MacOS features a powerful sandbox restriction that helps keep modern Apple computers safe by limiting how code can run on the system.

Unfortunately, no system is bullet proof. There’s a way that a determined attacker could bypass sandbox restrictions and execute malicious code arbitrarily.  Engineers at Microsoft discovered the vulnerability, and independent security researcher Arsenii Kostromin discovered it independently.

Both groups responsibly disclosed their findings to Apple and the Microsoft team released the technical details along with a proof of concept that demonstrates how it works.

The vulnerability is being tracked as CVE-2022-26706, and the issue specifically relates to macros in Word documents opened on a machine running MacOS.  If that’s something you do on a regular basis, then it pays to be well versed in exactly how this vulnerability could be used against you.

Johnathan Bar Or is one of the researchers on the Microsoft 365 Defender Research Team.

Johnathan had this to say about the issue:

“Despite the security restrictions imposed by the App Sandbox’s rules on applications, it’s possible for attackers to bypass the said rules and let malicious codes ‘escape’ the sandbox and execute arbitrary commands on an affected device.”

The good news is that the issue was discovered in October 2021, and Apple released a fix for it in May of 2022 in the Big Sur 11.6.6 update.

Even if you’ve disabled auto updates and are leery about applying OS patches to your system, this one deserves a place on your list.  It’s not an incredibly technical exploit, which means that most any hacker could pull it off. The longer you leave your system unpatched, the more danger you’re in.

Kudos to the Microsoft team and to Arsenii Kostromin for discovering and then promptly responsibly reporting the issue, and to Apple for moving with some haste to release a patch.

If you own a Lenovo laptop, be aware that researchers at ESET have recently discovered a trio of bugs reported to Lenovo that could allow an attacker to disable security features and hijack your operating system.

The issues are tracked as CVE-2022-1890, CVE-2022-1891, and CVE-2022-1892 and are all classed as medium severity level.

The first of these is an issue in the ReadcyBootDxe driver used in some of Lenovo’s products, while the other two are overflow bugs in the SystemLoadDefaultDxe driver.

Unfortunately, the issue is quite widespread, as the SystemLoadDefaultDxe driver is used in more than 70 different Lenovo models. That includes everything in the IdeaPad, Flex, ThinkBook, V14, V15, V130, Slim, S145, S540, S940, and Yoga product lines.

The company has issued a formal advisory regarding the issue and has a complete listing of all their products impacted by these flaws on their website.

ESET had this to say about their recent discovery:

“These vulnerabilities were caused by insufficient validation of DataSize parameter passed to the UEFI Runtime Services function GetVariable.  An attacker could create a specially crafted NVRAM variable, causing buffer overflow of the Data buffer in the second GetVariable call.”

If there’s a silver lining to be found here, it lies in the fact that exploiting these flaws is not a trivial task and requires a skillset that is likely beyond a great many of the world’s hackers.

That does not mean that you are safe. You are very much at risk. The good news though is that at least a casual or relatively inexperienced hacker will not be able to easily exploit these weaknesses.  They’re still well worth keeping on your company’s radar, however.

One final note to be aware of is that if you’re having trouble determining whether your Lenovo is on the vulnerable list, the company has published a website that auto-detects for the vulnerability.  It is hands down the fastest way to find out for sure. Good luck out there!

Does your company use Microsoft 365?  If so, and you’ve noticed that your Office apps have begun to crash mysteriously and inexplicably, be aware that the latest update (build 15330.20298) is the culprit.

Unfortunately, the bug was introduced in the Enterprise channel during the company’s regularly scheduled “Patch Tuesday.”

The error manifests itself when users try to open a contact card or hover over a contact’s name or picture in shared documents, emails, or comments.

For their part, the company has moved quickly. Although they have not identified the root cause of the issue yet, in the meantime, they went back to the last version confirmed to not contain the bug.

Microsoft is advising any users who have installed version 2206 to roll back to version 2205 to get around the issue. For Admins, the company drafted specific rollback instructions and posted them on their website.

For some time last year, Microsoft’s updates were plagued with issues and several annoying bugs crept into the mix in just about every update the company made.

They re-doubled their efforts and tightened up their processes, and the number of faulty updates declined markedly.  This latest update breaks the trend.  With any luck, this will prove to be a one-time mistake with their next update, and the updates that follow will be smooth sailing.  Given the trouble in the recent past, it’s something that bears paying close attention to in the weeks ahead.

