Windows 10: Microsoft Security Intelligence Report Vol. 24 January - December 2018

Brink · Feb 28, 2019

Hello and welcome to the 24th edition of the Microsoft Security Intelligence Report (SIR). As a practitioner and security architect, I read reports like this hoping to understand the landscape a little better with the takeaway of practical advice about how to use that knowledge to defend and protect organizations more effectively.

The SIR team brings the spirit of education for improved cyber-resilience to this report and has sifted through a year of data to distill out the most important lessons.

What you’re reading are insights culled from a year of security data analysis and hands-on lessons learned. Data analyzed includes the 6.5 trillion threat signals that go through the Microsoft cloud every day and the research and realworld experiences from our thousands of security researchers and responders around the world. In 2018, attackers used a variety of dirty tricks, both new (coin-mining) and old (phishing), in their ongoing quest to steal data and resources from customers and organizations. Hybrid attacks, like the Ursnif campaign, blended social and technical approaches. As defenders got smarter against ransomware, a loud and disruptive form of attack, criminals pivoted to the more “stealth”, but still profitable, coin-miners.

That “pivot” can feel frustrating, like attackers are always one step ahead. But viewed through a different lens, the story here is a positive one. Defenders and cybersecurity professionals like you implemented defensive techniques that forced attackers to change their preferred payloads and move away from ransomware.

Another area where cyber criminals increased their activity is the supply chain. One of the most notable, the Dofoil coin-miner outbreak, which hit on March 6, 2018, was kicked off by a poisoned peer-to-peer app. Supply chain concerns went beyond apps and into the cloud and included malicious browser extensions, compromised Linux repositories, and multiple instances of back-doored modules. To address this threat, organizations are moving towards a transparent and trusted supply chain model.

Data is great, but sometimes it helps to find out what really happened at an organization. That’s why we’ve included lessons learned in the field from our Detection and Response Team (DART). These include how a large manufacturing company was able to implement controls to block a multi-phased phishing campaign that had been plaguing them for months, and financial services organizations that were finally able to eradicate threat actors from their systems using advanced investigation tools and endpoint monitoring.

Last but not least, phishing clicks continued to go up – but machine learning models are getting better at catching phish before they hit user boxes and preventing harm after click if they do. More good news? An increasing number of companies are implementing multi-factor solutions to limit the success of credential theft phishing emails.

Attackers look for opportunities, so the more we know about their techniques and tradecraft, the better prepared we’ll be to build defenses and respond quickly. Small important steps can make a huge difference in the overall cybersecurity health of an organization. That’s why along with deep insights on the shifting malware and attack landscape, you’ll find recommended steps and other best practice guidance in this report. Because when I was a practitioner that’s exactly what I needed in my fight against the bad guys. We hope it’s what you need too.

Diana Kelley
Microsoft Cybersecurity Field CTO

P.S. We’re always looking to improve the SIR. If you’ve got feedback, please reach out and let us know how we’re doing
Click to expand...

Read more: Microsoft Security Intelligence Report Vol. 24 January - December 2018 (PDF)

:)

NICK ADSL UK · Feb 28, 2019

Microsoft December 2018 Security Updates

Security Update Guide
> Release Notes
Release Notes
December 2018 Security Updates
Release Date: December 11, 2018

The December security release consists of security updates for the following software:

Adobe Flash Player

Internet Explorer

Microsoft Edge

Microsoft Windows

Microsoft Office and Microsoft Office Services and Web Apps

ChakraCore

.NET Framework

Microsoft Dynamics NAV

Microsoft Exchange Server

Microsoft Visual Studio

Windows Azure Pack (WAP)

Please note the following information regarding the security updates:

A list of the latest servicing stack updates for each operating system can be found in

ADV990001. This list will be updated whenever a new servicing stack update is released. It is important to install the latest servicing stack update.

Windows 10 updates are cumulative. The monthly security release includes all security fixes for vulnerabilities that affect Windows 10, in addition to non-security updates. The updates are available via the

Microsoft Update Catalog.

Starting in March 2017, a delta package will be available on the Microsoft Update Catalog for Windows 10 version 1607 and newer. This delta package contains just the delta changes between the previous month and the current release.

Updates for Windows RT 8.1 and Microsoft Office RT software are only available via

Windows Update.

For information on lifecycle and support dates for Windows 10 operating systems, please see

Windows Lifecycle Facts Sheet.

In addition to security changes for the vulnerabilities, updates include defense-in-depth updates to help improve security-related features.

The following CVEs have FAQs with additional information and may include * further steps to take after installing the updates.

CVE-2018-8477

CVE-2018-8514

CVE-2018-8580

CVE-2018-8595

CVE-2018-8596

CVE-2018-8598

CVE-2018-8616

CVE-2018-8621

CVE-2018-8622

CVE-2018-8627

CVE-2018-8637

CVE-2018-8638

Known Issues

4471321

4471327

4471329

4471324

4471318

{{windowTitle}}

NICK ADSL UK · Feb 28, 2019

Microsoft Security Bulletin(s) for December 2018

Security Update Guide > Release Notes
Release Notes
December 2018 Security Updates
Release Date: December 11, 2018

The December security release consists of security updates for the following software:

Adobe Flash Player

Internet Explorer

Microsoft Edge

Microsoft Windows

Microsoft Office and Microsoft Office Services and Web Apps

ChakraCore

.NET Framework

Microsoft Dynamics NAV

Microsoft Exchange Server

Microsoft Visual Studio

Windows Azure Pack (WAP)

Please note the following information regarding the security updates:

A list of the latest servicing stack updates for each operating system can be found in ADV990001. This list will be updated whenever a new servicing stack update is released. It is important to install the latest servicing stack update.

