Critical - Print Spooler Bug allows hacker to hack any version of Windows

Microsoft's July Patch Tuesday offers 11 security bulletins with six rated critical resolving almost 50 security holes in its software.

The company has patched a security flaw in the Windows Print Spooler service that affects all supported versions of Windows ever released, which if exploited could allow an attacker to take over a device via a simple mechanism.

The "critical" flaw (CVE-2016-3238) actually resides in the way Windows handles printer driver installations as well as the way end users connect to printers.

The flaw could allow an attacker to install malware remotely on victim machine that can be used to view, modify or delete data, or create new accounts with full user rights; Microsoft said in MS16-087 bulletin posted Tuesday.

Users who are logged in with fewer user rights on the system are less impacted than users who operate with administrative user rights, such as some home accounts and server users.

Microsoft said the critical flaw could be exploited to allow remote code execution if an attacker can conduct a man-in-the-middle (MiTM) attack on a system or print server or set up a rogue print server on a target network.

The critical flaw was discovered and reported by the researchers at security firm Vectra Networks, who disclosed some details on the vulnerability, but didn't publish their proof-of-concept (POC) code.

You can watch the video that shows the hack in action:

In corporate networks, by default network administrators allow printers to deliver the necessary drivers to workstations or systems connected to the network. These drivers are silently installed without user interaction and run with full privileges under the SYSTEM user.

According to researchers, attackers can replace these drivers on the printer with malicious files that could allow them to execute code of their choice.

More worrisome: If the printer is behind a firewall, attackers can even hack other device or computer on that particular network, and then use it to host their malicious files.

Watering Hole Attacks via Printers

Like servers, multiple computers are also connected to printers in an effort to print documents as well as download drivers. So, this flaw allows a hacker to execute watering hole attacks technically using printers.

Watering hole attacks, or drive-by downloads, are used to target businesses and organizations by infecting them with malware to gain access to the network.

"Rather than infecting users individually, an attacker can effectively turn one printer into a watering hole that will infect every Windows device that touches it," said Vectra chief security officer Gunter Ollmann.

"Anyone connecting to the printer share will download the malicious driver. This moves the attack vector from physical devices to any device on the network capable of hosting a virtual printer image."

This flaw (CVE-2016-3238) is by far the most dangerous vulnerability of the year, which is easy to execute, provides different ways of launch attacks, and affects a huge number of users.

A second related vulnerability, CVE-2016-3239, in MS16-087 bulletin is a privilege escalation flaw that could allow attackers to write to the file system.

A security bulletin for Microsoft Office, MS16-088, includes patches for seven remote code execution (RCE) vulnerabilities, 6 of them are memory corruption flaws, which affects Microsoft Office, SharePoint Server as well as Office Web Apps.

The flaws can be exploited by specially crafted Office files, allowing attackers to run arbitrary code with same privileges as the logged in user.

Bulletin MS16-084 addresses flaws in Internet Explorer and MS16-085 in Microsoft Edge. The IE flaws include RCE, privilege escalation, information disclosure and security bypass bugs.

Edge flaws include a handful of RCE and memory corruption flaws in the Chakra JavaScript engine, as well as an ASLR bypass, information disclosure, browser memory corruption, and spoofing bugs.

Bulletin MS16-086 addresses a vulnerability in the JScript and VBScript engines in Windows, which could allow an attacker to execute remote code execution flaw, affecting VBScript 5.7 and JScript 5.8.

Rest five bulletins rated as important address flaws in Windows Secure Kernel Mode, Windows Kernel-Mode Drivers, the .NET framework, the Windows Kernel, and Secure Boot process.

Users are advised to patch their system and software as soon as possible.

Beware ! it could be Malicious to download Pokemon Go Game for Android

"Pokémon Go" has become the hottest iPhone and Android game to hit the market in forever with enormous popularity and massive social impact. The app has taken the world by storm since its launch this week.

Nintendo's new location-based augmented reality game allows players to catch Pokémon in the real life using their device's camera and is currently only officially available in the United States, New Zealand, UK and Australia.

On an average, users are spending twice the amount of time engaged with the new Pokémon Go app than on apps like Snapchat. In fact Pokémon Go is experiencing massive server overload in just few days of launch.

Due to the huge interest surrounding Pokémon Go, many gaming and tutorial websites have offered tutorials recommending users to download the APK from a non-Google Play link.

In order to download the APK, users are required to "side-load" the malicious app by modifying their Android core security settings, allowing their device's OS to install apps from "untrusted sources."

Pokémon Go is Installing DroidJack Malware

Security researchers have warned users that many of these online tutorials are linked to malicious versions of the Pokémon Go app that install a backdoor on Android phones, enabling hackers to compromise a user's device completely.

Security firm Proofpoint has discovered the malicious app, or APK, that has been infected withDroidJack – a Remote Access Tool (RAT) that can hack any Android device by opening a silent backdoor for hackers.

Just less than 3 days after Nintendo initially released the game in Australia and New Zealand on July 4, the malicious app was uploaded to an online malware detection repository.

Since Android core security settings normally prevent the installation of untrusted third-party apps from "unknown sources," side-loading should have never been done by a user.

"This is an extremely risky practice and can easily lead users to install malicious apps on their own mobile devices," researchers at Proofpoint wrote in a blog post. "Should an individual download an APK [Android application package] from a third-party that has been infected with a backdoor, like the one we discovered, their device would then be compromised."

Here's How to Prevent Yourself

Fortunately, there are several ways to check if you have downloaded the malicious version of the Pokémon Go app.

The infected version of the Pokémon Go app would have been granted more system permissions, so one way to differ between the two is to compare the permissions of your app to those of the legitimate one.

To do so, Go to the Settings → Apps → Pokemon GO and check the game's permissions.

