In August 2020, Microsoft released an interesting batch of software security updates for the Windows operating systems and other products they currently support. This release revealed that doing any of the following activities can lead to PCs getting hacked:
| Action | Cause of risk |
|---|---|
| Visit a website | The ever-buggy Internet Explorer |
| Listen to audio | Windows Media Audio Codec bugs |
| Open a video file | Microsoft Media Foundation and Windows Codec bugs |
| Read a PDF file | Microsoft Edge PDF Reader loophole |
| Get an email | Microsoft Outlook flaw |
| Edit an HTML webpage | MSHTML Engine bug |
It’s difficult to fathom that doing mundane, innocuous activities like reading an email opens users up to cybersecurity risks. But take note that this wasn’t the first time such vulnerabilities were discovered — and it won’t be the last. In fact, Microsoft releases patches for its operating systems, Office apps, and other programs on a monthly basis to fix known bugs and vulnerabilities.
This doesn’t mean that you must always be anxious whenever you use Windows. It just means that system updates need to be installed as soon as these are made available. In this regard, you either have to add checking for and installing updates as part of a monthly routine, or you can rely on a managed IT services provider (MSP) to do that for you.
As an MSP ourselves, XBASE will always be on top of data security in ways our clients may never be aware of. As they focus on acquiring new customers and delivering products and services, we ensure that they always have the latest and safest patches.
Furthermore, since we serve many clients, we encounter many business systems and fix all sorts of vulnerabilities all the time. This means that we’ve built up knowledge and experience that all of our clients benefit from. In fact, we build in Intrusion Prevention and Intrusion Detection Systems (IPS/IDS) to our solution so that our clients don’t have to be agitated or distracted by such concerns.
Why is installing updates immediately such a big deal?
There must always be urgency because Microsoft developers and white hat hackers are always racing against cybercriminals to find security vulnerabilities. You see, no software is ever released without flaws. Bugs that the developers themselves are not aware of — called zero-day vulnerabilities — are the best opportunities black hat hackers have of infiltrating your IT systems undetected and inflicting the most damage to your company.
In fact, in mid-2020, independent members of the security community reported that two zero-day vulnerabilities were being actively exploited by hackers. One flaw was an Internet Explorer (IE) remote execution bug. It allowed the attacker to execute code as if they were the actual user and thereafter gain the same rights as that user. This meant that if that user had administrator privileges, the hacker could take control of certain systems and then do the following:
- View, alter, or delete data
- Install malicious programs
- Create entirely new user accounts and endow these with full rights
Last May, Kaspersky Labs successfully defended a South Korean company from an attack that was exploiting the IE bug. Kaspersky reported their findings to Microsoft in June, and Microsoft released a patch in August.
And just by the end of August, a zero-click remote code execution bug was discovered in Microsoft Teams desktop apps. According to the researcher who discovered the bug, all the attacker had to do was to send a specially made chat message to cause "complete loss of confidentiality and integrity for end users.” That is, it would grant the hacker “access to private chats, files, internal network, private keys and personal data outside MS Teams." Needless to say, this is very bad news for businesses.
Similar to the IE bug, it took developers two months to create a fix for it. This may sound like a short time, but it’s actually a very long time for hackers to do damage to a company’s systems if the vulnerability is left unaddressed.
Therefore, if an update arrives even before the vulnerability it patches is ever exploited, we mustn’t let that time advantage go to waste. Some of the more enterprising black hat hackers even go so far as to reverse-engineer updates to learn more about the bugs being fixed and how to take advantage of these . They do this so that when they encounter users who fail to install the necessary update, they can attack with impunity.
In short, you need to have security updates installed as soon as they’re available. MSPs take it as a matter of professional pride to ensure these are acted upon immediately. If you’re a company that doesn’t have complete confidence that the same is being done for you — either by internal staff or your current provider — then we urge you to take the steps needed to regain that confidence. Your business may depend on it.
Organizationsin Toronto and across Canada trust XBASE’s cybersecurity services to provide them with Exponentially Better™ protection. To learn more about what we can do for you, download our free eBook today.
Like This Article?
Sign up below and once a month we'll send you a roundup of our most popular posts