Microsoft has released a security update through Windows Update that fixes CVE-2018-0986, a vulnerability in the Microsoft Malware Protection Engine used in Windows Defender, Microsoft Security Essentials, Microsoft Endpoint Protection, Windows Intune Endpoint Protection, and Microsoft Forefront Endpoint Protection. Users should install the latest updates to install the fixes.
Security researcher Satoshi Tanda has discovered that a bug in AMSI truncates files after a null character. The Antimalware Scan Interface (AMSI) is a generic interface standard that allows applications and services to integrate with any antimalware product present on a machine. It provides enhanced malware protection for users and their data, applications, and workloads.
Source: satoshi’s note
On Jan 3 Microsoft released updates addressing these vulnerabilities for the following operating systems with more to come:
Windows Server 2008 R2
Windows Server 2012 R2
Windows Server 2016
Windows Server Core
We are not recommending you install these during business hours or without Technical assistance as there are reports of systems failing to boot patch as of today
A new widespread ransomware is spreading like in Europe. Named “Bad Rabbit,” is reportedly a new Petya-like targeted ransomware attack demanding 0.05 bitcoin as ransom from victims to unlock their systems.
The ransomware was distributed via download attacks, using fake Adobe Flash players installer to lure victims’ in to install malware unwittingly. Users should not install any software they are prompted to without their intervention.
A vulnerability in the WPA2 wireless protocol called Krack potentially allow attackers to eavesdrop on wireless connections and inject data into the wireless stream in order to install malware or modify web pages.
To protect yourself, many Wi-Fi product vendors will be releasing updated firmware and drivers for their products. It is strongly recommended that users update their hardware or have it updated as soon as a update is available in order to protect themselves. This includes router firmware and wireless network card drivers.