Business

Microsoft Patches Windows Vulnerabilities Including (CVE-2018-8611) Kernel Transaction Manager Allowing Elevated Privilege

Xenu

Microsoft released several year-end December, security updates to patch a total of 39 vulnerabilities in its Windows operating systems and applications—10 of which they rated as critical including (CVE-2018-8611.)

The flaw affects almost all versions of Windows operating system—Windows 7 through Server 2019.

The exploit originally discovered and reported by security researchers at Kaspersky, allows for a zero-day attack exploitation of elevation of privilege (EoP) bug in the Windows Kernel (ntoskrnl.exe.) Exploiting the Windows Kernel could then allow malicious programs to execute their own subjective code with higher privileges on any targeted vulnerable systems.

“This vulnerability successfully bypasses modern process mitigation policies, such as Win32k System call Filtering that is used, among others, in the Microsoft Edge Sandbox and the Win32k Lockdown Policy employed in the Google Chrome Sandbox,” Kaspersky said.

“Combined with a compromised renderer process, for example, this vulnerability can lead to a full Remote Command Execution exploit chain in the latest state-of-the-art web-browsers.”

Another important publicly known vulnerability known as CVE-2018-8517, which is a denial-of-service bug in web applications was also fixed in the update.

“The vulnerability can be exploited remotely, without authentication. A remote unauthenticated attacker could exploit this vulnerability by issuing specially crafted requests to the .NET Framework application,” Microsoft explains.

Microsoft also patched 10 critical and 29 important vulnerabilities affecting a range of its products, including — Windows, Edge, Internet Explorer, ChackraCore, Office,  Microsoft Office Services and Web Apps, and the .NET Framework responsible for a number of applications.

Users and system administrators alike are strongly recommended to apply the latest security patches as prompted to update, to not risk becoming a slave for a hacker’s botnet. Unless of course, you want to opt for being a target of a hacker or group of hackers.

Then by all means, please keep your system software outdated with these vulnerabilities present including the Kernal bug. Which hackers are going to have a field day with that bug present, just remember you the reader are responsible for all your actions with this information and this is just security education.

For installing the latest security patch updates, go to Settings → Update and Security → Windows Update → then Check for updates, on your computer system or you can install the updates manually.

 

How will our lives change when we lose net neutrality?

Hack News

Net neutrality helps to balance the internet in such a way that internet service providers can’t use the laws to their benefits. This year (2017), a repeal against net neutrality is to be decided upon by the FCC in the United States. The United States is a country where the internet service providers are mostly monopolies created by the government. Therefore, the government, which controls the internet, will be biased in favour of these big businesses. And these businesses, owned by wealthy businessmen, will want to take advantage from removing such regulations and safeguards.

Despite the fact that the FCC in the United States is asking for net neutrality to be gone, the aftermath effects the whole world. The supporters of the repeal against net neutrality spread a list of countries which lack net neutrality in their law, trying to convince the public that even without net neutrality, such countries are doing great in regards to free and cheap internet use.

However, these European countries they keep listing never had a bandwidth or network issue, due to their strong enough internet infrastructure. The United States internet infrastructure, on the contrary, has been like a cheddar cheese. It is exploited by the ISPs to such a degree that the US can’t meet the quotas anymore, since they oversold the lines. Even the public funding that was used by such ISPs on public lands was never returned by these big business owners. Subscriptions were also oversold and all profits went to these companies. All ISPs laid the internet infrastructure with public funding on public land because they were allowed to. And nothing was ever paid back.

As a result, the internet infrastructure of the US was weakened, and will soon be handed over as private property to these ISPs, if they would be succesful at appealing the net neutrality law. This draconian overtake is expected to happen on 14 December 2017.

Without real competition among ISPs, the internet is nothing more than a heavily regulated tool of the elite and the people in power, for controlling news and discourse. Isn’t that what happened with your TV channels as well? Being subjected to the controlling mechanisms of the government, it is now hard to find informative and neutral news or programs and even while more TV channels become available, the price is also increasing and the quality is dropping.

