News

Wer ein Unternehmen führt, der trägt Verantwortung. Dazu gehört auch die Cybersicherheit, ein Bereich der aktuell durch neue Gesetze und Regeln wie das EU-weite Cyber-Resilienz-Gesetz und nicht zuletzt die zahlreichen Schlagzeilen über groß angelegte Cyberattacken in den Fokus rückt.  Hohe Geldstrafen für die Unternehmen tun ein Übriges, um die Dringlichkeit für Organisation jeder Größenordnung zu […]

Cyberkriminelle hatten es im letzten Jahr besonders auf Betriebe aus den Bereichen Verarbeitung und Produktion abgesehen. Laut State of Ransomware Report 2024 verzeichneten die meisten Sektoren einen Rückgang von Angriffen. Nur drei Branchen wurden stärker belastet, der Bereich Produktion und Verarbeitung hatte mit 9 Prozent das höchste Plus. 65 Prozent der Unternehmen aus Produktion und Verarbeitendem […]

Sophos veröffentlichte vor kurzem die Ergebnisse seines Reports „Cyber Insurance and Cyber Defenses 2024: Lessons from IT and Cybersecurity Leaders“. Dieser offenbart, dass 97 Prozent der Unternehmen mit einer Cyber-Police in ihre Abwehrmaßnahmen investiert haben, um die Versicherung zu unterstützen. 76 Prozent geben an, sich dadurch für eine Deckung qualifiziert zu haben. 67 Prozent erhielten […]

Die finanziellen und betrieblichen Auswirkungen eines Ransomware-Angriffs sind schon schlimm genug. Wenn es den Cyberkriminellen allerdings zusätzlich gelingt, die Backups zu schädigen oder zu verschlüsseln, ist die Wahrscheinlichkeit hoch, dass ein Unternehmen rund das doppelte an Lösegeld zahlen muss. Laut einer Studie von Sophos bei 2.974 IT-/Cybersecurity-Entscheidern in 14 Ländern fallen die Gesamtkosten für die […]

Im Falle einer Datenverschlüsselung durch Ransomware müssen „Incident Responder“ und Task-Forces schnell und effizient vorgehen, um möglichst alle Daten beispielsweise von einer verschlüsselten virtuellen Maschine zu extrahieren. Wie wichtig das Fachwissen und die richtige Vorgehensweise sind, unterstreicht einmal mehr der aktuelle Sophos-Report State of Ransomware 2024: 58 Prozent der deutschen Unternehmen waren im letzten Jahr […]

Innerhalb von 51 Tagen verschickte eine Gruppe von Angreifern, die vermutlich aus Russland stammt, mehr als 2.000 Phishing-E-Mails an fast 800 Unternehmen und Organisationen aus den Bereichen Regierung, Gesundheitswesen, Energie und kritische Infrastrukturen. Die Ziele befanden sich in Großbritannien, Australien, Frankreich, Deutschland, Österreich, Italien sowie in den USA und Niederlanden. Die E-Mails zeichneten sich durch […]

Sophos veröffentlichte heute seinen Bericht „Operation Crimson Palace: Sophos Threat Hunting Unveils Multiple Clusters of Chinese State-Sponsored Activity Targeting Southeast Asia“, in dem eine hochentwickelte, fast zweijährige Spionagekampagne gegen ein hochrangiges Regierungsziel detailliert unter die Lupe genommen wird. Im Rahmen der 2023 gestarteten Untersuchung von Sophos X-Ops fand das Managed-Detection-and Response-Team (MDR) drei verschiedene Aktivitätscluster, […]

Laut dem jährlichen State of Ransomware 2024 Report arbeiteten 97 Prozent der befragten Organisationen, die im letzten Jahr Opfer von Ransomware waren, mit Strafverfolgungsbehörden oder anderen amtlichen Stellen zusammen. Dieser eindrucksvoll hohe Prozentsatz gilt gleichermaßen für die weltweiten als auch die DACH- Umfrageergebnisse. Mehr als die Hälfte (59 Prozent weltweit und 56 Prozent in DACH) […]

Really interesting article on the ancient-manuscript scholars who are applying their techniques to the Voynich Manuscript.

No one has been able to understand the writing yet, but there are some new understandings:

Davis presented her findings at the medieval-studies conference and published them in 2020 in the journal Manuscript Studies. She had hardly solved the Voynich, but she’d opened it to new kinds of investigation. If five scribes had come together to write it, the manuscript was probably the work of a community, rather than of a single deranged mind or con artist. Why the community used its own language, or code, remains a mystery. Whether it was a cloister of alchemists, or mad monks, or a group like the medieval Béguines—a secluded order of Christian women—required more study. But the marks of frequent use signaled that the manuscript served some routine, perhaps daily function.

