isc.sans.edu Open in urlscan Pro
45.60.31.34  Public Scan

Form analysis
1 forms found in the DOM

Name: searchform — GET /search.html

<form id="headerSearch" name="searchform" action="/search.html" method="get">
  <input type="text" name="q" placeholder="Search...(IP, Port..)">
  <input type="hidden" id="token" name="token" value="">
  <input class="btn btn-primary" type="submit" name="Search" value="Search">
</form>

Text Content

INTERNET STORM CENTER

Sign In Sign Up
Handler on Duty: Xavier Mertens
Threat Level: green
Last Daily Podcast (Fri, Apr 12th): BatBadBut Vulnerability; FortiClient Linux
RCE; Apple Notifications; GitHub Search Tricks;
A recording of our xz-utils Webcast can be found here:
https://www.youtube.com/watch?v=HTNKS3tw3xk.


DIARIES


VIEW ALL


Published: 2024-04-12 by Xavier Mertens


BUILDING A LIVE SIFT USB WITH PERSISTENCE

The SIFT Workstation[1] is a well-known Linux distribution oriented to forensics
and incident response tasks. It is used in many SANS training as the default
platform. This is also my preferred solution for my day-to-day DFIR activities.
The distribution is available as a virtual machine but you can install it on top
of a classic Ubuntu system. Today, everything is virtualized and most DFIR
activities can be performed remotely with the provided VM but... sometimes you
still need a way to perform local investigations against a physical computer.
That's why I always carry a USB stick with me. Before I was using Kali which
provides a standard solution. 

But, how to build a live USB SIFT. The key requirement is to implement
persistence. For two main reasons;

 * Keep your scripts and settings used to expand the default SIFT capabilities
 * To save the collected data

Many computers have multiple USB ports, so you can boot a SIFT connected to one
port and save your data/images/... on a storage device connected to another
port. Except when the computer has only one port available!

To build my live SIFT USB, I followed this process:

Step 1: Install Ubuntu on a USB stick and enable persistence

My best choice to perform this is to use Rufus[2]. The process is pretty
straightforward and the most important setting is to define the size of the
persistent storage:



I'm using a 128GB storage and define my persistence partition to 110 GB.

Note: an alternative way to create the disk is to use mkusb[3].

Step 2: Install SIFT

Boot the freshly created USB stick and follow the process described on the SIFT
website. Install Cast[4] and run:

sudo cast install teamdfir/sift

Grab some coffee, the installation might take some time depending on your
hardware specifications (USB3 is a minimum) and you'll have a classic SIFT
environment that you can boot now from any computer.

Step 3: Customize

Because we all have our preferred tools and pieces of scripts, install them on
your SIFT as usual.

Now, you can boot it on any computer, perform investigations, and save your
pieces of evidence directly on the USB stick!

[1] https://www.sans.org/tools/sift-workstation/
[2] https://rufus.ie/en/
[3] https://help.ubuntu.com/community/mkusb
[4] https://github.com/ekristen/cast/releases/latest

Xavier Mertens (@xme)
Xameco
Senior ISC Handler - Freelance Cyber Security Consultant
PGP Key

Xavier Mertens
Published: 2024-04-11 by Yee Ching Tok


EVOLUTION OF ARTIFICIAL INTELLIGENCE SYSTEMS AND ENSURING TRUSTWORTHINESS

We live in a dynamic age, especially with the increasing awareness and
popularity of Artificial Intelligence (AI) systems being explored by users and
organizations alike. I was recently quizzed by a junior researcher on how AI
systems came about and realized I could not answer that query immediately. I had
a rough idea of what led to the current generative and large language models.
Still, I had a very fuzzy understanding of what transpired before them, besides
being confident that neural networks were involved. Unsatisfied with the lack of
appreciation of how AI systems evolved, I decided to explore how AI systems were
conceptualized and developed to the current state, sharing what I learnt in this
diary. However, knowing only how to use them but being unable to ensure their
trustworthiness (especially if organizations want to use these systems for
increasingly critical business activities) could expose organizations to a much
higher risk than what senior leadership could accept. As such, I will also
suggest some approaches (technical, governance, and philosophical) to ensure the
trustworthiness of these AI systems.

AI systems were not built overnight, and the forebears of computer science and
AI had thought at length about how to create a system almost similar to a human
brain. Keeping in mind the usual considerations, such as the Turing test and
cognitive and rational approaches, there were eight foundational disciplines
that AI drew on [1]. This is illustrated in Figure 1 below:


Figure 1: Foundational Disciplines Used in AI Systems
 

The foundational disciplines also yielded their own set of considerations which
would collectively be considered for an AI system. They are summarized in Table
1 below [1]:



Table 1: Considerations for Foundational Disciplines in AI Systems (adapted from
[1]) Foundational Discipline Considerations Philosophy - Where does knowledge
come from?
- Can formal rules be used to draw valid conclusions?
- How does the mind arise from a physical brain?
- How does knowledge lead to action? Mathematics - What can be computed?
- How do we reason with uncertain information?
- What are the formal rules to draw valid conclusions? Economics - How should we
make decisions in accordance with our preferences?
- How should we do this when others may not go along?
- How should we do this when the payoff may be far in the future? Neuroscience -
How do brains process information? Psychology - How do humans and animals think
and act? Computer Engineering - How can an efficient computer be built? Control
theory and cybernetics - How can artifacts operate under their own control?
Linguistics - How does language relate to thought?