When net neutrality is absent, it is ofcourse unlikely carriers would block entire services from being accessed by their customers because it will harm their business. However, they can use bandwidth throttling, since they will aim to force the users to select the carrier’s preferred alternative, to earn more on the packages they will be selling. If smaller companies wanted a better deal, ISPs like Comcast would ask for fees in exchange for such services.

Such deals will make the services small companies are selling to their customers more expensive, while paying for internet use as one fixed price package will be a thing from the past. Monopolized by the government, ISPs will be able to ask whatever price they want from site owners. Those not able to meet the demands, will see their sites slow down to a degree they can’t reach their followers anymore. In this case, both users and the site owners would have to pay for the services. Users for the internet access, and site owners to make sure the ISPs will not be not slowing down their website speed or the speed at which their videos stream.

In addition, customers will be accessing features like social media through service providers. Such redirected routes will make the internet experience for users complicated, even slower and more expensive.

Bigger companies like Google and Netflix (as they had to pay for Comcast in the past), will be able to pay for the fees ISPs will demand. For small companies, like alternative news sites and personal bloggers (for example, activists), it will be much harder to afford such fees..

ISPs, as big businesses, already have been abusing the internet while working with the government, by functioning as a regulator. Now in the US it will be even easier to block social media and any site unpopular with the big businesses or government. While small companies and a lot of sites all over the world may disappear, the big corporations will control the internet, even growing bigger and now armed with an effective strategy of creating an everlasting monopoly.

Sources:

The inside story of how Netflix came to pay Comcast for internet traffic

https://www.wsj.com/articles/netflix-agrees-to-pay-comcast-to-improve-its-streaming-1393175346

http://viapopuli.com/what-is-net-neutrality-and-why-is-it-important-for-a-free-internet-simplified-version

https://arstechnica.com/tech-policy/2007/08/pearl-jam-censored-by-att-calls-for-a-neutral-net/

http://bsalert.com/news/853/Comcast_Caught_Filtering_Political_E-Mails.html

Is Bitcoin a curse or is it the future? And should you invest in it?

Hack News

Probably one of the most discussed subjects online in recent years is Bitcoin. What do we think of it, and is it smart to invest money in it?

Bitcoin created a shockwave through the financial world. Together with other crypto currencies it provided an alternative to the FIAT currency markets and created an entirely new economy. One that is global and does not care about the economic situations of the different countries around the world.

But what is it? In simple terms Bitcoin and other crypto currencies are blockchains. A chain that is comprised of all transactions that ever happened, an algorithm and a huge amount of code. Nothing very special to the common man, but to computer technicians it is probably one of the most impressive things that ever happened.

Should you put your money in it? Especially over the last year the value of a single Bitcoin has risen to thousands of dollars. If you invested in Bitcoin at the start, and you bought a serious amount, you are likely laughing right now, because you made those millions. You are officially a millionaire and you did not really have to work for it. But what is the real tangible value of it?

Really the blockchain is nothing more than digital code. The only thing that makes a difference is that there is a limited amount of coins available. You can mine the coins, but the total amount of Bitcoin is a pre defined number. For this reason, in a technical sense, it can only deflate. Meaning the value should become higher, always. The only thing that is needed for that is that it is used more. So as more stores start accepting it, the value will keep rising. As more miners arrive, and more buyers, the value will keep on increasing. Focu on hyping it, and collectively you are forcing the world to make you a millionare.

Both Bitcoin and the alternative coin Litecoin have now been embedded in to the CFD market. Respected internet brokers like Plus500 allow you to invest in it without actually buying the coins, you simply buy the CFD contracts on the market. Using just 500 bucks you can invest in up to 100.000 dollar worth of Bitcoin. It works with a leverage system. And when it grows you make a huge profit. Want to learn more? Just visit that website. Big business is doing it, so why wouldn’t you?

