 In Windows 10, Microsoft added a new ransomware protection feature called Controlled Folder Access that can be used to prevent modifications to files in protected folders by unknown programs. At the DerbyCon security conference last week, a security researcher showed how DLL injection can be used by ransomware to bypass the Controlled Folder Access ransomware protection feature. Controlled Folder Access is a feature that allows you to protect folders and the files inside them so that they can only be modified by an application that is whitelisted. The whitelisted applications are either ones that you specify or ones that are whitelisted by default by Microsoft. Knowing that the explorer.exe program is whitelisted in Controlled Folder Access, Soya Aoyama, a security researcher at Fujitsu System Integration Laboratories Ltd., figured out a way to inject a malicious DLL into Explorer when it is started. Since Explorer is whitelisted, when the DLL is injected it will launch and be able to bypass the ransomware protection feature. To do this, Aoyama relied on the fact that when explorer.exe starts, it will load DLLs found under the HKEY_CLASSES_ROOT*shellexContextMenuHandlers registry key. The HKEY_CLASSES_ROOT tree is a merge of registry information found in HKEY_LOCAL_MACHINE and HKEY_CURRENT_USER. When performing the merge, Windows gives the data in the HKCU tree precedence. Tune into OUR FORUM to learn more.  Google has decided to shut down its social media website Google+ after a massive data breach which potentially exposed data of over 500,000 users. Google has since decided to shut down the network for consumers. The company said it didn’t report the breach partly due to fears of regulatory scrutiny. This comes from the Wall Street Journal who cited unnamed sources and internal documents. Google said the bug hasn’t affected the personal data but is investigating the issue. Google found the issue with their API back in March but chose to ignore it and not report it to the regulatory bodies. This is in direct violation of GDPR which says that any data breach should be reported within 72 hours. Google said a glitch in the social site gave outside developers potential access to private Google+ profile data between a major redesign in 2015 and March 2018, when internal investigators discovered and fixed the issue. Wall Street Journal also reported that Google Chief Executive Officer Sundar Pichai was briefed on the plan not to notify users as it would result in an immediate regulatory interest. Since the breach has been reported, it would be interesting to see how the regulatory bodies respond to this. Find out what Google had to say about this breach on OUR FORUM.  At Microsoft’s Surface event the company announced a brand-new accessory, the Surface Headphones, and the company has slowly been trickling out details regarding its pricing and availability. The headphones, which are appealing especially to developers and other office workers who want to maintain their productivity in distraction-prone environments, utilize 4 beam-forming microphones, 4 active noise-canceling microphones, and 13 levels of noise reduction for up to 30 dB for active noise cancellation to keep users focused. They also feature 40 mm free drivers delivering up to115 dB, automatic pause and play, support phone calls, USB-C charging, 3.5mm connectivity, Microsoft’s own Bluetooth fast pair technology and 15 hours of battery life. At the time of their announcement, Microsoft did not reveal the pricing and availability of the Cortana-powered headphones, but we have recently heard they will be retailing for $350, in line with similar offerings by Bose and Sony. Microsoft has been working on the headphones for the last three years and Panos Panay called them “One of my dream products right now.” Visit OUR FORUM for more information and links. |
Latest Articles
|