Kudos to Microsoft’s engineers for their fast action here, and we hope that the issue will be resolved before much longer.  It’s unfortunate any time a new bug is introduced, especially to a system as complex as Microsoft 365. Overall, the company has done a good job of addressing issues as they arise, and we expect that to be the case in this instance.

The Internet of Things (IoT) has seen explosive growth in recent years.

If you like, you can now build your own smart home with intelligent toasters, washing machines, dishwashers, and refrigerators. They are all connected to your home network, and they all make vast amounts of data available to you at your fingertips.

Unfortunately, security is slim to non-existent on most of these “smart” devices.  We’ve seen botnets enslave those smart devices and put them to use in a wide range of malicious ways. Although many industry experts have been sounding the alarm, few of the smart device manufacturers have taken much of an interest in bolstering security on the products they sell.

The good news is that Microsoft may have an answer.  The Redmond giant recently released Microsoft Defender for IoT in a bid to secure smart TVs, printers, washing machines, and any other “smart” device you may have connected to your network.

The company previewed Defender for IoT in the waning days of 2021.  Back then it was called Azure Defender for IoT and before that it was Azure Security Center.  By any of those names however, it’s the same code and it’s clear that plugging this gigantic gap in device security has been on Microsoft’s radar for quite some time.

Now at last, the product is ready for a proper unveiling and it’s a solid solution. That is especially given the fact that it integrates seamlessly with Microsoft 365 Defender, which millions of users the world over already rely on.

Michal Braverman-Blumenstyk is Microsoft’s Corporate VP and Chief Technology Officer of Cloud and AI Security.

Michal had this to say about the new product:

“…Defender for IoT now delivers comprehensive security for all endpoint types, applications, identities, and operating systems.

The new capabilities allow organizations to get the visibility and insights they need to address complex multi-stage attacks that specifically take advantage of IoT and OT devices to achieve their goals.

Customers will now be able to get the same types of vulnerability management, threat detection, response, and other capabilities for enterprise IoT devices that were previously only available for managed endpoints and OT devices.”

If you have one or more smart devices connected to your network (and you probably do), you need Defender for IoT.  Kudos to Microsoft.

Security researchers at Unit 42, a division of Palo Alto Networks, have been tracking the efforts of a massive campaign aimed at Elastix VoIP telephony servers.

They are used by companies of all shapes and sizes to unify their communications, and it is especially attractive because it can be used with the Digium phones module for FreePBX.

So far, the team has collected more than half a million malicious code samples over a three-month period.  An analysis of those code samples reveals that the attackers are exploiting a remote code execution vulnerability. It is being tracked as CVE-2021-4561 and carries a severity rating of 9.8 out of ten.

Security researchers report that hackers have been actively exploiting this flaw since at least December 2021.

Based on the code samples collected, the Unit 42 team believes that the attackers’ goal was to plant PHP web shells on successfully penetrated systems. That would allow them to execute arbitrary commands on the compromised servers.

Another security firm, Check Point, confirms Unit 42’s findings and both teams stress that the campaign is still ongoing.  Worse, it appears that there are two different groups involved in the attack. Although it is not currently known whether they are coordinating their efforts or if that fact is coincidental. Perhaps it is a case of one following the other so as not to miss out on an opportunity.

The attackers behind the campaign are both clever and technically savvy.  They’ve built in some good anti-detection strategies into the attack, such as masking the name of the back door so that the file name resembles that of a known file already on the system.  It would take a sharp pair of eyes indeed to spot it.

In any event, if you use Elastix VoIP, be sure your IT people are aware of this threat.

“Just Google it.”  You’ve probably heard that phrase a thousand times.  In fact, you may use it yourself on a regular basis.

Unfortunately, Googling it wasn’t possible recently.  The iconic search giant went dark across broad swaths of the world and simply could not be accessed at all for thirty 34 very long minutes.

It was a very strange experience, fumbling through the internet without Google to guide the way.  Strange and frustrating.

At the root of the outage was a botched software update that rendered both Google Search and Google Maps inoperable for a time, and #Googledown became a trending hashtag on Twitter.  Google Workspace users faced similar difficulties, as they rely on portions of the Google Search technology to function correctly.

Thankfully, Google’s engineers were quick to respond, and they corrected the issue with admirable speed.  Nonetheless, for many ‘netizines’, it was the first time in living memory that Google didn’t dominate the virtual landscape.

Of course, there are plenty of other search engines out there. During that time, many of them including Bing and DuckDuckGo in particular, saw impressive surges in use that they’ll be talking about for months if not years to come.

