Windows 10: Windows Meltdown-Spectre: Watch out fake patches that spread malware

Borg 386 · Jan 16, 2018

Windows Meltdown-Spectre: Watch out for fake patches that spread malware

PC users already have to contend with buggy Meltdown and Spectre patches. But now they also need to be wary of cybercriminals exploiting uncertainty about the fix and where to get them.

Click to expand...

Jérôme Segura, a researcher at Malwarebytes, says the phishing site's link leads to the installation of malware known as Smoke Loader, which can install other malware.
Click to expand...

As with many phishing sites these days, the fake BSI page was SSL-enabled, meaning victims could be duped by seeing the secure padlock symbol in their browser's address bar next to the HTTPS address.
Click to expand...

"Online criminals are notorious for taking advantage of publicized events and rapidly exploiting them, typically via phishing campaigns," wrote Secura.

"This particular one is interesting because people were told to apply a patch, which is exactly what the crooks are offering under disguise."

He added that HTTPS links aren't necessarily trustworthy. A recent report from security firm PhishLabs showed that HTTPS adoption by phishing sites is actually increasing faster than the general web.

In the third quarter of 2017, a quarter of all phishing sites used HTTPS, up from three percent a year ago. Phishers are adopting HTTPS, even though it's not necessary for the task, but rather because the additional security gives the impression of legitimacy.
Click to expand...

Windows Meltdown-Spectre: Watch out for fake patches that spread malware | ZDNet

A fake patch for the massive Spectre and Meltdown chip flaws is actually a front for a piece of malware called Smoke Loader. A fake website that claims to be part of the German Federal Office for Information Security (BSI) is associated with Smoke Loader, according to a Malwarebytes blog post.

In recent years, social engineering efforts by cyber criminals have leveraged headline-grabbing issues in an attempt to infect users. This is especially true of high-profile vulnerabilities. Fake patches and fixes were rampant after the critical WannaCry ransomware attack, so it was only a matter of time before Spectre and Meltdown were used by criminals too.
Click to expand...

Once a user is directed to the fake site, the Malwarebytes post said, they will find a download link to a ZIP archive titled Intel-AMD-SecurityPatch-11-01bsi.zip. This contains a "so-called patch (Intel-AMD-SecurityPatch-10-1-v1.exe), which really is a piece of malware," the post said.

If a user were to download and run the fake patch, they'd be infected with the Smoke Loader malware. Smoke Loader can retrieve additional payloads, and traffic analyzed by Malwarebytes seems to show it trying to connect to other domains and send encrypted data.
Click to expand...

This fake Spectre/Meltdown patch will infect your PC with malware - TechRepublic

:)

Pixelme · Jan 16, 2018

Windows Update Intel Patches for Meltdown & Spectre

URGENT - Please Microsoft:

1. Provide a List of Windows Updates that included the (bad) Intel Patches for Meltdown & Spectre (which Intel now say should NOT be installed).

2. Advise IF (and HOW) the Windows Updates that included (bad) Intel Patches for Meltdown & Spectre should be 'removed' by End Users?

3. If Microsoft Identifies (to it's Community) Windows Updates that included (bad) Intel Patches, can Users remove them - while still getting any other 'fixes' (that did NOT relate to Meltdown & Spectre) included in the Same Windows Updates that contained
the (bad) Patches for Meltdown & Spectre?

4. How do Users ensure that ant Windows Updates they remove - to 'eject' the (bad) Intel Patch for Meltdown & Spectre - are not 'automatically' re-installed' later - by Automatic Windows Updates, when Windows notices the 'removed updates' are not installed?

Note: I've looked at the Microsoft.com Descriptions of Numerous Recent Windows Updates and (although some refer to 'security') none seem to specifically mention Intel, Meltdown or Spectre - so I can't determine which Windows Updates included the 'bad' Intel
Patches.

ConiGL · Jan 16, 2018

Feature for the Fall update Windows 10

Patch for windows is an update. To patch your computer you will need to go to your computer manufacturers website to find out how to patch.

More good reading on this

How to Check and Update Windows Systems for the Meltdown and Spectre CPU Flaws
(article includes: "This
Google Docs file contains a list of the responses from some AV companies.")

Windows, Meltdown and Spectre: Keep calm and carry on

Win7 Monthly Rollup KB 4056894 signals early, abbreviated Patch Tuesday(applies
to all Windows versions despite title)

Microsoft Releases Emergency Updates to Fix Meltdown and Spectre CPU Flaws

https://support.microsoft.com/en-us...garding-the-windows-security-updates-released

How to Protect Against the Meltdown and Spectre Vulnerabilities

https://www.computerworld.com/artic...t-slowdowns-and-antivirus-proves-crucial.html

Windows 10: Windows Meltdown-Spectre: Watch out fake patches that spread malware

Windows Meltdown-Spectre: Watch out fake patches that spread malware

Windows Meltdown-Spectre: Watch out fake patches that spread malware

Windows Meltdown-Spectre: Watch out fake patches that spread malware - Similar Threads - Meltdown Spectre Watch

How to disable Downfall patch and Meltdown/Spectre patch together

How to disable Downfall patch and Meltdown/Spectre patch together

Do Spectre/Meltdown patches for windows 10 affect me ?

Do Spectre/Meltdown patches for windows 10 affect me ?

Do Spectre/Meltdown patches for windows 10 affect me ?

spectre and meltdown

GRC InSpectre Shows Meltdown and Spectre Patched??

Spectre & Meltdown patches ruined it for me!

Freeze after meltdown/spectre patch ?