cybersecurity expert Archives

Winsage

April 30, 2025

A mysterious new Windows 11 folder appeared – and now there’s a new exploit

Windows 11 users encountered the "inetpub" folder after the April 2023 update (KB5055523), which is a crucial component for addressing the security vulnerability CVE-2025-21204. Microsoft stated that the folder should not be removed, as it helps manage Windows Update security vulnerabilities by preventing unauthorized control through symbolic links. However, cybersecurity expert Kevin Beaumont revealed that the same patch introduced a new vulnerability that could allow remote exploitation, prompting Microsoft to acknowledge this issue with a "Moderate" status and indicate that a fix is forthcoming. Users are advised to keep their systems updated and not delete the "inetpub" folder. If the folder is deleted, it can be restored by enabling Internet Information Services in the Control Panel.

Tech Optimizer

April 30, 2025

Avast Antivirus Vulnerability Let Attackers Escalate Privileges

A significant vulnerability, designated as CVE-2025-3500, has been identified in Avast Free Antivirus, allowing attackers to gain elevated system privileges and execute malicious code at the kernel level. The vulnerability has a high CVSS score of 8.8 and was publicly disclosed on April 24, 2025, shortly after a patch was implemented. It originates from inadequate validation of user-supplied data in the aswbidsdriver kernel driver, leading to an integer overflow prior to buffer allocation. Attackers must first execute low-privileged code on the target system to exploit this vulnerability. The flaw affects multiple versions of Avast Free Antivirus, specifically versions ranging from 20.1.2397 to 2016.11.1.2262. A fix was released in version 25.3.9983.922, and users are urged to update their software promptly. Security experts recommend enabling automatic updates and using standard user accounts for daily activities to mitigate risks.

Winsage

April 25, 2025

Windows “inetpub” security fix can be abused to block future updates

A recent Microsoft security update has created a new 'inetpub' folder in the root of the system drive, linked to a fix for a Windows Process Activation elevation of privilege vulnerability (CVE-2025-21204). This folder has appeared on systems without Internet Information Services (IIS) installed. Microsoft advises users not to delete the folder, as it enhances system protection. However, cybersecurity expert Kevin Beaumont has shown that the 'inetpub' folder can be manipulated by non-administrative users to create a junction that redirects to a Windows file, potentially obstructing future Windows updates and resulting in a 0x800F081F error code. Microsoft has classified this issue as "Medium" severity and has closed the case, indicating it may be addressed in future updates.

Winsage

April 11, 2025

Windows Recall Is Finally Rolling Out To Customers

Microsoft is rolling out its Windows Recall feature, which captures near-constant screenshots of user activity to allow natural language searches for content. Concerns have been raised by cybersecurity expert Kevin Beaumont, who warns that it could reverse cybersecurity progress by a decade. Users must opt-in and use Windows Hello for authentication to access their stored images, which can be paused at any time. Recall captures snapshots during various tasks and allows users to reopen applications or documents and perform actions directly from these snapshots. The rollout will occur gradually, and the tech community is monitoring its impact on cybersecurity.

AppWizard

March 26, 2025

How secure is signal? The messaging app used by Trump team to share war plans

Senior officials from the Trump administration accidentally shared sensitive military discussions on the encrypted messaging platform Signal, leading to calls from Democratic lawmakers for a congressional investigation. A journalist was mistakenly included in a group chat, giving him access to confidential conversations about military operations in Yemen. Signal is an open-source messaging platform known for its end-to-end encryption and prioritizes user privacy by retaining minimal data. User chats and contacts are stored locally on devices, and the app allows for automatic deletion of conversations. Signal operates independently of government servers and does not use governmental encryption methods. Cybersecurity expert Rocky Cole stated that the risk of discussing sensitive information on Signal is less about its security and more about the potential compromise of the mobile device itself.