On the other hand, it is just digital code, and like FIAT currencies, there is not much difference there. It is not a real thing, like a house, or a golden ring. It exists in the digital world and nowhere else. No matter how sophisticated the system is, in a true sense, it is not much more than a number inserted in a digital database. Like credits on a Poker site, really. The big difference there is that the blockchain is managed by all its users, and is completely open. Meaning every single event that ever happened is visible In the blockchain. Every payment, every coin mined, yes, really all of it.

So there is a system that is owned by the users, not so much by a single entity. In the case of FIAT currencies, like the dollar or the euro, these are also just digital numbers. Everything is digitalized meaning banks can simply change the number in the database and you are dependent on what happens next. There are the financial watchdogs who make sure there is no abuse. But with the blockchain, every user is a watchdog.

How does it relate to previous metals like gold and silver? Traditionally these resources have been used as an alternative to FIAT currencies. Whenever the economy went bad, investors jumped on the metal market and gold and silver would rise in value. Because there are limited amounts as well, and those metals are tangible. You buy a silver coin, its a real coin, and it can be exchanged for money at millions of locations worldwide. Usually at a rate that is very close to the market value. But gold can be mined as well, like crypto currencies, and there is no real way of knowing how much gold actually exists in the ground. So should a big discovery be made, the value might drop. However, countries in the world choose to keep their reserves in gold and silver. And it is used in the industry, so there is something to say for that.

At the moment I am writing this article the price of Bitcoin is close to 10.000 dollars for each coin. The real remaining question is, is something digital, something invented by some random guy on the internet, really worth the 10.000? I am not convinced of this. The hype is incredible and it is likely it will still grow bigger. So right now, yes, you can invest in it. Do not put all your hard earned money in it, but get at least a bit of Bitcoin. As it hits the mainstream markets now, it will surely increase more and you will make a profit. But for the long term? No. Make that profit and get something tangible with it. Buy a house, or a piece of land. Why? Because that is not created out of thin air by some internet guru, but it is something in the real world, and there is limited availability as well. And with real estate it is not a question of availability and demand, the demand will always increase in the long run, if the population grows.

Good luck!

Equifax Has Sold Private Data Including Salary Details of Millions of Employees To Other Companies

Hack News

Equifax-owned company called Workforce Solutions, also known as The Work Number (TALX), sold salary data of its employees to debt specialists, financial service companies, and other organizations. Facebook Inc. is one of those companies buying such data despite the fact that the U.S. Federal Trade Commission put Facebook on privacy probation.

It is well known that social media such as Facebook now encourage their users to share their private data online. These sites’ entire policies are based on encouraging their customers to share their private lives as much as possible. The data shared (most of the time voluntary) is sent to several organizations and companies regardless of users’ consent. Despite the fact that social media users share their private lives online, salary is one of the sacred areas to most people, people who would not want to post publicly how much they earn. Facebook has been buying data from Equifax and also selling all the private data it collects from its users back to several companies including Equifax which had a breach to expose 143 million Americans’ private information.

Equifax Work Number database now contains over 296 million employment records and contains employees at all wage levels, from CEOs to interns. Considering how loose their security level is, apparent from breaches, it is not even a surprise there was unauthorized access to their employee tax records, lasting over a year, from April 2016 to May 2017. Cybersecurity expert Brian Krebs states that ‘crooks were able to reset the 4-digit PIN given to customer employees as a password and then steal W-2 tax data after successfully answering personal questions about those employees,’ to breach TALX’s databases, the Tax Form Management platform. He said due to this method of breaching, Equifax has no idea how many employees were affected from it. Krebs also reported that last September, a research team was able to access 14,000 consumer records after slipping into an online portal where Equifax employees in Argentina manage credit report disputes from consumers, as the password combination was set to an easy guess such as admin/admin.

Equifax-owned The Work Number has such a detailed database about salary data they put on sale that it shows week-by-week data for years, health care providers, types of health care coverage, files of unemployment claims and more. The data The Work Number owns and sells includes 12 million records.

