | Quote

[AlexEiffel]

Thank you Susan.

This is exactly what I am looking for in your security articles. Put the risk in perspective and determine to which risk category it belongs.

I too share the same philosophy vs denial of services.

Depending on the context, what is most important to me is the real world risk of remote unauthenticated privilege escalation.

I can sleep well with a denial of service risk for many scenarios.

The PsExec issue is concerning. Thank you for bringing that to our attention.

Reply | Quote

[Susan Bradley]

Keep in mind that while priv escalation is a given once they are inside, we have moved away from the OH MY WORD WE NEED TO PATCH NOW era of the Code Red/Nimda.  They have to wiggle in first – get in via phishing.  We’re still quite “squishy” inside, we’re getting better protecting the outside.

Susan Bradley Patch Lady

1 user thanked author for this post.

AlexEiffel

Reply | Quote

[Alex5723]

AlexEiffel wrote:

The PsExec issue is concerning

EpMe NSA hacking tool could hack into any Windows PC.

On Monday, the security firm Check Point revealed that it had discovered evidence that a Chinese group known as APT31, also known as Zirconium or Judgment Panda, had somehow gained access to and used a Windows-hacking tool known as EpMe created by the Equation Group, a security industry name for the highly sophisticated hackers widely understood to be a part of the NSA. According to Check Point, the Chinese group in 2014 built their own hacking tool from EpMe code that dated back to 2013. The Chinese hackers then used that tool, which Check Point has named “Jian” or “double-edged sword,” from 2015 until March 2017, when Microsoft patched the vulnerability it attacked. That would mean APT31 had access to the tool, a “privilege escalation” exploit that would allow a hacker who already had a foothold in a victim network to gain deeper access, long before the late 2016 and early 2017 Shadow Brokers leaks…

Reply | Quote

[Paul T]

2017? Seriously old news, as is the patch.

cheers, Paul

Reply | Quote

[Author]

Posts