iSecurity Social’s Post

Windows Remote Registry Client EoP Flaw Exposes Systems to Relay Attacks A critical elevation of privilege (EoP) vulnerability, identified as CVE-2024-43532, has been discovered in the Windows Remote Registry client. This vulnerability potentially allows attackers to relay NTLM authentication and gain unauthorized access to Windows systems. It carries a high CVSS score of 8.8 and affects all unpatched Windows versions. Akamai researcher Stiv Kupchik uncovered the vulnerability, which exploits a fallback mechanism in the WinReg client implementation. Stay connected to Aashay Gupta, CISM, GCP for content related to Cybersecurity.   #LinkedIn #Cybersecurity #Cloudsecurity #AWS #GoogleCloud #Trends #informationprotection #Cyberthreats #CEH #ethicalhacker #hacking #cloudsecurity #productmanagement #cybersecurity #appsec #devsecops

Windows Remote Registry Client EoP Flaw Exposes Systems to Relay Attacks A critical elevation of privilege (EoP) vulnerability, identified as CVE-2024-43532, has been discovered in the Windows Remote Registry client. This vulnerability potentially allows attackers to relay NTLM authentication and gain unauthorized access to Windows systems. It carries a high CVSS score of 8.8 and affects all unpatched Windows versions. Akamai researcher Stiv Kupchik uncovered the vulnerability, which exploits a fallback mechanism in the WinReg client implementation. Stay Connected to Sidharth Sharma, CPA, CISA, CISM, CFE, CDPSE for content related to Cyber Security. #CyberSecurity #JPMC #Technology #InfoSec #DataProtection #DataPrivacy #ThreatIntelligence #CyberThreats #NetworkSecurity #CyberDefense #SecurityAwareness #ITSecurity #SecuritySolutions #CyberResilience #DigitalSecurity #SecurityBestPractices #CyberRisk #SecurityOperations 

🎯A critical elevation of privilege (EoP) vulnerability, identified as CVE-2024-43532, has been discovered in the Windows Remote Registry client. This vulnerability potentially allows attackers to relay NTLM authentication and gain unauthorized access to Windows systems. It carries a high CVSS score of 8.8 and affects all unpatched Windows versions. Akamai researcher Stiv Kupchik uncovered the vulnerability, which exploits a fallback mechanism in the WinReg client implementation. 🔔 Stay connected for industry’s latest content – Follow Dr. Anil Lamba, CISSP #linkedin #teamamex #JPMorganChase #cybersecurity #technologycontrols #infosec #informationsecurity #GenAi #linkedintopvoices #cybersecurityawareness #innovation #techindustry #cyber #birminghamtech #cybersecurity #fintech #careerintech #handsworth #communitysupport #womenintech #technology #security #cloud #infosec #riskassessment #informationsecurity #auditmanagement #informationprotection #securityaudit #cyberrisks #cybersecurity #security #cloudsecurity #trends #grc #leadership #socialmedia #digitization #cyberrisk #education #Hacking #privacy #datasecurity #passwordmanagement #identitytheft #phishingemails #holidayseason #bankfraud #personalinformation #creditfraud

On December 10, 2024, #Microsoft disclosed a critical vulnerability in its Windows Remote Desktop Services, tracked as CVE-2024-49115. This security flaw allows attackers to execute remote code on affected systems, posing a severe threat to confidentiality, integrity, and availability. The vulnerability has been classified as critical, with a CVSS score of 8.1. #cybersecurity #windows #rdp #vulnerabilities #patched

Microsoft Windows Ntqueryinformationtoken Flaw Let Attackers Escalate Privileges: Microsoft has disclosed a critical vulnerability identified as CVE-2024-30088. With a CVSS score of 8.8, this flaw affects Microsoft Windows and allows local attackers to escalate their privileges on affected installations. CVE-2024-30088 -Vulnerability Details The vulnerability resides in the implementation of the NtQueryInformationToken function within Microsoft Windows. This function is responsible for querying information about a token, which is a critical component in the Windows […] The post Microsoft Windows Ntqueryinformationtoken Flaw Let Attackers Escalate Privileges appeared first on GBHackers on Security | #1 Globally Trusted Cyber Security News Platform.

🚨 Windows Security Alert: Critical Flaw in Remote Registry! 🛡️ A major Elevation of Privilege (EoP) vulnerability has been discovered in the Windows Remote Registry client. Here's what you need to know: ## Vulnerability Details • Identifier: CVE-2024-43532 • CVSS Score: 8.8 (Critical) • Impact: Enables NTLM authentication relay ## Exploitation Mechanism • Uses a fallback mechanism in the WinReg client • Exploits obsolete transport protocols • Allows interception of authentication metadata ## Potential Risks • Identity spoofing within a domain • Unauthorized access to critical systems • Creation of persistent administrator accounts ## Recommended Actions • Immediately apply the October 2024 patch • Strengthen network activity monitoring • Update authentication policies 🔍 This discovery underscores the crucial importance of proactive patch management and continuous vulnerability monitoring. #cybersecurity #cybersécurité #vulnerability #WindowsSecurity #VulnerabilityManagement #CyberThreat #InfoSec #PatchManagement #CyberRisk #ITSecurity #NTLMRelay #PrivilegeEscalation #CyberAttack For more technical details, visit: https://lnkd.in/eYwB2xEG

🚨 New Windows Update KB5046617 – Key Improvements for Security 🚨 Staying updated with critical patches and security fixes is essential for maintaining a secure network environment. Microsoft’s latest Windows Update KB5046617 (released for Windows 10 and Windows 11) brings some important changes, especially for those of us working in cybersecurity. Here’s a quick breakdown of what’s new in KB5046617: 🔐 Security Enhancements: Fix for RDP Vulnerabilities: The update addresses security flaws in Remote Desktop Protocol (RDP). As RDP is a common vector for attacks, this patch mitigates the risk of remote code execution vulnerabilities, improving the overall resilience of your network. Cumulative Security Fixes: This update includes a range of security fixes that protect against a variety of threats, from elevation of privilege to information disclosure issues. Ensuring that endpoint security remains intact across the organization is essential. ⚙️ Improved Stability: Windows Kernel Updates: The update includes stability improvements for the Windows kernel, addressing specific bugs that could lead to system crashes or performance degradation. This ensures that critical systems remain operational, even during high-traffic security events. 🛠️ Bug Fixes: Updates for File Explorer: If you've been noticing issues with File Explorer, this update resolves several bugs that affect its performance, ensuring smoother daily operations for SOC teams when managing log files or system data. Printer Compatibility Issues: Fixed issues related to printer connectivity and functionality, ensuring smoother operation of physical or virtual printing devices that might be critical in your workflow. What Does This Mean for SOC Analysts? RDP Security: With RDP being a frequent target for cybercriminals, it's essential that we stay vigilant. Regular patching and ensuring the RDP security settings are correctly configured is vital to protecting endpoints. System Stability: The improvements in system stability will directly impact the reliability of security tools, which often rely on stable, uninterrupted operations. Monitoring tools and SIEMs need to be consistently available for threat detection and response. Critical Patch Management: As always, keep your patch management processes in place. As a SOC analyst, implementing these updates across all systems ensures vulnerabilities are minimized, and the attack surface remains as small as possible.

Atlassian Sourcetree For Mac & Windows Flaw Let Attackers Execute Remote Code: A critical security vulnerability has been discovered in Atlassian’s popular version control client, Sourcetree, affecting both Mac and Windows versions. The flaw, identified as CVE-2024-21697, allows unauthenticated attackers to execute arbitrary code remotely, posing a significant risk to users. The vulnerability, which carries a high severity rating with a CVSS score of 8.8, was introduced […] The post Atlassian Sourcetree For Mac & Windows Flaw Let Attackers Execute Remote Code appeared first on Cyber Security News. #CyberSecurity #InfoSec

CrowdStrike Update Pushing Windows Machines Into a BSOD Loop Cyber Security News ® A recent update to the CrowdStrike Falcon sensor is causing major issues for Windows users worldwide. This update leads to blue screen of death (BSOD) loops and makes systems inoperable. # Possible Workarounds Boot Windows into Safe Mode or the Windows Recovery Environment Navigate to the C:\Windows\System32\drivers\CrowdStrike directory Locate the file matching “C-00000291*.sys”, and delete it. Boot the host normally.