NewApp Digest
search bot

breach

Beyond antivirus: Other essential tools to protect your Mac
Tech Optimizer
October 31, 2024

Beyond antivirus: Other essential tools to protect your Mac

Macs are facing an increasing number of cybersecurity threats, with malware targeting macOS rising from eight families in 2021 to 21 in 2023. To protect against these threats, users are advised to implement antivirus software, maintain regular backups using tools like Apple's Time Machine and cloud services, enable the built-in firewall, use password managers for secure password storage, and utilize a VPN for secure internet connections, especially on public Wi-Fi.
Arm and Qualcomm are fighting–what does that mean for Windows on Arm?
Winsage
October 30, 2024

Arm and Qualcomm are fighting–what does that mean for Windows on Arm?

Qualcomm is currently engaged in a legal battle with Arm, which has issued a 60-day ultimatum threatening to revoke Qualcomm's license to its technology before a court date in December. This conflict stems from Arm's lawsuit initiated in 2022 over Qualcomm's acquisition of Nuvia and involves financial disagreements over licensing fees. Qualcomm generates approximately billion annually from using Arm's technology, and its potential loss of access could disrupt various manufacturers reliant on its chips, including major players like Microsoft and Android manufacturers. Arm accounted for about 10% of its total revenue from Qualcomm last fiscal year, indicating a mutual dependence between the two companies. The outcome of this dispute could have significant implications for the broader technology sector.
Comparing Antivirus Software 2025: Avast vs. AVG
Tech Optimizer
October 29, 2024

Comparing Antivirus Software 2025: Avast vs. AVG

Avast and AVG are antivirus software products developed by Avast Software s.r.o. Both platforms have similar pricing structures, with Avast priced at .99 per year for the first year and .99 for subsequent years, while AVG is priced at .88 for the first year and .99 for subsequent years. They support Windows, MacOS, and Android, and can protect up to 10 devices. Both offer a firewall and have a malware detection rate of 100% according to AV-Test.org's August 2024 Windows test. Avast has an overall rating of 2.5/5, with specific ratings of 2/5 for pricing, 5/5 for core features, 3/5 for advanced features, 2/5 for customer support, 4/5 for impact on device performance, and 0/5 for trustworthiness. AVG shares the same overall rating and similar scores in the same categories. Both platforms have a history of monetizing user data, with Avast facing an FTC order in 2024 and a .5 million fine for data practices. Neither platform offers antivirus solutions for iOS. Alternatives to consider include Microsoft Defender and Malwarebytes, which provide competitive features and pricing.
Windows Update takeover lets an attacker revive a patched flaw
Winsage
October 28, 2024

Windows Update takeover lets an attacker revive a patched flaw

Microsoft's approach to security vulnerabilities has been criticized for not classifying scenarios where an attacker with administrative privileges can execute kernel-level code as critical vulnerabilities. SafeBreach researchers highlighted that this narrow definition leaves systems vulnerable to custom rootkits that can bypass essential security controls. They identified CVE-2024-21302, a privilege escalation vulnerability affecting the Windows virtualization stack, and CVE-2024-38202, which allows attackers to exploit the Windows Update process to disable security features like Driver Signature Enforcement and virtualization-based security. Microsoft is actively developing mitigations for these vulnerabilities and has released a security update for CVE-2024-38202 on October 15, with further updates planned for CVE-2024-21302.
Windows kernel components can be installed to bypass defense systems
Winsage
October 28, 2024

Windows kernel components can be installed to bypass defense systems

Cybersecurity experts have discovered a method that allows cybercriminals to bypass Windows security features, specifically Driver Signature Enforcement (DSE), enabling the installation of rootkits on fully updated systems. Alon Leviev from SafeBreach reported that the exploit involves downgrading specific Windows kernel components, making Windows 11 devices particularly vulnerable. Despite notifying Microsoft, no fix has been implemented, as the company stated the vulnerability does not breach a “security boundary” since administrator access is required for exploitation. Leviev presented this vulnerability at the Black Hat and DEF CON 2024 conferences, introducing a tool called Windows Downdate that can reactivate previously patched vulnerabilities. He demonstrated downgrading components on Windows 11 to bypass DSE and install rootkits that disable security software. A key part of his attack involved replacing the ci.dll file with an unpatched version, which requires a system restart and disguises the action as a routine update. Leviev also showed methods to disable Virtualization-Based Security (VBS) by modifying settings and files. Microsoft is working on a solution to block outdated system files and prevent downgrade attacks, but the timeline for this fix is uncertain due to the need for thorough testing. Leviev advises organizations to remain vigilant against downgrade attacks until a resolution is available.
New Windows Driver Signature bypass allows kernel rootkit installs
Winsage
October 26, 2024

New Windows Driver Signature bypass allows kernel rootkit installs

SafeBreach security researcher Alon Leviev has identified a vulnerability in the Windows operating system that allows attackers to downgrade kernel components, bypassing security measures like Driver Signature Enforcement (DSE). This vulnerability enables the installation of rootkits on fully patched systems. Leviev demonstrated that attackers can manipulate the Windows Update process to introduce outdated components without altering the system's patched status. He introduced a tool called Windows Downdate, which allows the creation of custom downgrades, exposing updated systems to previously patched vulnerabilities. Leviev's method, named "ItsNotASecurityBoundary," exploits a flaw in the DSE, allowing unsigned kernel drivers to be loaded and facilitating the deployment of rootkit malware. Despite Microsoft addressing the privilege escalation aspect of this vulnerability, it does not protect against downgrade attacks. Leviev's research shows that attackers can replace the 'ci.dll' file responsible for enforcing DSE with an unpatched version during the Windows Update process, thereby circumventing protections. He also discussed methods to disable Microsoft's Virtualization-based Security (VBS), which is designed to protect critical resources, by modifying registry keys. Leviev emphasizes the need for endpoint security tools to monitor downgrade procedures to mitigate these risks.
Search