Infosec in brief Cybersecurity researchers informed Microsoft that Notorious North Korean hackers Lazarus Group discovered the “holy grail” of rootkit vulnerabilities in Windows last year, but Redmond still took six months to patch the problem.
Researchers at Avast said they informed Microsoft of a serious admin-to-kernel exploit in a driver associated with AppLocker, the app for whitelisting software built into Windows, in August of last year.
“This presented an ideal exploitation scenario, allowing the attacker to call an arbitrary kernel function with a high degree of control over the first argument.”
Avast claims Lazarus Group used the vulnerability to obtain read/write primitive on the Windows kernel and install their FudModule rootkit, but Microsoft’s opinion on the severity of admin-to-kernel exploits meant it didn’t prioritize the matter, waiting until February’s patch Tuesday to fix the issue, which it tagged as CVE-2024-21338, with a CVSS score of 8/10.
Of admin-to-kernel issues, Microsoft said administrative processes and users are part of Trusted Computing Base for Windows, and thus “not strong [sic] isolated from the kernel boundary.”
“By providing complementary security certifications, we aim to break down barriers and create opportunities for women in Jordan, fostering a more inclusive and diverse workforce,” OpenSSF said.
The original article contains 705 words, the summary contains 200 words. Saved 72%. I’m a bot and I’m open source!
This is the best summary I could come up with:
Infosec in brief Cybersecurity researchers informed Microsoft that Notorious North Korean hackers Lazarus Group discovered the “holy grail” of rootkit vulnerabilities in Windows last year, but Redmond still took six months to patch the problem.
Researchers at Avast said they informed Microsoft of a serious admin-to-kernel exploit in a driver associated with AppLocker, the app for whitelisting software built into Windows, in August of last year.
“This presented an ideal exploitation scenario, allowing the attacker to call an arbitrary kernel function with a high degree of control over the first argument.”
Avast claims Lazarus Group used the vulnerability to obtain read/write primitive on the Windows kernel and install their FudModule rootkit, but Microsoft’s opinion on the severity of admin-to-kernel exploits meant it didn’t prioritize the matter, waiting until February’s patch Tuesday to fix the issue, which it tagged as CVE-2024-21338, with a CVSS score of 8/10.
Of admin-to-kernel issues, Microsoft said administrative processes and users are part of Trusted Computing Base for Windows, and thus “not strong [sic] isolated from the kernel boundary.”
“By providing complementary security certifications, we aim to break down barriers and create opportunities for women in Jordan, fostering a more inclusive and diverse workforce,” OpenSSF said.
The original article contains 705 words, the summary contains 200 words. Saved 72%. I’m a bot and I’m open source!