attack Archives

Winsage

April 23, 2025

Critical Flaw in Windows Update Stack Enables Code Execution and Privilege Escalation

A newly identified vulnerability in the Windows Update Stack, designated as CVE-2025-21204, allows attackers to execute arbitrary code and escalate privileges to SYSTEM level on affected machines. This critical security flaw arises from improper privilege separation and inadequate validation during the update orchestration process. Attackers can exploit it by creating harmful update packages or acting as man-in-the-middle on compromised networks. The vulnerability impacts any Windows system utilizing the vulnerable update mechanism, affecting both enterprise and consumer editions. Microsoft is working on a patch, and users are advised to monitor official channels for updates and apply patches promptly. Organizations should also restrict network access to update servers and monitor for suspicious update activities. The CVSS score for this vulnerability is 7.8 (High), indicating significant risk.

Tech Optimizer

April 22, 2025

VIPRE Security Crushes Competition with 99.93% Protection Rate in Latest Test

VIPRE® Advanced Security received the Advanced+ distinction from AV-Comparatives in their March 2025 Malware Protection Test, demonstrating strong capabilities against cyber threats. The test evaluated 19 security products using 10,030 malware samples and included both online and offline scenarios. VIPRE achieved a 98.7% detection rate and a 99.93% overall protection rate during execution testing, with one of the lowest false positive counts among the products tested. VIPRE's security solutions also enhance other Ziff Davis consumer security products, utilizing its threat intelligence cloud to block malicious sites and improve overall protection.

Winsage

April 22, 2025

Critical Windows Update Stack Vulnerability Allows Code Execution & Privilege Escalation

A security vulnerability identified as CVE-2025-21204 has been discovered in the Windows Update Stack, allowing local attackers to execute unauthorized code and escalate privileges to SYSTEM-level access. This vulnerability, with a CVSS score of 7.8 (High), affects Windows 10 versions 1507, 1607, and 1809, among likely other supported Windows 10/11 and Windows Server versions. The flaw arises from a design issue where Windows Update processes do not properly follow directory junctions, enabling attackers with limited user privileges to redirect trusted paths to locations containing malicious code. Microsoft has introduced a mitigation strategy in its April 2025 cumulative update, which includes creating a new folder at the root of system drives and implementing detection rules for suspicious junction creations. Organizations are advised to apply the April 2025 security updates, restrict ACLs on specific directories, prevent symbolic link creation, and monitor file creation activities in certain directories.

Tech Optimizer

April 22, 2025

VIPRE Security Crushes Competition with 99.93% Protection Rate in Latest Test

VIPRE® Advanced Security received the Advanced+ distinction from AV-Comparatives in their March 2025 Malware Protection Test for its exceptional performance in detecting and preventing malware threats. The test evaluated 19 security products using 10,030 malware samples on a Windows 11 system, focusing on both online and offline threats. VIPRE achieved a 98.7% detection rate in all scenarios, a 99.93% overall protection rate during execution testing, and had one of the lowest false positive counts. VIPRE's security features also enhance other Ziff Davis products, utilizing its threat intelligence cloud to improve protection across various platforms. VIPRE is a subsidiary of Ziff Davis, Inc., and has over 25 years of experience in cybersecurity solutions.

Winsage

April 19, 2025

Windows vulnerability with NTLM hash abuse exploited for phishing

A vulnerability in Windows, identified as CVE-2025-24054, is being exploited in phishing campaigns targeting government and private organizations. Initially considered low-risk, it was addressed in Microsoft's March 2025 Patch Tuesday updates. Following the release of these patches, Check Point observed a rise in exploitation attempts, particularly linked to the Russian group APT28. Attackers sent phishing emails with Dropbox links containing .library-ms files, which, when accessed, connected to an external SMB server controlled by the attackers, allowing interception of NTLM hashes. A subsequent wave of attacks involved .library-ms files sent as direct attachments, requiring minimal user interaction to exploit the vulnerability. The malicious ZIP archive also contained files exploiting older NTLM vulnerabilities. Check Point identified the attackers' SMB servers with specific IP addresses. Despite being classified as medium-severity, the vulnerability's potential impact is significant, prompting organizations to apply the March 2025 updates and consider disabling NTLM authentication if not essential.

