vlc 1

Beware! Playing Untrusted Videos On VLC Player Could Hack Your Computer

If you use VLC media player on your computer and haven’t updated it recently, don’t you even dare to play any untrusted, randomly downloaded video file on it.

Doing so could allow hackers to remotely take full control over your computer system.

That’s because VLC media player software versions prior to 3.0.7 contain two high-risk security vulnerabilities, besides many other medium- and low-severity security flaws, that could potentially lead to arbitrary code execution attacks.

With more than 3 billion downloads, VLC is a hugely popular open-source media player software that is currently being used by hundreds of millions of users worldwide on all major platforms, including Windows, macOS, Linux, as well as Android and iOS mobile platforms.

Discovered by Symeon Paraschoudis from Pen Test Partners and identified as CVE-2019-12874, the first high-severity vulnerability is a double-free issue which resides in “zlib_decompress_extra” function of VideoLAN VLC player and gets triggered when it parses a malformed MKV file type within the Matroska demuxer.

The second high-risk flaw, identified as CVE-2019-5439 and discovered by another researcher, is a read-buffer overflow issue that resides in “ReadFrame” function and can be triggered using a malformed AVI video file.

Though the proof-of-concepts demonstrated by both researchers cause a crash, a potential attacker can exploit these vulnerabilities to achieve arbitrary code execution with the same privileges as of the target user on the system.

All the attacker needs to do is craft a malicious MKV or AVI video file and trick users into playing it using the vulnerable versions of VLC.

Well, that’s not a tough job, as attackers can easily target hundreds of thousands of users within hours by simply releasing malicious video files on torrent sites, mimicking as a pirated copy of a newly released movie or TV series.

According to an advisory released by VideoLAN, having ASLR and DEP protections enabled on the system could help users mitigate the threat, but developers did admit that these protections could be bypassed too.

Paraschoudis used honggfuzz fuzzing tool to discover this issue and four other bugs, which were also patched by the VideoLAN team earlier this month along with 28 other bugs reported by other security researchers through EU-FOSSA bug bounty program.

Users are highly recommended to update their media player software to VLC 3.0.7 or later versions and should avoid opening or playing video files from untrusted third parties.

Have something to say about this article? Comment below or share it with us on Facebook, Twitter.

3

Windows 10 Now Automatically Uninstalls Updates That Cause Problems

Do you always think twice before installing Windows updates worrying that it could crash your system or leave it non-working the day after Patch Tuesdays?

Don’t worry.

Microsoft has addressed this issue by adding a safety measure that would from now onwards automatically uninstall buggy software updates installed on your system if Windows 10 detects a startup failure, which could be due to incompatibility or issues in new software.

A new document published by Microsoft on Monday, a day before this month’s Patch Tuesday, says just like Windows “automatically installs updates to keep your device secure and running at peak efficiency,” the OS will now run another automatic process to uninstall problematic updates.

From now on, if you receive the following notification on your device, that means your Windows 10 computer has recently been recovered from a startup failure.

“We removed some recently installed updates to recover your device from a startup failure.”

If Windows 10 detects this, the operating system will try to resolve the failure by uninstalling recently installed Windows updates, which is only done when all automatic recovery attempts fail.

Besides this, if such issues happen, Windows 10 will automatically block installation of the problematic updates for the next 30 days to ensure that your system can start up and continue running just fine.

Also in the meantime, Microsoft and its partners can investigate the issue and fix it before the update is delivered to the user again after 30 days.

For Windows 10 users who believe that the updates in question should not have been uninstalled, Microsoft allows them to manually install driver or quality updates.

However, the tech giant noted that if those updates manage to stop your system from starting up properly even after automatic or manual installation, Windows will uninstall them again.

At last, Microsoft also asked Windows users to share their feedbacks using the Feedback Hub so that the company can diagnose and remediate the issues with these updates and work on a fix accordingly.

This new safety measure, which comes in action as of today, would definitely help a lot of Windows users deal with problematic updates and associated issues. Let’s see how this new system goes as Microsoft is set to roll out the March Patch Tuesday security updates in just a few hours.

