Windows 10: New Microsoft Security Signals study shows firmware attacks on rise

Brink · Mar 30, 2021

Cybersecurity threats are always evolving, and today weâre seeing a new wave of advanced attacks targeting areas of computing that donât have the protection of the cloud. New data shows that firmware attacks are on the rise, and businesses arenât paying close enough attention to securing this critical layer.

Recently, Microsoft commissioned a study that showed how attacks against firmware are outpacing investments targeted at stopping them. The March 2021 Security Signals report showed that more than 80% of enterprises have experienced at least one firmware attack in the past two years, but only 29% of security budgets are allocated to protect firmware.

Security Signals is a comprehensive research report assembled from interviews with 1,000 enterprise security decision makers (SDMs) from various industries across the U.S., UK, Germany, China, and Japan. Microsoft commissioned Hypothesis Group, an insights, design, and strategy agency, to execute the research.

The study showed that current investment is going to security updates, vulnerability scanning, and advanced threat protection solutions. Yet despite this, many organizations are concerned about malware accessing their system as well as the difficulty in detecting threats, suggesting that firmware is more difficult to monitor and control. Firmware vulnerabilities are also exacerbated by a lack of awareness and a lack of automation.

But the tide may be starting to turn against firmware exploits. There is a growing awareness of the issue worldwide, a new willingness to invest in protections, and an emerging class of secured-core hardware is showing the potential to empower organizations with chip-level security and new automation and analytics capabilities.
Click to expand...

Read more: https://www.microsoft.com/security/b...ss-of-threats/

Tweet

— Twitter API (@user) View on Twitter
Click to expand...

:)

Brink · Mar 30, 2021

Study shows 5 out of 6 routers inadequately updated for security flaws

A new study by a US consumer nonprofit has found that five out of six home routers are inadequately updated for security flaws, leaving the devices, and indirectly their users, vulnerable to hacking.

Carried out by the American Consumer Institute (ACI), the study analyzed a sample of 186 SOHO (small office/home office) WiFi routers from 14 different vendors with a presence on the US market.

ACI experts looked at the firmware version the routers were running and searched public vulnerabilities databases for known security flaws affecting each device's firmware.

"In total, there was a staggering number of 32,003 known vulnerabilities found in the sample," said ACI experts in the study published last week.

"Our analysis shows that of the 186 sampled routers, 155 (83%) were found to have vulnerabilities to potential cyber attacks, in the router firmware, with an average of 172 vulnerabilities per router, or 186 vulnerabilities per router for the identified 155 routers," ACI experts said.

Of the total 32,003 security flaws, more than a quarter were vulnerabilities that received the two highest severity ratings of "critical" and "high-risk" respectively.

"Our analysis shows that, on average, routers contained 12 critical vulnerabilities and 36 high-risk vulnerabilities, across the entire sample," researchers said.

These are staggeringly large numbers...
Click to expand...

Read more:

New study finds 5 of every 6 routers are inadequately updated for security flaws | ZDNet

http://www.theamericanconsumer.org/w...rabilities.pdf

Brink · Mar 30, 2021

Study shows 5 out of 6 routers inadequately updated for security flaws

A new study by a US consumer nonprofit has found that five out of six home routers are inadequately updated for security flaws, leaving the devices, and indirectly their users, vulnerable to hacking.

Carried out by the American Consumer Institute (ACI), the study analyzed a sample of 186 SOHO (small office/home office) WiFi routers from 14 different vendors with a presence on the US market.

ACI experts looked at the firmware version the routers were running and searched public vulnerabilities databases for known security flaws affecting each device's firmware.

"In total, there was a staggering number of 32,003 known vulnerabilities found in the sample," said ACI experts in the study published last week.

"Our analysis shows that of the 186 sampled routers, 155 (83%) were found to have vulnerabilities to potential cyber attacks, in the router firmware, with an average of 172 vulnerabilities per router, or 186 vulnerabilities per router for the identified 155 routers," ACI experts said.

Of the total 32,003 security flaws, more than a quarter were vulnerabilities that received the two highest severity ratings of "critical" and "high-risk" respectively.

"Our analysis shows that, on average, routers contained 12 critical vulnerabilities and 36 high-risk vulnerabilities, across the entire sample," researchers said.

These are staggeringly large numbers...
Click to expand...

Read more:

New study finds 5 of every 6 routers are inadequately updated for security flaws | ZDNet

http://www.theamericanconsumer.org/w...rabilities.pdf

DaveM121 · Mar 30, 2021

About Ransomware attack

Here is Microsoft's Customer Guidance on the Ransomware Attack:

In March, we released a security update which addresses the vulnerability that these attacks are exploiting. Those who have Windows Update enabled are protected against attacks on this vulnerability. For those organizations who have not yet applied the
security update, we suggest you immediately deploy Microsoft Security Bulletin MS17-010.

For customers using Windows Defender, we released an update earlier today which detects this threat as Ransom:Win32/WannaCrypt.
As an additional “defense-in-depth” measure, keep up-to-date anti-malware software installed on your machines. Customers running anti-malware software from any number of security companies can confirm with their provider, that they are protected.

This attack type may evolve over time, so any additional defense-in-depth strategies will provide additional protections. (For example, to further protect against SMBv1 attacks, customers
should consider blocking legacy protocols on their networks).

For the full article,
Click HERE

Windows 10: New Microsoft Security Signals study shows firmware attacks on rise

New Microsoft Security Signals study shows firmware attacks on rise

New Microsoft Security Signals study shows firmware attacks on rise

New Microsoft Security Signals study shows firmware attacks on rise

New Microsoft Security Signals study shows firmware attacks on rise - Similar Threads - Microsoft Security Signals

secure launch/firmware protection

secure launch/firmware protection

Monitors showing no signal

Monitors showing no signal

Firmware is not showing.

Sleep Study not showing % of battery

BIOS firmware / security

Study shows 5 out of 6 routers inadequately updated for security flaws

New Ransomware attack