-

More on the 0day in Microsoft protocols.

Twitter avatar for @spaceraccoonsec
spaceraccoon | Eugene Lim @spaceraccoonsec
Wake up babe, new custom URI to arbitrary command exec just dropped ms-msdt:/id PCWDiagnostic /skip force /param "IT_RebrowseForFile=calc?c IT_LaunchMethod=ContextMenu IT_BrowseForFile=h$(calc.exe))'))))i/../../../../../../../../../../.exe IT_AutoTroubleshoot=ts_AUTO"
Twitter avatar for @GossiTheDog
Kevin Beaumont @GossiTheDog
This is a nice find, looks like an EDR tooling gap from initial tests. (Possibly more, surprises Word didn’t block this). https://t.co/jzPzkOskGg

And some analysis.

Twitter avatar for @HaifeiLi
Haifei Li @HaifeiLi
4)Brief analysis shows that this "patched 0day" attack was exactly exploiting the same attack vector exposed by the CVE-2021-40444 0day (MS didn't block the vector when patching 40444 in Sep 2021). I (& other researchers) repeatably warned about the risk.
Twitter avatar for @HaifeiLi
Haifei Li @HaifeiLi
Some thoughts: it's a bit weird to me that Microsoft fixed the Excel-loading-remote-Excel-file vector but leave the Word-loading-remote-html vector exposed by CVE-2021-40444 untouched, which still brings great risk for all Office users, I wonder why? https://t.co/S4apd4RzJg

Mitigation

Twitter avatar for @GossiTheDog
Kevin Beaumont @GossiTheDog

-

Twitter avatar for @SamCarrArt
Sam Carr @SamCarrArt
Sleeping Statues
Image

-

Damning indictment.

Twitter avatar for @drvolts
David Roberts @drvolts
I think about this a lot: in today's media environment, Nixon would survive Watergate unscathed. What @Sulliview doesn't mention is that the RW built its media machine in response to Watergate, precisely to prevent accountability in the future.

-

Military made cyber weapons could soon be available on the dark web. send tweet.

Twitter avatar for @CNBC
CNBC @CNBC
Military-made cyberweapons could soon become available on the dark web, Interpol warns

-

Twitter avatar for @0xdea
raptor @0xdea

-

Twitter avatar for @Flash43191300
Flash @Flash43191300
⚡️Photos of anti-Russian leaflets on the streets of occupied Tokmak and Melitopol, Zaporizhie region, posted by partisans, appeared on the network.
Image

-

You’ll be shocked at the state of the REvil prosecution. Shocked!

Twitter avatar for @shakirov2036
Oleg Shakirov @shakirov2036
REvil investigation in Russia is in an impasse per @kommersant. 4 months after suspects were arrested, they've been charged only with stealing from 2 people in the U.S., not ransomware attacks. The excuse: lack of cooperation & evidence from the U.S.

-

Don't miss what's next. Subscribe to the grugq's newsletter: