Windows 10: is this for real https://secure.logmeinrescue.com/Customer/Code.aspx

is this reAL? I CALLED THIS NUMBER AND ASKED IS THIS MICROSOFT. THEY SAID YES...WHY AM I GETTING THIS.


I DID NOT GO FURTHER AND DID NOT ALOW THEM ACCESS TO MY COMPUTER,. WHAT DO i DO? HOW DO I MAKE THIS MESSAGE DISAPPEAR. HOW DID THEY GET TO ME... AND WHY WHEN I CHECK MY MICROSOFT PROTECTION... DO I GET EVERYTHING IS OK.


ROZANNE



https://xspec3.ga/wmn2-9499/ChxLogMeIn123.com – Start Support Connectionrx-692831/?&gclid=EAIaIQobChMI2cigvuvk7AIVFu7ACh37UgjIEAEYASAAE J35vD_BwE

:)

 

"logmeinrescue" is it a legitimate micorsoft technical support site.

LogMeInRescue is not a Microsoft product.

LogMeInRescue is a legitimate product by LogMeIn, Inc.

LogMeInRescue might be used by official Microsoft support people.

You might want to read the reply here which supplies some more info:
https://answers.microsoft.com/en-us/protect/forum/protect_other-protect_scanning-windows_8/helpmenet/be75da52-92c2-4856-ae3b-6e21bf685bc3?messageId=582f9879-80a3-49e6-9c66-eb9e91f5f1c4

Read:
https://answers.microsoft.com/en-us/windows/forum/windows_10-update/how-to-remove-support-logmeinrescue/b26cd192-dc9e-42bb-9f21-dd04d5ef76d1

And/or read one or the other thread from this search:
https://duckduckgo.com/?q=uninstall+logmeinrescue+site%3Aanswers.microsoft.com&t=ffsb&ia=web

In addition you might want to ask here: http://help.logmein.com/pkb_Home?l=en_US&c=products%3Almirescue
or here:
http://community.logmein.com/

 

Microsoft account security code - WHY?

Thanks for the reply Greg.

"If you turn on two-step verification, you’ll get a security code to your email, phone, or authenticator app every time you sign in on
a device that isn't trusted. When two-step verification is turned off, you will only have to verify your identity with security codes periodically, when
there might be a risk to your account security."

Overkill.

As Two-Step verification has never been turned on, I presume MS thinks every time I log into access pages on https://account.microsoft.com/ pages I'm a risk to my account. Even from computers listed in the 'Devices" tab of those pages. Even though I have
to supply my MS password to get to those pages.

Are you suggesting I turn two-step verification on, which is what I don't need?

 

AtomBombing: A Code Injection that Bypasses Current Security Solutions



"Our research team has uncovered new way to leverage mechanisms of the underlying Windows operating system in order to inject malicious code. Threat actors can use this technique, which exists by design of the operating system, to bypass current security solutions that attempt to prevent infection. We named this technique AtomBombing based on the name of the underlying mechanism that this technique exploits.

AtomBombing affects all Windows version. In particular, we tested this against Windows 10.

Unfortunately, this issue cannot be patched since it doesn’t rely on broken or flawed code – rather on how these operating system mechanisms are designed."

Code Injection 101
"The issue we revealed presents a way for threat actors to inject code. Attackers use code injection to add malicious code into legitimate processes, making it easier to bypass security products, hide from the user, and extract sensitive information that would otherwise be unattainable.

For example, let’s say an attacker was able to persuade a user to run a malicious executable, evil.exe. Any kind of decent application level firewall installed on the computer would block that executable’s communication. To overcome this issue, evil.exe would have to find a way to manipulate a legitimate program, such as a web browser, so that the legitimate program would carry out communication on behalf of evil.exe.

This manipulation technique is known as code injection."

Code Injection: An Important Tool in the Attacker’s Toolbox
"There are quite a few reasons why code injection is useful. An attacker may use code injection, for example, to:

• Bypass process level restrictions: Many security products employ a white list of trusted processes. If the attacker is able to inject malicious code into one of those trusted processes, the security product can easily be bypassed.
• Access to context-specific data. Some data is only accessible to certain processes, while inaccessible to others. For example:
  • Taking screenshots. A process that takes a screenshot of the user's screen, must run within the context of the user's desktop. However, more often than not malware will be loaded into the services desktop, not the user’s, preventing the malware from taking a screenshot of the user's desktop. Using code injection, a malware can inject code into a process that’s already running in the user's desktop, take a picture and send it back to the malware in the services desktop.
  • Performing Man in the Browser (MitB) attacks. By injecting code into a web browser an attacker can modify the content shown to the user. For example, in a banking transaction process, the customer will always be shown the exact payment information as the customer intended via confirmation screens. However, the attacker modifies the data so that the bank receives false transaction information in favor of the attacker, i.e. a different destination account number and possibly amount. In a MitB attack, the customers are unaware of the money being funneled out of their account until it’s too late.
  • Accessing encrypted passwords. Google Chrome encrypts the user's stored passwords by using Windows Data Protection API (DPAPI). This API uses data derived from the current user to encrypt/decrypt the data and access the passwords. In this scenario, a malware that is not running in the context of the user will not be able to access the passwords. However, if the malware injects code into a process that's already running in the context of the current user, the plain-text passwords can be easily accessed."

Behind the Scenes of AtomBombing
"The underlying Windows mechanism which AtomBombing exploits is called atom tables. These tables are provided by the operating system to allow applications to store and access data. These atom tables can also be used to share data between applications.

What we found is that a threat actor can write malicious code into an atom table and force a legitimate program to retrieve the malicious code from the table. We also found that the legitimate program, now containing the malicious code, can be manipulated to execute that code.

For the technology deep dive, please the researcher’s post here: https://breakingmalware.com/injection-techniques/atombombing-brand-new-code-injection-for-windows/ "

Code Injections in the Past
"Currently there are just a handful of known code injection techniques. A list of several of these can be found here: Code Injection Techniques - Infosec, Inc.

Additionally, last summer our research team found a new code injection technique called PowerLoaderEx. PowerLoaderEx enables an attacker to inject code without needing to actually write code or data to the injected process.

Once a code injection technique is well-known, security products focused on preventing attackers from compromising the endpoints (such as anti-virus and host intrusion prevention systems), typically update their signatures accordingly. So once the injection is known, it can be detected and mitigated by the security products.

Being a new code injection technique, AtomBombing bypasses AV, NGAV and other endpoint infiltration prevention solutions."

Mitigation
"AtomBombing is performed just by using the underlying Windows mechanisms. There is no need to exploit operating system bugs or vulnerabilities.

Since the issue cannot be fixed, there is no notion of a patch for this. Thus, the direct mitigation answer would be to tech-dive into the API calls and monitor those for malicious activity.

It’s important though at this point to take a step back. AtomBombing is one more technique in the attacker’s toolbox. Threat actors will continuously take out a tool – used or new - to ensure that they bypass anti-infiltration technologies (such as AV, NGAV, HIPS, etc).

Obviously we need to find a different way to deal with threat actors. Under the assumption that threat actors will always exploit known and unknown techniques, we need to build our defenses in a way that prevents the consequences of the attack once the threat actor has already compromised the environment."

Fortinet Blog - Broad, Integrated, Automated Cybersecurity

About Atom Tables:
https://msdn.microsoft.com/en-us/library/windows/desktop/ms649053(v=vs.85).aspx?f=255&MSPPError=-2147217396