Alaa-Eddine Boubakri 🇨🇦’s Post

🚨 Windows Security Alert: Critical Flaw in Remote Registry! 🛡️ A major Elevation of Privilege (EoP) vulnerability has been discovered in the Windows Remote Registry client. Here's what you need to know: ## Vulnerability Details • Identifier: CVE-2024-43532 • CVSS Score: 8.8 (Critical) • Impact: Enables NTLM authentication relay ## Exploitation Mechanism • Uses a fallback mechanism in the WinReg client • Exploits obsolete transport protocols • Allows interception of authentication metadata ## Potential Risks • Identity spoofing within a domain • Unauthorized access to critical systems • Creation of persistent administrator accounts ## Recommended Actions • Immediately apply the October 2024 patch • Strengthen network activity monitoring • Update authentication policies 🔍 This discovery underscores the crucial importance of proactive patch management and continuous vulnerability monitoring. #cybersecurity #cybersécurité #vulnerability #WindowsSecurity #VulnerabilityManagement #CyberThreat #InfoSec #PatchManagement #CyberRisk #ITSecurity #NTLMRelay #PrivilegeEscalation #CyberAttack For more technical details, visit: https://lnkd.in/eYwB2xEG

CVE-2024-30078 is a critical security flaw in the Windows Wi-Fi driver that allows for remote code execution (RCE) by an unauthenticated attacker. This vulnerability affects all supported versions of the Windows operating system, including Windows 10, Windows 11, and various Windows Server editions. With a CVSS severity score of 8.8, this flaw poses a significant risk, particularly in environments where numerous devices are connected to Wi-Fi networks, such as offices, hotels, and trade shows. Immediate action is required to apply the available security patches to mitigate potential exploitation. Technical Details: The CVE-2024-30078 vulnerability exists in the Windows Wi-Fi driver and can be exploited by an attacker within proximity of the target system. The attacker can send specially crafted Wi-Fi packets to the target system, enabling remote code execution without any user interaction. This flaw allows the attacker to execute arbitrary code on the target system, potentially leading to further system compromise. Affected systems include: Windows 10 (versions 1507, 1607, 1809, 21H2, 22H2) Windows 11 (versions 21H2, 22H2, 23H2) Windows Server 2008, 2012, 2016, 2019, 2022 (including server core installations) Mitigations/Recommendations: 1- Apply Patches Immediately: Microsoft has released security updates to address this vulnerability. Users and administrators should apply these patches as soon as possible to all affected systems. The patches can be found in the Microsoft Security Update Guide. 2- Disable Wi-Fi Adapters Temporarily: As a temporary mitigation, if patching cannot be performed immediately, disable Wi-Fi adapters on critical systems that do not require Wi-Fi connectivity. 3- Network Segmentation: Implement network segmentation to limit the exposure of critical systems to potential attackers. Ensure that Wi-Fi networks are isolated from sensitive network segments. 4- Monitor Network Traffic: Utilize network monitoring tools to detect unusual Wi-Fi traffic that may indicate an attempt to exploit this vulnerability. Intrusion Detection Systems (IDS) and Intrusion Prevention Systems (IPS) should be updated to recognize attack patterns associated with CVE-2024-30078. 5- Educate Users: Inform users about the potential risks associated with this vulnerability, especially in environments with high Wi-Fi usage. Encourage users to report any suspicious activity or connectivity issues.

Windows Remote Registry Client EoP Flaw Exposes Systems to Relay Attacks A critical elevation of privilege (EoP) vulnerability, identified as CVE-2024-43532, has been discovered in the Windows Remote Registry client. This vulnerability potentially allows attackers to relay NTLM authentication and gain unauthorized access to Windows systems. It carries a high CVSS score of 8.8 and affects all unpatched Windows versions. Akamai researcher Stiv Kupchik uncovered the vulnerability, which exploits a fallback mechanism in the WinReg client implementation. Stay Connected to Sidharth Sharma, CPA, CISA, CISM, CFE, CDPSE for content related to Cyber Security. #CyberSecurity #JPMC #Technology #InfoSec #DataProtection #DataPrivacy #ThreatIntelligence #CyberThreats #NetworkSecurity #CyberDefense #SecurityAwareness #ITSecurity #SecuritySolutions #CyberResilience #DigitalSecurity #SecurityBestPractices #CyberRisk #SecurityOperations 