And then Google came back to life and those surges in use stopped as quickly as they had started, like the tide going out.

In any case, if you were one of the hundreds of millions of people around the world who experienced a sense of frustration at not having access to what has become the dominant search engine on the web, that’s why.  A botched software update brought the biggest search engine on the planet to its knees for a little over half an hour.  Here’s hoping that doesn’t happen again any time soon!

Do you own a device running macOS Monterey 12.5.1, or iOS/iPadOS 15.6.1? If so, you’ll want to download and install the latest patches as soon as possible. Apple recently released a small but critical security update aimed at fixing a pair of serious vulnerabilities that could allow an attacker to execute arbitrary code on an unpatched device.

The two issues addressed by this patch are tracked as CVE-2022-32894 and CVE-2022-32893. The former is a flaw that allows an attacker to gain kernel-level privileges and execute arbitrary code. The second is a WebKit flaw that allows poisoned web pages to run arbitrary code. If you’re not familiar with it, WebKit is the platform that Apple’s Mail app, Safari, and all of its iOS web browsers rest on. Don’t expect much in the way of details from the patch release notes. You won’t find any. The only thing the latest security update does is patch to close these two security flaws.

If you own an Apple watch, also be aware that watchOS 8.7.1 has also been recently released, though when it was released, it was done without accompanying patch notes so we’re not certain whether or not this release is related to the security flaws referenced above or not.

While Apple has already fixed the issues with Monterey, some older versions of MacOS have yet to be patched. It is not currently known whether these versions are vulnerable or not, so be sure to keep an eye out for new releases if you are running older versions of MacOS.

Analysts at Red Canary Intelligence have recently spotted a Windows worm on hundreds of networks belonging to a wide range of organizations around the world.

Dubbed “Raspberry Robin” by the research team that discovered it, this worm spreads via infected USB devices and was initially spotted in September of last year (2021).  Another firm, Sekoia, observed the worm even earlier, citing appearances of similar code strains on QNAP NAS devices as early as November of 2019.

So far, nothing is known about the threat group that created the worm.  There’s nothing in the code that ties it definitively to any of the large, organized, active groups of hackers around the world. Although a code analysis reveals that it is quite advanced.

Although it has spread far and wide, and it is clearly capable of unleashing untold amounts of harm, the threat actors behind the worm have simply opted not to. At least not yet.

It is not known whether it’s because they wish to give the worm more time to spread before inflicting harm to maximize the impact of that harm, or because the group is still in early stages and is essentially testing its capabilities to see how far and how easily it will spread.

Given how little is known about the particulars and the theoretical capabilities of the worm, Microsoft tagged this as a high-risk threat. They stress that although the hackers have, not opted to use it to deploy additional malicious payloads so far, that could change at literally any time.

This is one to be on the lookout for.  Make sure your IT staff are aware of it and on high alert.  As additional details emerge about the worm and who might be behind it emerges, we’ll almost certainly have more to say about this latest threat.

Most business owners understand the importance of being active on at least one social media channel. That’s fine as far as it goes, but have you considered supplementing your social media presence with a good, old-fashioned newsletter?

Of course, when we say newsletter, we’re not talking about something you print and mail to your customers but rather something you publish electronically and email.

Not many companies do this anymore and that’s a real shame. While social media is fine, a regularly published newsletter can be a powerful companion to your online presence and can have several benefits.

First and foremost, it makes you stand out in the minds of your customers because again, not many companies are doing that anymore.

Second, whether you publish every two weeks or once a month, it gives you an opportunity to reach out to your customers at regular intervals. That keeps you on the collective minds of your customers.  If they’re thinking about you, they’re apt to head to your website or brick and mortar location the next time they need something.

Third, if your newsletter contains case studies or if it highlights the ways in which your company is responding to industry changes, it sends a clear message that you’re an authority on the topics you’re writing about. Everybody loves doing business with experts because experts really know what they’re doing.  It gives your customers peace of mind and confidence when they buy from you, and that makes them more likely to do so.

Finally, it’s a great way to give people who have done business with you before a sneak peek of upcoming products or services you plan to release, which makes them feel like they’re one of the insiders.  They’re in the know in ways that people who don’t get your newsletter simply aren’t, and that helps to create a powerful connection.

All that to say, if you don’t yet have a company newsletter, you may want to give serious consideration to starting one.  Done well, it will help your company in a wide range of ways.