2

New ‘Creative’ Phishing Attack You Really Should Pay Attention To

A cybersecurity researcher who last month warned of a creative phishing campaign has now shared details of a new but similar attack campaign with The Hacker News that has specifically been designed to target mobile users.

Just like the previous campaign, the new phishing attack is also based on the idea that a malicious web page could mimic look and feel of the browser window to trick even the most vigilant users into giving away their login credentials to attackers.

Antoine Vincent Jebara, co-founder and CEO of password managing software Myki, shared a new video with The Hacker News, demonstrating how attackers can reproduce native iOS behavior, browser URL bar and tab switching animation effects of Safari in a very realistic manner on a web-page to present fake login pages, without actually opening or redirecting users to a new tab.

New Phishing Attack Mimics Mobile Browser Animation and Design

As you can see in the video, a malicious website that looks like Airbnb prompts users to authenticate using Facebook login, but upon clicking, the page displays a fake tab switching animation video aimed to trick users into thinking that their browsers are behaving normally.

“The Facebook login page is also definitely fake and is an overlay over the current page that makes it look like an authentic Facebook page,” Jebara said.

“From the moment a user accesses the malicious website, they are manipulated into performing actions that seem legitimate, all with the purpose of building up their confidence to submit their Facebook password at the final stage of the attack.”

If users are not very attentive to details and fail to spot minor differences, they would eventually end up filling the username and password fields on the phishing page, resulting in giving away their social media credentials to the attackers.

“This attack is poorly implemented and contains multiple flaws from both a process and design point of view. Login with Facebook prompts are presented as an external window in Safari, not as an additional tab that the user is switched to, as the origin URL still appears in minimized form over the fake Facebook navigation bar,” Jebara said.

“Although hackers would probably implement this campaign in a more realistic manner, in its current form, a majority of users would fall for this attack, as the details that give it away are relatively subtle, and more importantly, the user is shown specific ‘familiar’ actions that seem to turn off the part of the brain that doubts the legitimacy of the page.”

How to Protect Against Such New Form of Phishing Scams

It should be noted that such advanced phishing attacks are not limited to Facebook, Safari browser or just to iOS mobile users only, but could very easily be adapted to target Android devices or any other social media site as well.

Cybercriminals can target different platforms by creating a website that automatically serves different versions of phishing pages based upon what browser app and mobile device operating system victims use.

Since there are no clear guidelines to spot such creative phishing attacks, users are highly recommended to:

  • Use password managers that only auto-fill credentials on legit domains, helping you avoid giving away credentials to fake websites.
  • Enable two-factor authentication, wherever available, preventing hackers from accessing your online accounts even if they somehow manage to steal your credentials.

Besides this, Jebara also suggests users ask themselves “Why am I asked to log in?” Or “Am I not already logged in to this?” when hackers try to mimic the logins of popular websites for which you already have an app on your smartphone.

Phishing is still one of the most severe threats to users as well as companies, and hackers continue to try new and creative ways to trick you into providing them with your sensitive and financial details that they could later use to steal your money or hack into your online accounts.

Stay Safe! Stay Tuned!

Stack

Severe Flaw Disclosed In StackStorm DevOps Automation Software

A security researcher has discovered a severe vulnerability in the popular, open source event-driven platform StackStorm that could allow remote attackers to trick developers into unknowingly execute arbitrary commands on targeted services.

StackStorm, aka “IFTTT for Ops,” is a powerful event-driven automation tool for integration and automation across services and tools that allows developers to configure actions, workflows, and scheduled tasks, in order to perform some operations on large-scale servers.

For example, you can set instructions (if this, then that) on Stackstorm platform to automatically upload network packet files to a cloud-based network analyze service, like CloudShark, in events when your security software detects an intrusion or malicious activity in the network.

Since StackStorm executes actions—which can be anything, from the HTTP request to an arbitrary command—on remote servers or services that developers integrate for automated tasks, the platform runs with quite high-privileges.

According to the details Barak Tawily, an application security researcher, shared with The Hacker News prior to the release, the flaw resided in the way the StackStorm REST API improperly handled CORS (cross-origin resource sharing) headers, eventually enabling web browsers to perform cross-domain requests on behalf of the users/developers authenticated to StackStorm Web UI.