Winsage

April 18, 2025

Your Windows 10 PC isn’t dead yet – this OS from Google can revive it

On October 14, 2025, Windows 10 will reach its end of life, affecting users with older PCs that cannot upgrade to Windows 11. ChromeOS Flex is a free operating system by Google designed to modernize older Windows PCs and Macs, offering a fast and secure alternative built on Chromium OS. It does not support standalone Windows applications but allows access to Microsoft 365 and other SaaS applications via web portals. ChromeOS Flex focuses on security with features like automatic updates and data encryption, and it has never experienced a reported ransomware attack. The minimum system requirements include an Intel or AMD x86-64-bit compatible device, 4 GB of RAM, 16 GB of internal storage, and the ability to boot from a USB drive. To install ChromeOS Flex, users must back up their files, create a USB installation drive using the Chromebook Recovery Utility, and boot from the USB drive to test compatibility before proceeding with a full installation.

AppWizard

April 18, 2025

Perplexity’s Android App Is Infested With Security Flaws, Report Finds

Perplexity has launched a promotional campaign called “Ask like a millionaire,” offering a million-dollar prize to users who download its app, refer friends, and engage with it during the Super Bowl. However, the Android app is facing scrutiny due to significant security vulnerabilities, including issues that could lead to data theft and account takeovers. A report from Appknox reveals that the app's API can be accessed without restriction, and the code contains hardcoded secrets, making it easy for attackers to create counterfeit versions of the app. The app is also vulnerable to task hijacking, which could allow unauthorized access to sensitive data. Perplexity, founded in 2022, has raised 0 million in venture capital and has over 10 million downloads. The company is exploring partnerships with smartphone manufacturers and has faced criticism for alleged copyright infringement. Security experts advise users to consider removing the app until the issues are resolved.

TrendTechie

April 18, 2025

Прекратил работу главный торрент-трекер России. Причины неизвестны. Опрос

As of 11:00 PM on April 15, 2025, Rutracker has resumed operations after a significant outage that began around 5:00 PM Moscow time the same day. Users from major Russian cities reported difficulties accessing the site, which has been permanently blocked in Russia since 2016. During the outage, users encountered a "Web Server Down" message due to a 521 error from Cloudflare, indicating a connection termination. The access issues appeared to affect only Russian users, as individuals in Italy and Kazakhstan could still access Rutracker. This incident marks the third occurrence in six months raising concerns about the future of popular web resources among Russians. Rutracker had previously announced its own anti-Russian sanctions in March 2022 but continued to be accessible to Russian users until this outage. In January 2023, Rutracker experienced another outage lasting nearly a full day. The recent issues have been attributed to hosting problems, although some users reported no access issues during that time.

AppWizard

April 18, 2025

Rhode Island ‘Minecraft’ Moviegoers Slashed By Kids With Knives

Four male teenagers, aged 14 to 16, have been charged following a violent altercation outside Apple Cinemas in Warwick, Rhode Island, on April 15. The incident began when the teenagers became agitated during a screening of A Minecraft Movie and followed three adults to their vehicle, where they attacked them with knives, resulting in two adults being slashed. The injuries were not life-threatening. The suspects were apprehended by police, and the weapons used were recovered. The teenagers are in custody at the Rhode Island State Training School, awaiting a Family Court appearance. One victim suffered a laceration to the triceps, and another had a cut to the forehead.

Winsage

April 17, 2025

Hackers Exploiting NTLM Spoofing Vulnerability in Wild to Compromise Systems

Cybercriminals are exploiting a vulnerability in Windows systems known as CVE-2025-24054, which involves NTLM hash disclosure through spoofing techniques. This flaw allows attackers to leak NTLM hashes, leading to privilege escalation and lateral movement within networks. It is triggered when a user extracts a ZIP archive containing a malicious .library-ms file, causing Windows Explorer to initiate SMB authentication requests that expose NTLMv2-SSP hashes. Exploitation of this vulnerability began shortly after a security patch was released on March 11, 2025, with campaigns targeting government and private institutions in Poland and Romania. These campaigns utilized spear-phishing emails containing malicious ZIP archives, which, when interacted with, leaked NTLM hashes. The malicious files included various types designed to initiate SMB connections to attacker-controlled servers, allowing for pass-the-hash attacks and privilege escalation. The stolen hashes were sent to servers in several countries, indicating potential links to state-sponsored groups. One campaign involved Dropbox links that exploited the vulnerability upon user interaction. Microsoft has recommended immediate patching, enhancing network defenses, user education, network segmentation, and regular security audits to mitigate risks associated with this vulnerability.