🎯A critical elevation of privilege (EoP) vulnerability, identified as CVE-2024-43532, has been discovered in the Windows Remote Registry client. This vulnerability potentially allows attackers to relay NTLM authentication and gain unauthorized access to Windows systems. It carries a high CVSS score of 8.8 and affects all unpatched Windows versions. Akamai researcher Stiv Kupchik uncovered the vulnerability, which exploits a fallback mechanism in the WinReg client implementation. 🔔 Stay connected for industry’s latest content – Follow Dr. Anil Lamba, CISSP #linkedin #teamamex #JPMorganChase #cybersecurity #technologycontrols #infosec #informationsecurity #GenAi #linkedintopvoices #cybersecurityawareness #innovation #techindustry #cyber #birminghamtech #cybersecurity #fintech #careerintech #handsworth #communitysupport #womenintech #technology #security #cloud #infosec #riskassessment #informationsecurity #auditmanagement #informationprotection #securityaudit #cyberrisks #cybersecurity #security #cloudsecurity #trends #grc #leadership #socialmedia #digitization #cyberrisk #education #Hacking #privacy #datasecurity #passwordmanagement #identitytheft #phishingemails #holidayseason #bankfraud #personalinformation #creditfraud

💡 What is Network Level Authentication? Network level authentication is used for authenticating Remote Desktop services, such as Windows RDP, and Remote Desktop Connection (RDP Client). You might also hear it called front authentication. 💡 What is Network Level Authentication (NLA) used for? Before you can start a remote desktop session, the user will need to authenticate themselves – ie,prove that they are who they say they are. Using network level authentication means that a false connection can’t be made, which would use up CPU and cause a strain on the resources of the network. This offers a level of security against some cyberattacks such as Denial of Service attacks, where multiple requests are made all at once towards a network, overwhelming its ability to cope. To combat this, you can turn on network level authentication to authenticate the user’s credentials before starting a remote access session. If the user’s credentials aren’t authenticated, then the connection is simply denied. https://lnkd.in/e_QaU8ER

🌐 CrowdStrike Issues Fix for BSOD Error Update In a recent development, CrowdStrike has issued a fix for an update that was causing Windows systems to enter a Blue Screen of Death (BSOD) loop. The issue, which began on July 19, 2024, affected Windows 10 and 11 systems running CrowdStrike’s endpoint security software. The problematic update led to repeated BSODs with the error message “DRIVER_OVERRAN_STACK_BUFFER,” preventing normal system boot and operation¹. The impact was particularly severe for enterprise customers, with some organizations reporting that thousands of devices, including critical production servers and SQL nodes, were affected. CrowdStrike has acknowledged the problem and their engineering teams are working to resolve the issue. The company advises affected users not to open individual support tickets now. IT departments are scrambling to mitigate the damage, with some resorting to removing CrowdStrike-related files from affected systems to restore functionality. This incident highlights the potential risks associated with automatic updates for security software, especially in enterprise environments. Many affected users are now calling for more rigorous testing procedures and the implementation of staged rollout policies to prevent similar incidents in the future. #CrowdStrike #SoftwareUpdate #ITOutage #Cybersecurity

Windows Remote Registry Client EoP Flaw Exposes Systems to Relay Attacks: A critical elevation of privilege (EoP) vulnerability, identified as CVE-2024-43532, has been discovered in the Windows Remote Registry client. This vulnerability potentially allows attackers to relay NTLM authentication and gain unauthorized access to Windows systems. It carries a high CVSS score of 8.8 and affects all unpatched Windows versions. Akamai researcher Stiv Kupchik uncovered the […] The post Windows Remote Registry Client EoP Flaw Exposes Systems to Relay Attacks appeared first on Cyber Security News. #CyberSecurity #InfoSec

Windows Remote Registry Client EoP Flaw Exposes Systems to Relay Attacks A critical elevation of privilege (EoP) vulnerability, identified as CVE-2024-43532, has been discovered in the Windows Remote Registry client. This vulnerability potentially allows attackers to relay NTLM authentication and gain unauthorized access to Windows systems. It carries a high CVSS score of 8.8 and affects all unpatched Windows versions. Akamai researcher Stiv Kupchik uncovered the vulnerability, which exploits a fallback mechanism in the WinReg client implementation. Stay connected to Aashay Gupta, CISM, GCP for content related to Cybersecurity.   #LinkedIn #Cybersecurity #Cloudsecurity #AWS #GoogleCloud #Trends #informationprotection #Cyberthreats #CEH #ethicalhacker #hacking #cloudsecurity #productmanagement #cybersecurity #appsec #devsecops

