Sunday, July 18, 2021
MALICIOUS CODE PRINT NIGHTMARE: Third Serious Windows Print Spooler Flaw in 5 Weeks
Disable the Windows print spooler to prevent hacks, Microsoft tells customers
The third serious Windows print flaw in 5 weeks prompts new Microsoft warning.
The vulnerability is the third printer-related flaw in Windows to come to light in the past five weeks.
Bring your own printer driver
On Thursday, Microsoft warned of a new vulnerability in the Windows print spooler. The privilege-escalation flaw, tracked as CVE-2021-34481, allows hackers who already have the ability to run malicious code with limited system rights to elevate those rights. The elevation allows the code to access sensitive parts of Windows so malware can run each time a machine is rebooted.
"An elevation of privilege vulnerability exists when the Windows Print Spooler service improperly performs privileged file operations,” Microsoft wrote in Thursday’s advisory. “An attacker who successfully exploited this vulnerability could run arbitrary code with SYSTEM privileges.
An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights.”
Microsoft said that the attacker must first have the ability to execute code on a victim's system. The advisory rates in-the-wild exploits as “more likely.” Microsoft continues to advise that customers install the previously issued security updates. A print spooler is software that manages the sending of jobs to the printer by temporarily storing data in a buffer and processing the jobs sequentially or by job priority.
“The workaround for this vulnerability is stopping and disabling the Print Spooler service,” Thursday’s advisory said. It provides several methods customers can use to do so. . ."
What can you do, as an attacker, when you find yourself as a low privileged Windows user with no path to SYSTEM? Install a vulnerable print driver! In this talk, you'll learn how to introduce vulnerable print drivers to a fully patched system. Then, using three examples, you'll learn how to use the vulnerable drivers to escalate to SYSTEM.”
In an email, Baines said he reported the vulnerability to Microsoft in June and didn't know why Microsoft published the advisory now.
"I was surprised by the advisory because it was very abrupt and not related to the deadline I gave them (August 7), nor was it released with a patch," he wrote.
"One of those two things (researcher public disclosure or availability of a patch) typically prompts a public advisory. I'm not sure what motivated them to release the advisory without a patch. That is typically against the goal of a disclosure program. But for my part, I have not publicly disclosed the vulnerability details and won't until August 7. Perhaps they have seen the details published elsewhere, but I have not."
Microsoft said it’s working on a patch but didn’t provide a timeline for its release. . ."It does have a CVSSv3 score of 7.8 (or High), but at the end of the day, it's just a local privilege escalation," he explained. "In my opinion, the vulnerability itself has some interesting properties that make it worthy of a talk, but new local privilege escalation issues are found in Windows all the time."
==============================================================================
How to mitigate Print Spooler Vulnerability “PrintNightmare”:
Disable Print Spooler Service or disable inbound remote printing through Group Policy
PrintNightmare is the most recent zero-day vulnerability impacting the Windows print spooler, and the vulnerability can enable an attacker to remotely control an affected system. The service that allows the spooling of documents in print has become a recurring nightmare for Microsoft. This flaw was found as indicated “CVE-2021-1675 “and classified as low risk since it only allows attacks based on escalation of privileges conducted locally with human input. Microsoft issued a patch for CVE-2021-1675, described as a “Windows Print Spooler Elevation of Privilege Vulnerability” last Tuesday (Patch Tuesday). The acknowledgment comes after researchers from Hong Kong-based cybersecurity company Sangfor published a technical deep-dive of a Print Spooler RCE flaw to GitHub, along with a fully working PoC code, before it was taken down just hours after it went up. For other articles I have written on GPO, see the following link. See this guide if you ever wanted to know what group policies are enabled or analyze GPO computers, and how to fix Print Spooler Service not running. Kindly refer to the fix (patch) to remediate the PrintNightmare “Out-of-Band Security Update for PrintNightmare: Patch released for Windows Print Spooler Remote Code Execution Vulnerability“.
Security researchers recently leaked details of a critical Windows print spooler vulnerability referred to as the "PrintNightmare". The flaw is a Stuxnet-style zero-day and can be exploited to completely compromise a Windows system. As explained by Bleeping Computer, researchers from Chinese security firm QiAnXin published a video showing that they had been able to achieve privilege escalation and remote code execution with the vulnerability. Then researchers from Sangfor, another Chinese security firm got a little mixed up and published a technical write up of what they thought was the same bug, calling it PrintNightmare.
- July 7th, 2021, the PrintNightmare security update for Windows Server 2012, 2016, and Windows 10, v1607 was released. But why are the Out-of-Band patches not effective for the Print Spooler vulnerability?
Saturday, July 17, 2021
7 Minutes Please > Research on Internet Speeds
We want to see your internet bill
/cdn.vox-cdn.com/uploads/chorus_image/image/69574701/acastro_170711_1777_0005.0.jpg)
"You don’t always get what you pay for in internet access. Most places only have one option, so you’re stuck picking the good plan or the bad plan from a single carrier, and if the expensive “broadband” plan turns out to be closer to dial-up speeds, there isn’t much you can do. And that’s without getting into the big swaths of the country that don’t even have a broadband option on the table.
So we’re joining with Consumer Reports to take a close look at the problem, collecting as many internet bills as we can to get a sense of which telecoms are holding up their end of the bargain — and which ones are falling short. The idea is to get a bird’s-eye view of the speeds people are actually getting, and what they’re paying for those speeds.
To get there, we want to take a look at your internet bill. Consumer Reports has put together a site to collect your information and do a quick speed test. The whole thing should take about seven minutes, and you’ll be doing your part to build a better internet.
