permissions

Winsage
December 26, 2024
A new attack technique exploits Windows Defender Application Control (WDAC) to disable Endpoint Detection and Response (EDR) sensors on Windows systems. Attackers with administrative privileges can create and deploy custom WDAC policies that prevent EDR sensors from loading during system boot, leaving networks vulnerable. The attack involves three phases: crafting a malicious WDAC policy, rebooting the machine to enforce the policy, and disabling the EDR upon reboot. A proof-of-concept tool called "Krueger" has been developed for this purpose. Mitigation strategies include enforcing WDAC policies via Group Policy Objects (GPOs), applying the principle of least privilege, and implementing secure administrative practices.
Winsage
December 23, 2024
The Print Management Console is a utility in Windows 10 that allows desktop administrators to manage printer settings and configurations. It may be missing from some Windows 10 deployments, particularly in the Home edition and in installations from Windows 10 version 2004 onwards, where it became an optional feature. To check for its presence, users can run the command PrintManagement.msc. If absent, it can be installed using PowerShell with the command Get-WindowsCapability -Name "Print.Management.Console*" -Online | Add-WindowsCapability -Online or through the Windows GUI by navigating to Settings > System > Optional Features and adding it from there. The console is particularly useful for managing multiple printers, controlling access permissions, and monitoring print jobs.
AppWizard
December 23, 2024
McAfee's security team discovered a malicious app named "BMI CalculationVsn" in Amazon's Android Appstore, which pretended to be a health tracker but was capable of screen recording, password theft, and accessing private SMS messages. Following the report, Amazon removed the app from its platform, and users who downloaded it are advised to uninstall it immediately. McAfee recommends that Android users install reliable antivirus software, scrutinize permission requests before downloading apps, and monitor app behavior for unusual activity to enhance their security.
AppWizard
December 23, 2024
Exodus is an app that tracks data collection and app permissions for privacy-conscious users. Simple Keyboard is a minimalistic, customizable keyboard app that does not collect user data. Currencies provides real-time currency exchange rates without ads or tracking. Password Monitor checks for compromised passwords and offers security suggestions. Ente Auth is an offline authentication tool with end-to-end encryption and optional cloud backup. Seal is a download manager that supports various platforms and customizable options. Hacki is a client for Hacker News that allows voting, commenting, and saving articles. NetGuard is an open-source firewall app that enables users to manage internet access for specific applications without root access.
AppWizard
December 23, 2024
The Amazon App Store is hosting a potentially harmful app named BMICalculationVsn, marketed as a body mass index (BMI) calculator. Developed by PT Visionet Data Internasional, the app has been flagged as spyware by McAfee Labs, raising privacy concerns due to its requests for sensitive information such as passwords, payment details, and audio recordings. The app has thousands of installations and has been identified as a security threat since October 8, 2024. Users are advised to keep their Play Protect feature active to mitigate risks associated with third-party app stores.
AppWizard
December 20, 2024
Google Keep will transition to a system app in Android 16, as reported by Android Police. This change means it will be pre-installed on devices running Android 16 and cannot be removed through standard methods. The designation as a system app grants Google Keep enhanced privileges, allowing it to access features and data unavailable to third-party applications. Users may also see new functionalities, such as the ability to take notes directly from the lock screen, due to this transition.
AppWizard
December 19, 2024
A malicious Android spyware application named 'BMI CalculationVsn' was discovered on the Amazon Appstore, disguised as a health tool. Researchers at McAfee Labs identified the app, which was siphoning data from infected devices without users' knowledge, and alerted Amazon, leading to its removal. Users who installed the app must manually uninstall it and scan their devices for any remaining spyware. The app, published by 'PT Visionet Data Internasional,' initially appeared as a user-friendly BMI calculator but secretly activated a screen recording service and collected sensitive information, including SMS messages and one-time passwords. The app first appeared on October 8 and underwent modifications throughout the month. This incident highlights vulnerabilities in app stores and emphasizes the need for users to be cautious when downloading applications and to review app permissions carefully. Keeping Google Play Protect activated is recommended for enhanced security.
Search