🔒 Important Security Update: OPA for Windows Vulnerability Exposes NTLM Hashes 🔒 (source: https://lnkd.in/dgCqx8Na) I want to bring attention to a critical vulnerability recently identified in Open Policy Agent (OPA) for Windows, designated as CVE-2024-8260. This vulnerability affects all versions prior to v0.68.0 and poses significant risks for organizations utilizing this open-source policy enforcement engine. Researchers at Tenable discovered that improper input validation allows attackers to exploit OPA by tricking it into accessing a malicious Server Message Block (SMB) share. This can lead to the leakage of Net-NTLMv2 hashes, effectively exposing user credentials of the currently logged-in Windows device. The implications are severe: unauthorized access, credential leaks, and potential lateral movement within networks. As many organizations rely on OPA for enforcing authorization and resource access policies across their software stacks—including cloud-native applications, microservices, and APIs—this vulnerability serves as a stark reminder of the risks associated with open-source software. Immediate Action Required: Organizations using OPA for Windows should upgrade to version v0.68.0 or later to mitigate this vulnerability. Understanding Open Source Risks: A recent report by Black Duck highlighted that 84% of codebases contain security vulnerabilities, emphasizing the importance of vigilance when integrating open-source components. Collaboration is Key: As Ari Eitan from Tenable stated, it’s crucial for security and engineering teams to work together to address these risks and ensure the integrity of our systems. Let’s prioritize security and stay informed about the tools we use. For more details, I encourage everyone to read the full report from Tenable and assess your organization's exposure to this vulnerability. #CyberSecurity #OpenSource #VulnerabilityManagement #OPA #NTLM #CVE2024 #SecurityAwareness

Blue Screen of Death Redux: CrowdStrike Update Triggers Widespread Windows Crashes (For Cybersecurity Professionals) A recent incident involving a faulty CrowdStrike Falcon Sensor update caused a global Blue Screen of Death (BSOD) outbreak for Windows users on July 18th, 2024. This event highlights the potential vulnerabilities introduced by third-party security software integrations. Incident Breakdown: 👉 Cause: A faulty update from CrowdStrike Falcon Sensor, a widely used endpoint protection solution, triggered a critical system error in Windows environments. 👉 Impact: The BSOD resulted in unexpected system shutdowns, impacting businesses, consumers, and critical infrastructure globally. 👉 Resolution: CrowdStrike identified and addressed the issue. Microsoft advised users to restore their Windows systems to a point before the update or utilize alternative rollback mechanisms. Security Considerations: 👉 Third-Party Integration Risks: This incident underscores the importance of rigorous testing and compatibility checks for third-party security software integrations, especially those operating at a kernel level. 👉 Endpoint Security Management: Organizations should have robust endpoint security management (ESM) protocols in place to monitor for unexpected behavior and potential conflicts between security tools and the operating system. 👉 Patching and Update Procedures: Standardized patching and update procedures, including thorough testing before deployment, are crucial to mitigate risks associated with third-party software updates. Recommendations: 👉 Security Teams: Engage with CrowdStrike for further details and potential mitigation strategies. 👉 IT Teams: Review endpoint security configurations and consider implementing additional monitoring for potential conflicts. 👉 Security Professionals: Share this incident as a learning experience within your organization to emphasize the importance of robust third-party software integration processes. Additional Resources: 👉 Microsoft Support: Resolving Blue Screen errors in Windows: https://lnkd.in/dWNMpyZa 👉 CrowdStrike Falcon Sensor: https://lnkd.in/dH8yP-4P 💪 Stay vigilant! By understanding the cause of this incident and taking appropriate precautions, we can minimize the impact of similar events in the future. Let's work together to ensure a more secure environment for all users. #CyberSecurity #InfoSec #SecurityAwareness #EndpointSecurity #IncidentResponse #SecurityManagement #DigitalForensics #VulnerabilityManagement #ThreatIntelligence #BlueScreenofDeath #BSOD #CrowdStrike #WindowsPatching #ThirdPartyIntegration #SecuritySoftwareUpdate #CybersecurityIncident #SystemCrash #WindowsSecurity