19.08.24 Threat Report

Microsoft Patches Six Zero-Day Vulnerabilities in August Update

Microsoft released security updates addressing 90 vulnerabilities across its software, including six critical zero-day flaws actively exploited by attackers. Affected products include Office, .NET, Visual Studio, Azure, Dynamics, Teams, and Windows.

‍

Three of the zero-days involve local privilege escalation, granting SYSTEM-level access on compromised machines. Notably, CVE-2024-38106 and CVE-2024-38107 target the Windows Kernel, while CVE-2024-38193 impacts another Windows component. These flaws can be combined with others for more severe attacks.

‍

Another significant flaw, CVE-2024-38178, allows remote code execution via Internet Explorer Mode in Microsoft Edge, while CVE-2024-38213 bypasses the "Mark of the Web" security feature, enabling malware to evade warnings.

‍

Microsoft also fixed CVE-2024-38189, a remote code execution vulnerability in Microsoft Project, stressing the importance of active security features.

‍

Adobe also patched 71 vulnerabilities across various products. Although no active exploits have been reported, users are urged to apply these updates. It's advisable to back up data before updating to avoid issues.

‍

AWS Vulnerabilities Risk Full-Service Takeovers

Researchers discovered critical vulnerabilities in six AWS services: CloudFormation, Glue, EMR, SageMaker, ServiceCatalog, and CodeStar. These flaws could enable remote code execution, account takeovers, and data theft. The researchers identified "Shadow Resource" and "Bucket Monopoly" attack methods, which exploit automatically generated AWS resources like S3 buckets.

‍

AWS has mitigated these risks by adding randomness to bucket names and prompting users for unique names. Organisations are advised to use scoped policies, verify bucket ownership, and avoid predictable naming conventions.

‍

Phishing Campaign Targets AWS Accounts

A new phishing campaign is targeting AWS accounts via emails containing PNG images. These emails redirect victims to a fake AWS login page designed to steal credentials. The phishing page closely mimics the real AWS login portal and uses a similar URL structure, posing a significant risk to users who ignore browser warnings.

‍

To mitigate phishing risks, AWS users should:

• Disable root logins via Service Control Policies.
• Implement phishing-resistant MFA.
• Use SSO for user authentication.
• Apply least privilege principles.

‍

DDoS Attack Hits X During Trump Interview

X (formerly Twitter) experienced a massive Distributed Denial-of-Service (DDoS) attack during a live interview with Donald Trump, delaying the event by 40 minutes. The attack overwhelmed the platform with traffic, causing widespread access issues. Despite this, the interview proceeded with a smaller audience, and the unedited audio was released afterward.