A few quick notes on privacy:
> your bill will be encrypted as soon as you upload it, and Consumer Reports has pledged to only record relevant data such as price, bundle, speed, and hidden fees, and they’ll delete bills when they’re no longer needed.
> The site will ask you to create a login as a way to keep the information private and safe, but you won’t have to pay for anything and no personally identifiable information will be shared with outside researchers. You can get more answers about the specifics here.
We’re hoping this project will give us tens of thousands of bills to pore through, and spur on some great investigations for later on in the year. So head over to the site and show us your bill — and in a few months, we’ll tell you what we found.
Biggs Subject: "Performative Nonsense"...Whole Lot of Nothing This Week > Newsletter: The Biggs Idea
Count-down to Turning Point USA's rally in Phoenix next Saturday - one week to go to get those talking-points down pat for AZ Patriots
_0.png "BiggsBanner_red_(1)_0.png")
| |||
|
From the Associated Press in Arizona via The Guardian > Fewer than 200 Possible Voter Fraud Cases Among 3,400,000 Ballots Cast in 2020 Elections
Let's get right to the point:
Arizona counties find fewer than 200 possible voter fraud cases among 3m 2020 ballots
Findings undermine Trump’s claims after Biden beat him by more than 10,000 votes in state
Image Credit: Voters stand in line outside a polling station on election day last year in Mesa, Arizona. Photograph: Matt York/AP
"Arizona county election officials have identified fewer than 200 cases of potential voter fraud out of more than 3m ballots cast in last year’s presidential election, undercutting Donald Trump’s claims of a stolen election as his allies continue a disputed ballot review in the state’s most populous county.
The 182 cases identified by the Associated Press represent instances where problems were clear enough that officials referred them for further review. So far, only four cases have led to charges, including those identified in a separate state investigation. No one has been convicted. No vote was counted twice.
More cases could emerge but the numbers illustrate the implausibility of Trump’s claims that fraud and irregularities cost him the state. In final, certified and audited results, Joe Biden won 10,400 more votes in Arizona than Trump out of 3.4m cast.
The AP findings align with previous studies showing voter fraud is rare. Numerous safeguards are built into the system to prevent and detect it.
“The fact of the matter is that election officials across the state are highly invested in helping to ensure the integrity of our elections and the public’s confidence in them,” said Arizona’s secretary of state, Katie Hobbs, a Democrat. “And part of that entails taking potential voter fraud seriously.”
Of the four Arizona cases that have resulted in criminal charges, two involved Democratic voters and two Republicans.
The AP review supports statements made by state and local elections officials, as well as Republican county officials and Governor Doug Ducey, that Arizona’s presidential election was secure and its results valid.
Still, Arizona’s Republican-led state Senate has for months been conducting a “forensic audit” in Maricopa county, which covers Phoenix. The effort has been discredited by election experts and faced bipartisan criticism but some Republicans, including Trump, have suggested it will uncover widespread fraud.
“This is not a massive issue,” said Adrian Fontes, a Democrat who oversaw the Maricopa county election office during the 2020 election and lost his re-election bid. “It is a lie that has developed over time. It’s been fed by conspiracy theorists.”
The AP tallied the potential cases after submitting public record requests to all Arizona counties.
> Eleven out of 15 reported no potential cases. The majority of cases identified involve people casting a ballot for a relative who died or people who tried to cast two ballots.
An election integrity unit of the state attorney general’s office created in 2019 has been reviewing potential cases of fraud. A spokesperson for the attorney general, Mark Brnovich, told the AP in April the unit had 21 active investigations, although he did not specify if all were from last fall. A month later, the office indicted a woman for casting a ballot on behalf of her dead mother. A spokesperson declined to provide updated information this week.
> Maricopa county has identified just one case of potential fraud out of 2.1m ballots cast. That was a voter who might have cast a ballot in another state. The case was sent to the county attorney’s office, which forwarded it to the state attorney general.
> Virtually all the cases identified by county officials are in Pima county, home to Tucson, and involved voters who attempted to cast two ballots. The Pima recorder’s office has a practice of referring all cases with even a hint of fraud to prosecutors for review, something the state’s 14 other county recorders do not do.
> Pima officials forwarded 151 cases. They did not refer 25 from voters over age 70 because there was a greater chance those errors were the result of memory lapses or confusion, not criminal intent, an official said. None of the 176 duplicate ballots was counted twice.
An unusually high number of people appeared to have intentionally voted twice, often by voting early in person and then by mail. The Pima county deputy recorder, Pamela Franklin, noted several factors, including worries about US Postal Service delays.
In addition, Trump at one point encouraged voters who cast their ballots early by mail to show up at their polling places on election day and vote again if poll workers could not confirm their mail ballots had been received.
The results in Arizona are similar to early findings in other battleground states. Officials in Wisconsin identified just 27 potential cases of fraud out of 3.3m ballots cast last November, according to records obtained by the AP.
The AP conducted the review following months of Trump and his allies claiming without proof he won the 2020 election. His claims of widespread fraud have been rejected by election officials, judges, election security officials and even his own attorney general.
Even so, supporters repeat them and they have been cited by state lawmakers as justification for tighter voting rules.
In Arizona, Republicans have used the unsubstantiated claims to justify the unprecedented review of the election in Maricopa county and to pass legislation that could make it harder for infrequent voters to receive mail ballots automatically.
-
Flash News: Ukraine Intercepts Russian Kh-59 Cruise Missile Using US VAMPIRE Air Defense System Mounted on Boat. Ukrainian forces have made ...