Davis’s work brought like-minded scholars out of hiding. In just the past few years, a Yale linguist named Claire Bowern had begun performing sophisticated analyses of the text, building on the efforts of earlier scholars and on methods Bowern had used with undocumented Indigenous languages in Australia. At the University of Malta, computer scientists were figuring out how to analyze the Voynich with tools for natural-language processing. Researchers found that the manuscript’s roughly 38,000 words—and 9,000-word vocabulary—had many of the statistical hallmarks of actual language. The Voynich’s most common word, whatever it meant, appeared roughly twice as often as the second-most-common word and three times as often as the third-commonest, and so on—a touchstone of natural language known as Zipf’s law. The mix of word lengths and the ratio of unique words to total words were similarly language-like. Certain words, moreover, seemed to follow one another in predictable order, a possible sign of grammar.

Finally, each of the text’s sections—as defined by the drawings of plants, stars, bathing women, and so on—had different sets of overrepresented words, just as one would expect in a real book whose chapters focused on different subjects.

Spelling was the chief aberration. The Voynich alphabet—if that’s what it was—appeared to have a conventional 20-odd letters. But compared with known languages, too many of those letters repeated in the same order, both within words and across neighboring words, like a children’s rhyme. In some places, the spellings of adjacent words so converged that a single word repeated two or three times in a row. A rough English equivalent might be something akin to “She sells sea shells by the sea shore.” Another possibility, Bowern told me, was something like pig Latin, or the Yiddishism—known as “shm-reduplication”—that begets phrases such as fancy shmancy and rules shmules.

Microsoft today released updates to fix at least 90 security vulnerabilities in Windows and related software, including a whopping six zero-day flaws that are already being actively exploited by attackers.

This month’s bundle of update joy from Redmond includes patches for security holes in Office, .NET, Visual Studio, Azure, Co-Pilot, Microsoft Dynamics, Teams, Secure Boot, and of course Windows itself. Of the six zero-day weaknesses Microsoft addressed this month, half are local privilege escalation vulnerabilities — meaning they are primarily useful for attackers when combined with other flaws or access.

CVE-2024-38106, CVE-2024-38107 and CVE-2024-38193 all allow an attacker to gain SYSTEM level privileges on a vulnerable machine, although the vulnerabilities reside in different parts of the Windows operating system.

Microsoft’s advisories include little information about the last two privilege escalation flaws, other than to note they are being actively exploited. Microsoft says CVE-2024-38106 exists in the Windows Kernel and is being actively exploited, but that it has a high “attack complexity,” meaning it can be tricky for malware or miscreants to exploit reliably.

“Microsoft lists exploit complexity as high due to the attacker needing to win a race condition,” Trend Micro’s ZeroDay Initiative (ZDI) noted. “However, some races are easier to run than others. It’s times like this where the CVSS can be misleading. Race conditions do lead to complexity high in the CVSS score, but with attacks in the wild, it’s clear this bug is readily exploitable.”

Another zero-day this month is CVE-2024-38178, a remote code execution flaw that exists when the built-in Windows Edge browser is operating in “Internet Explorer Mode.” IE mode is not on by default in Edge, but it can be enabled to work with older websites or applications that aren’t supported by modern Chromium-based browsers.

“While this is not the default mode for most users, this exploit being actively exploited suggests that there are occasions in which the attacker can set this or has identified an organization (or user) that has this configuration,” wrote Kev Breen, senior director of threat research at Immersive Labs.

CVE-2024-38213 is a zero-day flaw that allows malware to bypass the “Mark of the Web,” a security feature in Windows that marks files downloaded from the Internet as untrusted (this Windows Smartscreen feature is responsible for the “Windows protected your PC” popup that appears when opening files downloaded from the Web).

“This vulnerability is not exploitable on its own and is typically seen as part of an exploit chain, for example, modifying a malicious document or exe file to include this bypass before sending the file via email or distributing on compromised websites,” Breen said.

The final zero-day this month is CVE-2024-38189, a remote code execution flaw in Microsoft Project. However, Microsoft and multiple security firms point out that this vulnerability only works on customers who have already disabled notifications about the security risks of running VBA Macros in Microsoft Project (not the best idea, as malware has a long history of hiding within malicious Office Macros).

Separately, Adobe today released 11 security bulletins addressing at least 71 security vulnerabilities across a range of products, including Adobe Illustrator, Dimension, Photoshop, InDesign, Acrobat and Reader, Bridge, Substance 3D Stager, Commerce, InCopy, and Substance 3D Sampler/Substance 3D Designer. Adobe says it is not aware of active exploitation against any of the flaws it fixed this week.

It’s a good idea for Windows users to stay current with security updates from Microsoft, which can quickly pile up otherwise. That doesn’t mean you have to install them on Patch Tuesday each month. Indeed, waiting a day or three before updating is a sane response, given that sometimes updates go awry and usually within a few days Microsoft has fixed any issues with its patches. It’s also smart to back up your data and/or image your Windows drive before applying new updates.

For a more detailed breakdown of the individual flaws addressed by Microsoft today, check out the SANS Internet Storm Center’s list. For those admins responsible for maintaining larger Windows environments, it pays to keep an eye on Askwoody.com, which frequently points out when specific Microsoft updates are creating problems for a number of users.