Windows 10 updates are cumulative. The monthly security release includes all security fixes for vulnerabilities that affect Windows 10, in addition to non-security updates. The updates are available via the Microsoft Update Catalog.

Starting in March 2017, a delta package will be available on the Microsoft Update Catalog for Windows 10 version 1607 and newer. This delta package contains just the delta changes between the previous month and the current release.

Updates for Windows RT 8.1 and Microsoft Office RT software are only available via Windows Update.

For information on lifecycle and support dates for Windows 10 operating systems, please see Windows Lifecycle Facts Sheet.

In addition to security changes for the vulnerabilities, updates include defense-in-depth updates to help improve security-related features.

The following CVEs have FAQs with additional information and may include * further steps to take after installing the updates.

CVE-2018-8477

CVE-2018-8514

CVE-2018-8580

CVE-2018-8595

CVE-2018-8596

CVE-2018-8598

CVE-2018-8616

CVE-2018-8621

CVE-2018-8622

CVE-2018-8627

CVE-2018-8637

CVE-2018-8638

Known Issues

4471321

4471327

4471329

4471324

4471318

https://portal.msrc.microsoft.com/en...0-000d3a33a34d

Brink · Feb 28, 2019

Microsoft Security Intelligence Report Volume 22 is now available

The latest volume of the Microsoft Security Intelligence Report is now available for free download at http://www.microsoft.com/sir" target="_blank" rel="nofollow">.

This new volume of the report includes threat data from the first quarter of 2017. The report also provides specific threat data for over 100 countries/regions. As mentioned in a recent blog, using the tremendous breadth and depth of signal and intelligence from our various cloud and on-premises solutions deployed globally, we investigate threats and vulnerabilities and regularly publish this report to educate enterprise organizations on the current state of threats and recommended best practices and solutions.

In this 22nd volume, we’ve made two significant changes:

We have organized the data sets into two categories, cloud and endpoint. Today, most enterprises now have hybrid environments and it’s important to provide more holistic visibility.

We are sharing data from a shorter time period, one quarter (January 2017 – March 2017), instead of the typical six months, as we shift our focus to delivering improved and more frequent updates in the future.

The threat landscape is constantly changing. Going forward, we plan to improve how we share the insights, and plan to share data on a more frequent basis – so that you can have more timely visibility into the latest threat insights. We are committed to continuing our investment in researching and sharing the latest security intelligence with you, as we have for over a decade. This shift in our approach is rooted in a principle that guides Microsoft technology investments: to leverage vast data and unique intelligence to help our customers respond to threats faster.

Here are 3 key findings from the report:

As organizations migrate more and more to the cloud, the frequency and sophistication of attacks on consumer and enterprise accounts in the cloud is growing.

There was a 300 percent increase in Microsoft cloud-based user accounts attacked year-over-year (Q1-2016 to Q1-2017).

The number of account sign-ins attempted from malicious IP addresses has increased by 44 percent year over year in Q1-2017.

Cloud services such as Microsoft Azure are perennial targets for attackers seeking to compromise and weaponize virtual machines and other services, and these attacks are taking place across the globe.

Over two-thirds of incoming attacks on Azure services in Q1-2017 came from IP addresses in China and the United States, at 35.1 percent and 32.5 percent, respectively. Korea was third at 3.1 percent, followed by 116 other countries and regions.

Ransomware is affecting different parts of the world to varying degrees.

Ransomware encounter rates are the lowest in Japan (0.012 percent in March 2017), China (0.014 percent), and the United States (0.02 percent).

Ransomware encounter rates are the highest in Europe vs. the rest of the world in Q1-2017.

Multiple European countries, including the Czech Republic (0.17 percent), Italy (0.14 percent), Hungary (0.14 percent), Spain (0.14 percent), Romania (0.13 percent), Croatia (0.13 percent), and Greece (0.12 percent) had much higher ransomware encounter rates than the worldwide average in March 2017.

Download Volume 22 of the Microsoft Security Intelligence Report today to access additional insights: http://www.microsoft.com/sir" target="_blank" rel="nofollow">.

Click to expand...

Source: Microsoft Security Intelligence Report Volume 22 is now available | Microsoft Secure Blog

Windows 10: Microsoft Security Intelligence Report Vol. 24 January - December 2018

Microsoft Security Intelligence Report Vol. 24 January - December 2018

Microsoft Security Intelligence Report Vol. 24 January - December 2018

Microsoft Security Intelligence Report Vol. 24 January - December 2018

Microsoft Security Intelligence Report Vol. 24 January - December 2018 - Similar Threads - Microsoft Security Intelligence

Microsoft update December 2018

.NET Framework December 2018 Security and Quality Rollup

Microsoft Windows Security Updates December 2018 release overview

Microsoft Security Bulletin(s) for December 2018

Microsoft December 2018 Security Updates

Microsoft Security Bulletin(s) for January 2018

Microsoft Security Intelligence Report Volume 22 is now available

.NET Framework January 2018 Security and Quality Rollup

January 2018 Non-Security Office Update Release