As part of its monthly Update Tuesday , Microsoft announced Vulnerability-related.PatchVulnerability this week that they ’ ve released Vulnerability-related.PatchVulnerability a preliminary fix for a vulnerability rated important , and present in Vulnerability-related.DiscoverVulnerability all supported versions of Windows in circulation ( basically any client or server version of Windows from 2008 onward ) . The flaw affects Vulnerability-related.DiscoverVulnerability the Credential Security Support Provider ( CredSSP ) protocol , which is used in all instances of Windows ’ Remote Desktop Protocol ( RDP ) and Remote Management ( WinRM ) . The vulnerability , CVE-2018-0886 , could allow remote code execution via a physical or wifi-based Man-in-the-Middle attack , where the attacker steals Attack.Databreach session data , including local user credentials , during the CredSSP authentication process . Although Microsoft says Vulnerability-related.DiscoverVulnerability the bug has not yet been exploited Vulnerability-related.DiscoverVulnerability , it could cause serious damage if left unpatched . RDP is widely used in enterprise environments and an attacker who successfully exploits Vulnerability-related.DiscoverVulnerability this bug could use it to gain a foothold from which to pivot and escalate . It ’ s also popular with small businesses who outsource their IT administration and , needless to say , an attacker with an admin account has all the aces . Security researchers at Preempt say Vulnerability-related.DiscoverVulnerability they discovered and disclosed Vulnerability-related.DiscoverVulnerability this vulnerability to Microsoft last August , and Microsoft has been working since then to create Vulnerability-related.PatchVulnerability the patch released Vulnerability-related.PatchVulnerability this week . Now it ’ s out there , it ’ s a race against time to make sure you aren ’ t an easy target for an attacker who wants to try and kick the tires on this vulnerability . Obviously , patch as soon as possible and please follow Microsoft ’ s guidance carefully : Mitigation consists of installing the update on all eligible client and server operating systems and then using included Group Policy settings or registry-based equivalents to manage the setting options on the client and server computers . We recommend that administrators apply the policy and set it to “ Force updated clients ” or “ Mitigated ” on client and server computers as soon as possible . These changes will require a reboot of the affected systems . Pay close attention to Group Policy or registry settings pairs that result in “ Blocked ” interactions between clients and servers in the compatibility table later in this article . Both the “ Force updated clients ” and “ Mitigated ” settings prevent RDP clients from falling back to insecure versions of CredSSP . The “ Force updated clients ” setting will not allow services that use CredSSP to accept unpatched clients but “ Mitigated ” will .

A zero-day vulnerability present in Vulnerability-related.DiscoverVulnerability security cameras and surveillance equipment using Nuuo software is thought to impact Vulnerability-related.DiscoverVulnerability hundreds of thousands of devices worldwide . Researchers from cybersecurity firm Tenable disclosed Vulnerability-related.DiscoverVulnerability the bug , which has been assigned as CVE-2018-1149 . The vulnerability can not get much more serious , as it allows attackers to remotely execute code in the software , the researchers said in a security advisory on Monday . Nuuo , describing itself as a provider of `` trusted video management '' software , offers a range of video solutions for surveillance systems in industries including transport , banking , government , and residential areas . Dubbed `` Peekaboo , '' the zero-day stack buffer overflow vulnerability , when exploited Vulnerability-related.DiscoverVulnerability , allows threat actors to view and tamper with video surveillance recordings and feeds . It is also possible to use the bug to steal Attack.Databreach data including credentials , IP addresses , port usage , and the make & models of connected surveillance devices . Such a security vulnerability has wide-reaching , real-world consequences -- as criminals could compromise a surveillance camera feed , replace the footage with a static image , and raid a premises , for example . In addition , the bug could be used to fully disable cameras and surveillance products . Peekaboo specifically impacts Vulnerability-related.DiscoverVulnerability the NVRMini 2 NAS and network video recorder , which acts as a hub for connected surveillance products . When exploited , the product permitted access to the control management system ( CMS ) interface , which further exposes credentials of all connected video surveillance cameras connected to the storage system . Speaking to ZDNet , Gavin Millard , VP of threat intelligence at Tenable , said that organizations all over the world use Nuuo software , including in shopping centers , hospitals , banks , and public areas . However , therein lies the problem -- as the software is also white labeled to over 100 brands and 2,500 camera product lines . Tenable disclosed Vulnerability-related.DiscoverVulnerability the zero-day vulnerability to Nuuo . A patch has not been released Vulnerability-related.PatchVulnerability , but Nuuo is currently developing Vulnerability-related.PatchVulnerability a fix for deployment . A plugin has also been released Vulnerability-related.PatchVulnerability by Tenable for organizations to assess whether or not they are vulnerable Vulnerability-related.DiscoverVulnerability to Peekaboo . ZDNet has reached out to Nuuo and will update if we hear back .