Equifax can easily get and store such private and hidden information through thousands of U.S. businesses, including Fortune 500 companies, government agencies (who hold 85 percent of the entire country’s population), the Department of Defense and even schools. These sectors and people let Equifax tap directly into their data so that the credit bureau can have the latest job information and they even pay for Equifax to own their workers’ private information as they see it as a privilege. Once Equifax collects the private data, it sells the data to third parties such as debt agents, social media giants like Facebook Inc., and various companies giving financial services.

A good example could be given when we look at Facebook employees. A typical employee at Facebook may require verification of his employment through TALX when he applies for a loan, public aid, or a new job. If his new prospective employer is among the 70,000 approved entities in Equifax’s verifier network with a “permissible purpose”, that company can purchase his employment and income information for about $20. Prospective landlords can verify an applicant’s income through The Work Number, or human resources departments can examine an applicant’s background information much cheaper.

How the Work Number process works, according to a 2007 slide about Equifax’s $1.4 billion acquisition of TALX that year. Image: SEC

Of course, gathering data which was more than a fifth of the firm’s $3.1 billion revenue last year makes TALX one of the most profitable businesses of Equifax. Rick Smith, Equifax’s former CEO, said at an event at the University of Georgia in August. “That acquisition, by the way—I don’t know if I’m proud of this or not—but it’s worth about $9 billion today.”

Equifax already confirmed in an emailed statement to News as it shares ‘job data’ with debt collectors and others in agreement with Fair Credit Reporting Act guidelines.

Despite the fact that the Work Number database presents a continuous threat for both employees and consumers with their large database to private data and with little to no protection to it, the Work Number stated they will continue to supply such data for their customers, the sale of the data is included.

Such private data being shared by financial companies means your health status, credit history, financial status, debts, salary, your bank accounts and several other private details about your life are exposed to many organisations and companies. When, for instance, you fail to pay for your credit card debt or hospital bill, the companies can withdraw this amount from your bank account and you won’t even realize it unless you see a detailed account report.

At this point, there does not seem to be a real solution to this big scandal concerning the violation of private data since the Federal Trade Commission (FTC), which is supposed to take care of such issues, also sends its employees’ data to Equifax and it is an Equifax client as well. FTC regularly sends wage and work information about its attorneys and staff members to the Work Number database.

Trade specialists comment about one of the biggest scams of our century concerning the violation of company’s customer related data as a ‘secret CIA’ since it is being done legally and nobody does anything about to prevent it.

Sources:

https://www.fastcompany.com/40485634/equifax-salary-data-and-the-work-number-database

https://krebsonsecurity.com/2017/10/equifax-breach-fallout-your-salary-history/

https://www.nbcnews.com/technology/exclusive-your-employer-may-share-your-salary-equifax-might-sell-1B8173066

Facebook creates scary “shadow profiles” with information you never wanted to give

Hack News

Everyone already knows Facebook is obsessed with collecting your private information. Data collection seems to be the primary business goal of this company these days. However, what most people do not know is that Facebook does not just collect and archive data taken from your profile. No, Facebook actually keeps huge databases of so called “shadow profiles”. These profiles contain information you never gave to them, infact we are pretty sure you would never allow them to have it.

For example, Facebook is a major customer of third-party data-brokers, who compile huge dossiers on people based on their spending, internet and phone usage, employment history and so on. In addition, Facebook encourages users to upload their entire address books to their system to “find your friends,” and while doing this, most Facebook users do not realize that they are leaking sensitive information, including nicknames, private numbers, and connections to the system.

Facebook mines this data to create their “shadow profiles” of its billions of users. And yes, these profiles are literally filled with data about you that you have never consciously provided to the system. It is data mined from third parties, including your friends, but also those spooky data-brokers we mentioned before. Facebook’s shadow profile system was first confirmed in 2013 when it accidentally leaked all of the users’ shadow profiles to them along with their own data. Something the company says it will never do again out of (ironic) respect for the privacy of the people who provided the data that goes into your shadow profile.

