Page 11 - Threat Intelligence 10-3-2019

Internal Threats

Microsoft will continue providing Windows 7 security updates for SMBs. Windows is the most popular
desktop operating system in use around the world. Somewhere around late 2017-early 2018, the number of
Windows 10 installations surpassed those of Windows 7, the generally praised and massively popular version
of the OS. Two years later, Windows 7 is still running on nearly 30 percent of all desktop computers running
Windows. Mainstream support for Windows 7 ended in January 2015, extended support is scheduled to end in
January 2020 and, until now, only those with Professional and Enterprise volume licenses could pay to get
extended security updates until January 2023.
Source: https://www.helpnetsecurity.com/2019/10/03/smb-windows-7-security/

PDF encryption standard weaknesses uncovered. You would be forgiven for thinking that encrypting PDFs,
before they are stored or sent via email, keeps their contents away from prying eyes. But according to
researchers in Germany, it might be time to revisit that assumption after they discovered weaknesses in PDF
encryption which could be exploited to reveal the contents of a file to an attacker. Dubbed ‘PDFex’ (PDF
exfiltration), the weaknesses documented in Practical Decryption exFiltration: Breaking PDF Encryption by
researchers from Ruhr University Bochum and the Münster University of Applied Sciences, offer two attack
methods, each with three variants that depend on which PDF viewer is used to open a target document.

Source: https://nakedsecurity.sophos.com/2019/10/03/pdf-encryption-standard-weaknesses-
uncovered/

WhatsApp Flaw Opens Android Devices to Remote Code Execution. A security researcher has identified a
flaw in the popular WhatsApp messaging platform on Android devices, which could allow attackers to launch
privilege elevation and remote code execution (RCE) attacks on victims. Exploiting the flaw—described in a
Wednesday post on GitHub by a Singapore-based “technologist and an information security enthusiast” called
Awakened – is a rather complicated affair. An attack involves a bad actor sending a malicious GIF file to a
victim via “any channel,” whether it’s an email or in a direct message on WhatsApp. After a victim has
downloaded the GIF file onto his device, the second step happens when he opens the WhatsApp Gallery in
order to send a media file to another user from WhatsApp (the victim doesn’t need to actually send anything,
just open the WhatsApp Gallery). That’s when the attack is triggered, according to Awakened. “Since
WhatsApp shows previews of every media (including the GIF file received), it will trigger the double-free bug
and our RCE exploit,” the researcher wrote..
Source: https://threatpost.com/whatsapp-flaw-opens-android-devices-to-remote-code-
execution/148888/

www.accumepartners.com
11