Ransomware scammers have been exploiting a flaw in Apple 's Mobile Safari browser in a campaign to extort fees Attack.Ransom from uninformed users . The scammers particularly target those who viewed porn or other controversial content . Apple patched Vulnerability-related.PatchVulnerability the vulnerability on Monday with the release Vulnerability-related.PatchVulnerability of iOS version 10.3 . The flaw involved the way that Safari displayed JavaScript pop-up windows . In fact , recovering from the pop-up loop was as easy as going into the device settings and clearing the browser cache . This simple fix was possibly lost on some uninformed targets who were too uncomfortable to ask for outside help . `` The attackers effectively used fear as a factor to get what they wanted before the victim realized that there was little actual risk , '' Lookout researchers Andrew Blaich and Jeremy Richards wrote in Monday 's post . The user provided the screenshot shown above , which attempts to instill fear with the claim the device was being locked `` for illegal pornography . '' Below those words was a pop-up Window that said `` Can not Open Page . '' Each time the person clicked on the accompanying OK button , a new window would open again . The JavaScript used in the attack shows signs of being used to exploit the same Safari flaw present in Vulnerability-related.DiscoverVulnerability iOS version 8 , which was released in 2014 . The attackers , the Lookout researchers said , purchased a large number of domains in an attempt to `` catch users that are seeking controversial content on the internet and coerce them into paying a ransom Attack.Ransom to them . '' Sites tailored the messages they delivered based on country identifiers . The campaign in many respects resembles one that hit Attack.Ransom Android users in 2014 . That one demanded Attack.Ransom a $ 300 ransom paid Attack.Ransom in the form of mechanisms such as Paysafecard or uKash

Researchers from several German universities have checked the PHP codebases of over 64,000 projects on GitHub , and found Vulnerability-related.DiscoverVulnerability 117 vulnerabilities that they believe have been introduced through the use of code from popular but insufficiently reviewed tutorials . The researchers identified popular tutorials by inputing search terms such as “ mysql tutorial ” , “ php search form ” , “ javascript echo user input ” , etc . into Google Search . The first five results for each query were then manually reviewed and evaluated for SQLi and XSS vulnerabilities by following OWASP ’ s guidelines ( Reviewing Code for SQL Injection , Cross Site Scripting Prevention Cheat Sheat ) . This resulted in the discovery Vulnerability-related.DiscoverVulnerability of 9 tutorials containing vulnerable code ( 6 with SQLi , 3 with XSS ) . Based on these , they created two types of queries that they used against the aforementioned data set obtained from GitHub . “ We use strict queries to identify known vulnerable patterns in web applications , and normal queries to identify code analogues of tutorial code , ” they explained . The results were , finally , manually reviewed by the researchers . “ Thanks to our framework , we have uncovered Vulnerability-related.DiscoverVulnerability over 100 vulnerabilities in web application code that bear a strong resemblance to vulnerable code patterns found Vulnerability-related.DiscoverVulnerability in popular tutorials . More alarmingly , we have confirmed Vulnerability-related.DiscoverVulnerability that 8 instances of a SQLi vulnerability present in Vulnerability-related.DiscoverVulnerability different web applications are an outcome of code copied from a single vulnerable tutorial , ” they noted . “ Our results indicate Vulnerability-related.DiscoverVulnerability that there is a substantial , if not causal , link between insecure tutorials and web application vulnerabilities. ” “ [ Our findings ] suggest that there is a pressing need for code audit of widely consumed tutorials , perhaps with as much rigor as for production code , ” they pointed out . In their research , they evaluated only PHP application code , but their approach can be easily used to evaluate codebases in other programming languages , especially because they have made available their crawler ( GithubSpider ) and code analogue detector ( CADetector ) tools . Unfortunately , such a search can be easily replicated – “ even with limited resources such as a standard PC and a broadband DSL connection ” – by individuals or groups intent of discovering Vulnerability-related.DiscoverVulnerability vulnerabilities in software for future exploitation .

Valentine ’ s Day is fast-approaching and the story goes that if Cupid hits you with his golden arrow you ’ ll fall madly in love . But there are other actors taking aim at you on Valentine ’ s Day whose arrows you need to avoid as the outcomes aren ’ t nearly as desirable . Think back to early February 2016 , when many online florists experienced a surge in traffic that wasn ’ t due simply to a rush to buy flowers . Dozens of florists were hit Attack.Ransom by targeted DDoS attacks during their busiest time of the year , causing problems for some and knocking others offline who were asked to pay a ransom Attack.Ransom before they could resume operations . It ’ s fairly typical for bad actors to escalate extortion-based campaigns Attack.Ransom during seasonal events when the stakes for targets are high . Looking to profit with minimal investment , attackers exploit known vulnerabilities as they attempt to breach systems . For example , the 2016 Valentine ’ s Day DDoS attacks used Shellshock , a critical vulnerability that ’ s present in Vulnerability-related.DiscoverVulnerability Linux , UNIX and Mac OS X that had been discovered Vulnerability-related.DiscoverVulnerability more than a year earlier . Of course , online florists are not alone when it comes to being targeted by cyber criminals . Different times of the year and major news events can trigger a surge in attacks aimed at particular industries and geographies . Organisations need to understand their threat model and apply security processes as appropriate . Threat actors will continue to take advantage of events to launch attacks , but you can avoid their arrows this Valentine ’ s Day .