Microsoft Printers Patch Exposed as Vulnerable

Ophtek, patches, printer vulnerability, Security, Security Threats, Updates, upgrade, , , , , , ,
01
Sep 2020

The importance of installing updates and patches should never be underestimated. However, did you know that even these are not 100% secure?

Microsoft knows a thing or two about computers, but this doesn’t mean they are immune from mistakes and flaws. Accordingly, they regularly release patches and updates to address any vulnerabilities in their software.  A recent investigation, though, has discovered that these updates aren’t quite the safeguard consumers would expect. And, when you consider the amount of applications that Microsoft bundle with their systems, this is a matter of major concern.

Given the number of patches you are prompted to install each and every week, it’s important to understand what has happened on this occasion.

A Vulnerable Patch

The initial vulnerability in question relates to a flaw which was discovered in Windows printing services. Your first thought may be that printers are far from a security risk, but this couldn’t be further from the truth. If a device or application has any form of access to your network then it needs strong defenses. And this is why Microsoft was keen to patch a vulnerability which offered hackers a route into PC networks through print spooler software. This patch was issued in May and Microsoft believed this was the end of the story. But this story was due to run a little longer.

Researchers discovered that the impact of this initial patch could be negated by simply bypassing it. By modifying .SHD files (better known as Shadow), the researchers were able to add them into the spooler folder. This particular type of folder allows commands to be sent between a PC and a printer. Usually this is the preserve of printing documents, but the modified Shadow files allowed the researchers to send all manner of commands. It’s a scenario which had the potential to give hackers full access to a network.

How Can You Defend Against Weak Patches?

The vulnerability in question is no longer in present in systems which have since been updated, but it paints a worrying picture for PC users. If you are unable to rely on patches to give you full protection then what hope do you have?

First of all, you must, no matter what, always install all security patches. They are a crucial aspect of security and are all programmed with an objective of preventing an attack. This printer spooler fiasco demonstrates they are not perfect, but the majority are capable of fulfilling their aims. Nonetheless, being overcautious with IT security is always a good idea. Therefore, make sure you follow these simple steps:

For more ways to secure and optimize your business technology, contact your local IT professionals.

Read More

Emotet: A Clever and Dangerous Brand of Malware

Emotet, malicious code, malware, Security, Security Threats, Trojans, , , , ,
11
Dec 2018

There’s no such thing as good malware, but some is certainly less trouble than others. And, when it comes to the Emotet malware, some are very dangerous.

First discovered in Europe in 2014, Emotet soon began to spread around the world and, before long, was infecting PCs in the US. Comprising several different functions and methods of attack, Emotet is a type of malware which has persisted in the digital landscape due to its constant evolution. Taking advantage of user errors and vulnerable systems, the hackers behind Emotet have managed to infect huge numbers of systems over the last four years. And it would appear that those who are coding Emotet are getting even cleverer.

Due to the severity of Emotet, and the lessons you can learn from it, I’m going to take you through the basics of Emotet.

What is Emotet?

Emotet is known as a banking Trojan due to the way it specializes in stealing user credentials including banking data as well as numerous other credentials. This is achieved by the injection of malicious code into infected computers which allows Emotet to transmit sensitive information.

As with numerous other brands of malware, Emotet delivers its payload through a combination of malicious URLs and infected attachments. Key to spreading the Emotet malware throughout a network is the way that Emotet takes advantage of the EternalBlue vulnerability, an exploit which affects unpatched versions of Windows XP through to Windows 7.

There is, however, more to Emotet than just stealing sensitive data. Adding another string to its bow, Emotet is also responsible for downloading other types of malware to infected PCs. These can include further banking Trojans such as TrickBot or modules as diverse as Outlook address book grabbers and spambots.

Why is Emotet So Clever?

The hackers behind Emotet are highly talented and this is why Emotet is so difficult to detect. Dedicated to their software, the hackers regularly update the code behind Emotet and this is then communicated to compromised systems. This change in Emotet’s DNA allows it, therefore, to remain undetected. Just as security experts believe they had identified the key signature of Emotet, they’re faced with a new variant which renders their work redundant.

New research has also revealed that Emotet’s Command and Control (C&C) server is split into two separate clusters. By designing their C&C server in this manner, the hackers can ensure that the source of Emotet is harder to track down. Additionally, this split of the C&C server allows Emotet to keep functioning if either of the clusters suffers a technical issue. For authorities, disabling this setup is highly difficult and underlines why Emotet has been so successful.

How Do You Protect Your PC from Emotet?

It’s important to protect your organization from malware at all times and variants such as Emotet are the perfect demonstration of why it’s crucial. So, if you want to maximize your defenses, make sure you follow these best practices:

For more ways to secure and optimize your business technology, contact your local IT professionals.

Read More