Wireshark 3.4.7 released. ’PetitePotam’ ADCS Domain Admin Vulnerability This one come from Bojan Zdrnja (@bojanz) and a great diary he posted to ISC about the entire issue. Bojan’s piece is a must-read to wrap your head around everything going on. At the core is NTLM (New Technology LAN Manager) relay, in which an attacker has a “machine-in-the-middle” position and is able to intercept credentials being sent. This gets into Microsoft’s encrypted file system remote protocol, and no further authentication is required, making matters worse. Summed up, Don’t use NTLM for authentication! Particularly, on Active Directory Certificate Services, make sure that IIS is not allowing authentication via NTLM. Mitigation documentation from…

Microsoft ACL Privilege Vulnerability dubbed “#SummerOfSAM”, this is a permissions-related fiasco for SAM & SYSTEM hives. Dubbed the “Summer of SAM” there is CVE 2021-#36934 issued for incorrect permissions on Windows 10/11 hives. Bojan Zdrnja (@bojanz) posted to the ISC (Internet Storm Center) first alerting the public here. The issue revolves around SAM and SYSTEM hives. SAM is Security Accounts Manager. SYSTEM User Account is like ‘root’ in Linux, as this account has more privileges than even the admin. SYSTEM users: see & do things the admin can’t. it can stop processes the admin can’t. has a higher integrity level that the admin. can bypass most policies. As Microsoft published…

A U.S. led coalition including the U.K. and other coutries and organizations including NATO are formally accusing China for cyberattacks worldwide, including the massive Microsoft Exchange email hack. via Financial Times, Bloomberg, CNN, CNBC. NSO Group, an Israeli tech organization, is being accussed of selling spyware used to snoop the devices of executives, journalists, activists and dissidents. NSO Group has a proprietary software technology called Pegasus, intended for tracking terrorists, that reportedly, “allows authorities to listen into conversations using hacked mobile phones microphones, as well as track other data”. via Economist Also, a compelling read from 2019 highlighting NSO Group is here via The Economist, as well. And, still another…

(News & Notes may be updated throughout the day…check back for more!) China’s cyber watchdog, the Cyberspace Administration, an agency set-up during Chinese President Xi JinPing’s first term is taking, “a lead role in Beijing’s push to strengthen interagency oversight of companies listed overseas, especially those traded in the U.S., and to tighten rules for future foreign listings”. via WSJ Update…China Orders Stores to Remove More Apps Operated by Didi GLobal’s China Arm via WSJ ”Stellantis said it plans to spend more than $35.5 billion through 2025 to release an array of new electrified vehicles.” Not mentioned is how much they plan on spending towards the cybersecurity of said vehicles.…