If you find that the game has asked for permissions like directly call phone numbers, edit and read your SMSes, record audio, read Web history, modify and read your contacts, read and write call logs, and change network connectivity, then you should uninstall the game right away, since it is infected with DroidJack.

You can also compare the game's SHA-1 hash – a long string of characters used to verify if a file was infected with or modified by a malicious third-party – to make sure the game matches the hash of the legitimate version.

The Bottom Line:

Instead of downloading available applications from unknown third party stores, wait for the Pokémon Go app to launch in your country.

However, downloading apps from third parties do not always end up with malware or viruses, but it certainly ups the risk. So, it's the best way to wait in order to avoid compromising your device and the networks it accesses.

Antivirus firm Avast to BUY AVG for $1.3 Billion

Antivirus company Avast Software is planning to acquire Dutch rival AVG Technologies for $1.3 Billion in cash.

Avast announced today that it would buy Amsterdam-based AVG Technologies for $25 per share in an all-cash transaction valued at $1.3 Billion in an aim to expand its presence in the emerging markets.

With more than 230 Million users worldwide, Avast provides free and paid security software packages for both PCs as well as mobile devices to businesses and individuals.

The deal between the two popular security software companies will provide Avast with 400 Million endpoints -- devices that have some form of Avast or AVG application installed. Around 160 Million of those are mobile.

However, AVG technologies was in controversies for updating its policy that clearly said that the company will be allowed to collect and sell users' "non-personal data" to online advertisers in order to "make money" from their "free offerings" so they can keep them free.

With access to a large number of devices, Avast will be granted more opportunities in Internet antivirus and security-related business, giving the company a bigger pool of data on malware to offer better security products.

"We believe that joining forces with Avast, a private company with significant resources, fully supports our growth objectives and represents the best interests of our stockholders," AVG CEO Gary Kovacs said in a statement.

The deal will also provide Avast with an expanded geographical reach in its primary business as well as the growing number of Internet of Things -- physical devices connected to the Internet, Avast said in a statement.

The offer of $25 per share on AVG represents a 33 percent premium to its closing price Wednesday on the NY Stock Exchange. Avast will fund the transaction using cash on hand and debt financing.

This is the next major tech acquisition in last few months. Just last month, Microsoft made its biggest acquisition by acquiring LinkedIn, the social network for professionals, for $26.2 Billion in cash.

Facebook Launches OpenCellular - An open source Wireless Access Platform

Big technology companies are in the race of bringing Internet connectivity to unconnected parts of the world through flying drones, high-altitude balloons, and laser beams, but Facebook has announced a far less expensive method to provide connectivity to rural areas.

Facebook CEO Mark Zuckerberg announced Wednesday the creation of a new open-source wireless communication platform called OpenCellular that can be easily deployed in remote locations by anyone.

OpenCellular is a doorbell-sized hardware device that could be attached to a pole or tree at a range of heights from where it can deliver a wireless network, from 2G cell-phone networks to higher speed LTE, and Wi-Fi networks like those inside your home, or local coffee shop.

The device is designed to work in rural locations in conditions, including high winds, extreme temperatures, and harsh climates.

But, wait! This doesn't mean that Facebook is rolling out its own broadband services.

Facebook to Open-Source the Designs and Software of OpenCellular

The social networking plans to open source the designs for this device so that service providers, researchers, and others can use its designs and control software for free to build their own boxes that are cheap to purchase and maintain.

"We designed OpenCellular as an open system so anyone—from telecom operators to researchers to entrepreneurs—can build and operate wireless networks in remote places," Zuck said. "It's about the size of a shoe box and can support up to 1,500 people from as far as 10 kilometers away."

Facebook has tested the new system at its headquarters in Menlo Park, California and, so far, it has been able to successfully use the device to send and receive text messages, make voice calls and access relatively slow 2G data connections.

OpenCellular is Zuckerberg's latest attempt to push its goal of worldwide Internet access, aiming to connect the next 4 Billion people across the world without Internet access and nearly 700 million people without cellular service.

Facebook's Free Basics -- an initiative to provide free access to certain Internet websites, including Facebook -- was banned in India from earlier this year due to the violation of Net Neutrality principles, while Egypt followed suit in April.

Besides OpenCellular, Facebook's other global connectivity initiatives include its high-bandwidth Internet laser beams, solar-powered aircraft Aquila and unmanned solar-powered Internet-distributing plane.

The initial version of OpenCellular's platform will be available this summer, but meanwhile, Facebook is testing out the devices at its headquarters and planning outdoor tests with its initial OEMs and Telecom Infra Project (TIP) partners.

Facebook Messenger Now Offers End-to-End Encryption for Chats

Following the recent surge in demand for secure apps, Facebook is now offering a new end-to-end encryption mode on Messenger, called Secret Conversations. The mode is currently available for a few users and could be in for prime time later this summer.

The mode brings Messenger in equal standing with competitors like iMessage, BBM and Whatsapp who already offer end-to-end encryption. Facebook highlights health and financial information as potential avenues where it could be used. It is not totally secure, but at least it demands a more sophisticated attack.

The mode resides inside the Messenger app, requiring no further installs. It will only work on one unique device at a time, be it your phone, laptop or desktop which makes sense as messages will only appear on the devices they’re delivered to. It will be very limited in terms of features at first, not supporting GIFs, payments, videos or any other Messenger features. Secret Conversations also won’t be turned on by default.

Users can time their messages to self-destruct after an allotted period, allowing greater controls over privacy.

Facebook, which came recently under fire from users for supposedly making their shared links on Messenger easy for marketers to find, is releasing the feature as a way to appease some of the bad press.

With 900 million users under its pocket, Messenger could be highly successful in getting encryption to larger populations. That is, if Facebook can shed away the trust issues to begin with.