vulnerabilities Vulnerability detected in Kernel Transaction Manager Thanks to our proactive technologies, zero-day vulnerability CVE-2018-8611 was neutralized. Nikolay Pankov December 13, 2018 Cybercriminals continue to stress-test Windows, and our protective technologies continue to detect their attempts and prevent exploitation. It is not the first or even the second discovery of this kind over the past three months. This time, our systems detected an attempt to exploit the vulnerability in Windows Kernel Transaction Manager. The new zero-day exploit was used against several victims in the Middle East and Asia. The vulnerability it exploited, CVE-2018-8611, allowed an elevation of privilege in cases where the Windows kernel fails to handle objects in memory properly. As a result, malefactors can run arbitrary code in kernel mode. In practice, that means malefactors can install programs, change or view data, or even create new accounts. According to our experts, the exploit can also be used to escape the sandbox in modern Web browsers, including Chrome and Edge. For technical details, see this Securelist post. Even more information about CVE-2018-8611 and the actors who tried to exploit it is available to customers of Kaspersky Intelligence Reports; contact intelreports@kaspersky.com Our experts reported this vulnerability to developers, and Microsoft just released a corresponding patch that corrects how the Windows kernel handles objects in memory. How to stay safe Again, here is our general advice for vulnerabilities: Do not feel safe just because the exploit has found few victims at this point. Since its disclosure, more cybercriminals may try to exploit it, so install the patch immediately. Regularly update all software your company uses. Use security products with automated vulnerability assessment and patch management capabilities. Use a security solution equipped with behavior-based detection capabilities for effective protection against unknown threats including zero-day exploits. Note again, before our protective technologies encountered the exploit, this vulnerability was unknown. Therefore, we can recommend specific products that can help keep you safe. The first is our solution made specifically to protect against APT threats — Kaspersky Anti Targeted Attack Platform, with its advanced sandboxing and antimalware engine. The second, Kaspersky Endpoint Security for Business, has built-in automatic exploit prevention technology, which is the technology that detected the CVE-2018-8611 vulnerability.
Read next Online fraud: 5 most common spammer tricks The 5 most common ways spammers can trick you into paying them or giving up your personal information.
Tips Reading between the lines: how to read e-books safely We break down how to use e-books safely, and which rules to follow when searching for books online, so you don’t fall victim to scammers
Tips The eMudhra certificate incident: how organizations can respond How a certificate’s private key ended up being equal to 4, and why browser updates alone won’t protect you from vulnerable eMudhra certificates.
Tips How to improve your resume with AI without exposing your data Let’s look at how to use AI as a resume editor without oversharing to build a document that gets past automated screening systems and catches a recruiter’s eye.
Tips How can students overcome the fear of unfulfilled potential, and where does cybersecurity come into it? University students sometimes don’t see the practical value of what they’re studying, and aren’t always sure what to do next. Kaspersky Academy’s free “Cybersecurity. Entry Level” course can help them pick up in-demand skills directly from Kaspersky experts.