The “shadow profiles” are involuntary and there’s no opt-out. Facebook even has shadow profiles on people who don’t use the service. For example, even though I’m not a Facebook user anymore, multiple people have uploaded their address books containing my email and phone number to the system, thus allowing Facebook to create a profile of my contacts by looking at who lists me as a contact.

Ofcourse Facebook doesn’t like, and doesn’t use, the term “shadow profiles.” because it sounds like Facebook creates hidden profiles for people who haven’t joined the network, which Facebook says it doesn’t do. Ofcourse the company is not being honest about this, as I just explained.

Most users remain unaware of the reach and power of the”shadow profiles”. Because shadow-profile connections happen inside Facebook’s algorithmic black box, people can’t see how deep the data-mining of their lives truly is, until an uncanny recommendation pops up.

Scary examples: (quotes from Gizmodo)

  • A man who years ago donated sperm to a couple, secretly, so they could have a child—only to have Facebook recommend the child as a person he should know. He still knows the couple but is not friends with them on Facebook.
  • A social worker whose client called her by her nickname on their second visit, because she’d shown up in his People You May Know, despite their not having exchanged contact information.
  • A woman whose father left her family when she was six years old—and saw his then-mistress suggested to her as a Facebook friend 40 years later.
  • An attorney who wrote: “I deleted Facebook after it recommended as PYMK a man who was defense counsel on one of my cases. We had only communicated through my work email, which is not connected to my Facebook, which convinced me Facebook was scanning my work email.”

As expected, Facebook does what it can to underplay how much data it gathers through contacts, and how widely it casts its net. “People You May Know suggestions may be based on contact information we receive from people and their friends,” Facebook spokesperson Matt Steinfeld wrote in an email.

So how do you stop Facebook from collecting data? Contact every person you know who ever received your contact information and uploaded it to Facebook and ask them to go to Facebook’s contact management page and delete it. That is really the only way.

Just don’t miss anyone. “Once a contact is deleted, we remove it from our system, but of course it is possible that the same contact has been uploaded by someone else,” Steinfeld wrote in an email.

Sources: BoingBoing, Gizmodo

Microsoft Engineer installs Google Chrome when Microsoft Edge crashes during presentation – Hilarious!

Hack News

Microsoft presenter Michael Leworthy was doing a presentation showing the new features of Microsoft Azure. While doing his presentation suddenly the web browser Microsoft has been presenting as the best browser in the world, Edge, crashed. Leworthy was forced to install Google Chrome to finish his presentation.

While people in the audience were giggling, the Microsoft engineer tries to continue presenting like nothing happened. It shows, however, how Microsoft (and other companies) have been struggling to keep up with Google. Chrome is the most popular web browser in the world, leaving the competition far behind.

“I love it when demos break,” he said. “So while we’re talking here, I’m gonna go install Chrome”.

Since the launch of Windows 10, Microsoft has been pushing its Edge browser, claiming it to be the best web browser over its competitors like Mozilla Firefox, Opera and Google Chrome in terms of speed and battery performance. However, Microsoft must admit that most users make use of Edge or Internet Explorer only to download Chrome.

Michael Leworthy was man enough to upload the presentation himself, showing Microsoft does have some sense of humour. Then again, the presentation does not say anything negative about Azure. So if the video goes viral, they might still get some sales from it.

Watch the full presentation below below. The funny stuff happens at around 37 minutes:

Microsoft, once known as the most powerful tech company in the world, has been struggling to regain its focus. Their operating systems are still the most widely used, but they seem to be having some issues with their other products.

Bad business moves, like replacing Windows Live Messenger with Skype, or continuing to change the name of the most popular e-mail service in the world, Hotmail, did not do them any good either. Especially because they did this during the rise of Gmail, causing Google to take the take their territory on the market at an amazing speed.

We honestly hope that some day Microsoft will become the giant that it once was, again. And if not, then at least we got some funny videos like the one above. That is worth something as well.

Sources: The Hacker News, Youtube