Cyber risk and advisory programs that identify security gaps and build strategies to address them.
MDR that provides improved detection, 24/7 threat hunting, end-to-end coverage and most of all, complete Response.
Our team delivers the fastest response time in the industry. Threat suppression within just 4 hours of being engaged.
Be protected by the best from Day 1.
24/7 Threat Investigation and Response.
Expert hunting, research and content.
Defend brute force attacks, active intrusions and unauthorized scans.
Safeguard endpoints 24/7 by isolating and remediating threats to prevent lateral spread.
Investigation and enhanced threat detection across multi-cloud or hybrid environments.
Configuration escalations, policy and posture management.
Detects malicious insider behavior leveraging Machine Learning models.
Customer testimonials and case studies.
Stories on cyberattacks, customers, employees, and more.
Cyber incident, analyst, and thought leadership reports.
Demonstrations, seminars and presentations on cybersecurity topics.
Information and solution briefs for our services.
MITRE ATT&CK Framework, Cybersecurity Assessment, SOC Calculator & more
THE THREAT
In Microsoft’s February Patch Tuesday release, fifty-eight separate vulnerabilities received security patches. Five vulnerabilities from this release stand out as especially concerning.
Microsoft identified a zero-day vulnerability (CVE-2021-1732) impacting Windows 10 devices. The vulnerability has been exploited in the wild prior to patch release for privilege escalation. Additionally, Microsoft released fixes for multiple vulnerabilities in their implementation of TCP/IP (CVE-2021-24074, CVE-2021-24094, and CVE-2021-24086) affecting multiple Windows products. Lastly, Microsoft patched a critical vulnerability in the Windows Fax Service (CVE-2021-24077), that could be exploited to cause remote code execution. These vulnerabilities have not been exploited in the wild at this time, but exploitation is expected in the near future.
It is recommended that organizations apply patches for all impacted products as soon as possible.
What we’re doing about it
What you should do about it
Additional information
Windows Win32k Elevation of Privilege Vulnerability
CVE-2021-1732 (CVSS:3.0 7.8)
A vulnerability exists in the core system component of Windows which could grant system level access when executed. This is a zero-day vulnerability, meaning exploitation in the wild has been identified. Exploitation requires the ability to execute code locally on a device. For a list of affected Windows versions, see Microsoft’s Update Guide.
Multiple Vulnerabilities in Windows implementation of TCP/IP
CVE-2021-24074 (CVSS:3.0 9.8)
CVE-2021-24094 (CVSS:3.0 9.8)
CVE-2021-24086 (CVSS:3.0 7.5)
Microsoft released security updates for three vulnerabilities impacting their implementation of networking TCP/IP protocols. These vulnerabilities affect all Windows versions and should be prioritized for patching or mitigated with workarounds. In their blog post, Microsoft states the vulnerabilities were discovered internally and creating working remote code execution exploits would be complex. Microsoft does warn that Denial-of-Service exploits are more likely to emerge. There is currently no known exploitation of these vulnerabilities in the wild.
Windows Fax Service Remote Code Execution Vulnerability
CVE-2021-24077 (CVSS:3.0 9.8)
A remotely exploitable vulnerability exists in Windows Fax Service. An attacker with network access to a vulnerable device can execute code. In order to exploit this vulnerability, both the Windows Fax and Scan feature and Fax service need to be enabled and running. This vulnerability was discovered by 3rd parties and technical details or proof-of-concept exploits are not public. There are no reports of in-the-wild exploits at this time. For a list of affected Windows versions see Microsoft’s Update Guide.
References:
[1] https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-1732
[2] https://msrc-blog.microsoft.com/2021/02/09/multiple-security-updates-affecting-tcp-ip/
[3] https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2021-24077