vulnerabilities CVE-2018-8589: Another day, another OS vulnerability Our exploit prevention technologies detected another zero-day exploit for Windows Nikolay Pankov November 14, 2018 A month ago, we wrote about finding an exploit for a vulnerability in Microsoft Windows. It may sound familiar, but our proactive technologies have detected another zero-day exploit, and again, the exploit targets a previously unknown vulnerability in the operating system. This time, only Windows 7 and Windows Server 2008 are at risk. That limitation does not make the threat less dangerous, however. Although Microsoft ended mainstream support of Windows Server 2008 on January 2015 and provided a free upgrade at the launch of Windows 10, not everyone upgraded. Developers are still providing security updates and support for both systems (and should continue to do so until January 14, 2020) because they still have enough clients to warrant the support. When we detected the exploit, in late October, our experts immediately reported the vulnerability to Microsoft, along with a proof of concept. Developers promptly patched it on November 13. What you should know about this vulnerability and corresponding exploit It is a zero-day elevation of privilege vulnerability in the win32k.sys driver. Using this vulnerability, malefactors can gain the necessary privileges for persistence on a victim’s system. The exploit was used in several APT attacks, mainly in the Middle East region. It was targeting only 32 bit versions of Windows 7. You can find technical data in this Securelist post. Our threat intelligence reports subscribers can also get more information about the attack by contacting intelreports@kaspersky.com. How to stay safe Nothing new here — but heed our usual advice for vulnerabilities: Install Microsoft’s patch immediately. Regularly update all software your company uses to the most recent versions. Stop using outdated software before its support ends. Use security products with vulnerability assessment and patch management capabilities to automate update processes. Use a robust security solution equipped with behavior-based detection capabilities for effective protection against unknown threats including zero-day exploits. Note that once again, credit for detecting this previously unknown threat goes to our proactive technologies: namely, the advanced sandboxing and antimalware engine for the Kaspersky Anti Targeted Attack Platform (a solution made specifically to protect against APT threats) and automatic exploit prevention technology that form an integral subsystem of Kaspersky Endpoint Security for Business.
Read next Twitter cryptocurrency scams: A hundred Elon Musks — and now Target Twitter cryptocurrency scams are becoming more and more advanced and convincing, with scammers using new techniques and some heavy artillery.
Tips How to improve your resume with AI without exposing your data Let’s look at how to use AI as a resume editor without oversharing to build a document that gets past automated screening systems and catches a recruiter’s eye.
Tips How can students overcome the fear of unfulfilled potential, and where does cybersecurity come into it? University students sometimes don’t see the practical value of what they’re studying, and aren’t always sure what to do next. Kaspersky Academy’s free “Cybersecurity. Entry Level” course can help them pick up in-demand skills directly from Kaspersky experts.
Tips Nine reasons to set up a VPN on your router Get the most speed, reliability, and convenience out of your VPN by putting it on your router. Here’s a look at the real benefits of specific VPN setup scenarios for your whole home network.
Tips Fact and fiction about hidden Wi-Fi network names Hiding your Wi-Fi network name might seem like a smart security move, but in practice it does more harm than good. Let’s take a look at how it works, what side effects it can have, and how to properly secure your home Wi-Fi.