Microsoft February Patch Tuesday: 14 Critical Updates
Microsoft's Patch Tuesday release for February includes patches for 14 critical vulnerabilities, 34 important patches and 2 moderate severity patches.
Critical flaws in the Edge browser and the Outlook client have been addressed along with a number of memory corruption issues in the script engines that are used by Edge and Internet Explorer.
Microsoft have also released modified patches for the Meltdown and Spectre vulnerabilities, for 32-bit versions of Windows 10 on Intel x86 devices. Previously released patches had to be disabled due to rebooting issues, instability and data loss.
Users with 32-bit systems are being advised to install the update as soon as possible.
Adobe also released security patches for Acrobat, Reader and their Experience Manager products, to fix 41 security vulnerabilities with 17 of these being critical.
Google Chrome: HTTP Sites Flagged as Not Secure from July 2018
From July 2018, Google Chrome browsers will label all HTTP websites as 'Not Secure'.
Google began their 'Not Secure' labeling last year, flagging credit card forms and login pages without HTTPS as unsafe. At the moment HTTP sites show a neutral indicator (!) before the address but from July onwards (Chrome 68) this will change to show the 'Not Secure' statement.
Website owners are being urged to switch their sites to HTTPS as it encrypts data transmission and protects both visitors and site owners from their data being intercepted by attackers.
Government Websites Hacked for Cryptocurrency Mining
Government websites around the world have been infected with cryptocurrency mining scripts.
Attackers hijacked a third-party accessibility plugin known as 'Browsealoud', injecting their mining script into the plugin code. Many websites, particularly government, use the Browsealoud plugin to provide access to their websites for blind and partially-sighted users, as it converts text into audio.
Over 4,200 websites were found to have been infected with the mining software, including many Australian government and services sites. The script that compromised this plugin is owned by CoinHive, a Monero mining service that is browser based and uses the visitors CPU to mine for Monero.
Texthelp, the Browsealoud operator, removed the plugin from all websites as soon as they were notified.
Android Devices Forced Into Mining Monero
Forced crypto mining appears to be all the rage at the moment, with millions of Android devices appearing to be duped into mining Monero for cybercriminals.
Malwarebytes documented a campaign that is believed to have started in November 2017, where mobile users, particularly Android devices, are being redirected to pages specially designed to mine cryptocurrency from the user's browser.
Users are then asked to prove that they are human by entering the captcha shown on the screen and that if they fail to do so, their browser will continue to mine Monero in order for the the crooks to "recover server costs incurred by bot traffic".
Android users who have started seeing these fake pages on their device are being advised that one of their latest installed apps is infected and responsible. Uninstalling it should resolve the issue.