For brevity’s sake, I will skip stating the overall historical details of the
exact developments of AI. However, an acknowledgement to the first work of AI
should be minimally mentioned, which was a research on artificial neurons by
Warren McCulloch and Walter Pitts in 1943 [1]. As technological research on AI
progressed, distinct iterations of AI systems emerged. These are listed in Table
2 below in chronological order, along with some salient pointers and the
advantages/disadvantages (where applicable):



Table 2: Evolution of Distinct AI Systems (adapted from [1]) Classification of
AI Systems Details Problem-solving (Symbolic) Systems - 1950s to 1980s era
- Symbolic and declarative knowledge representations
- Logic-based reasoning (e.g. propositional/predicate/higher-order logic)
- Rule-based (specifying how to derive new knowledge or perform certain tasks
based on input data and the current state of the system)
- Struggled with handling uncertainty and real-world complexities Knowledge,
reasoning, planning (Expert) Systems - 1970s to 1980s era
- Knowledge base (typically represented in a structured form, such as rules,
facts, procedures, heuristics, or ontologies)
- Inference engine (applies logical rules, inference mechanisms, and reasoning
algorithms to derive conclusions, make inferences, and solve problems based on
the available knowledge)
- Rule-based reasoning [define conditions (antecedents) and actions
(consequents), specifying how to make decisions or perform tasks based on input
data and the current state of the system. The inference engine evaluates rules
and triggers appropriate actions based on the conditions met.]
- Limited by static knowledge representations Machine Learning (ML) Systems -
1980s to 2000s era
- Feature extraction and engineering (data features/attributes extracted and
transformed/combined)
- Model selection and evaluation (e.g. linear regression, decision trees,
support vector machines, neural networks, and ensemble methods)
- Generalization (Ability of a model to accurately perform on unseen data)
- Hyperparameter tuning (Tuning parameters that control the learning process and
model complexity. Techniques such as grid search, random search, and Bayesian
optimization are commonly used for hyperparameter tuning)
- Had performance issues due to compute power, but performance significantly
improved in early 21st century due to advances in compute power Deep Learning
Systems - 2000s to present
- Subset of ML systems (uses neural networks with multiple layers)
- Feature hierarchies and abstractions (Lower layers in the network learn
low-level features such as edges and textures, while higher layers learn more
abstract concepts and representations, such as object parts or semantic
concepts)
- Scalability (particularly well-suited for tasks such as image and speech
recognition, natural language processing, and other applications with massive
datasets) Generative Models [Variational Autoencoders (VAEs) and Generative
Adversarial Networks (GANs)] - 2010s to present
- Data generation (produce new data samples based on training data. Samples can
be images, text, audio, or any other type of data that the model is trained on)
- Probability distribution modelling (capture the statistical dependencies and
correlations between different features or components of training data and
generate new samples exhibiting similar properties to the training data)
- Variability and diversity (multiple plausible samples for a given input or
condition can be generated by sampling from the learned probability
distribution)
- Unsupervised learning (unlabelled or partially labelled training data for the
model to capture inherent structure and patterns within the data) Transfer
Learning / Large Language Models - 2010s to present
- Reuse of pre-trained models (pre-trained models are fine-tuned or adapted to
new tasks with limited labelled data)
- Domain adaptation (e.g. pre-trained model trained on general text data can be
fine-tuned for specific domains such as legal documents, medical texts, or
social media post)
- Fine-grained representations (encode information about word semantics, syntax,
grammar, sentiment, and topic coherence, enabling them to capture diverse
aspects of language)
- Multi-task approach (enables the model to learn more generalized
representations of text data, improving performance on downstream tasks)



With reference to Table 2, we see that AI systems have evolved significantly to
become plausible assistants in automating and augmenting work processes. One
must be mindful of ensuring these new systems are trustworthy and remain so due
to the potential complications that could occur. AI systems could be exposed to
traditional cybersecurity issues such as unauthorized access, unsecured
credentials, backdooring (e.g. supply-chain compromise) and data exfiltration.
They also have their own domain-specific risks, such as poisoned training
datasets, insufficient guardrails, erosion of model integrity and prompt
engineering. While technical controls may mitigate some of these risks,
governance and philosophical approaches could bolster the resiliency and
trustworthiness of the incumbent AI systems. I will briefly discuss the
technical, governance and philosophical approaches that AI users should be aware
of.

Firstly, from a technical perspective, it is always a good approach to model
potential threats and perform a security assessment of the AI model to be
deployed. An excellent guidance for such an approach would be the MITRE
Adversarial Threat Landscape for Artificial-Intelligence Systems (ATLAS) matrix
(with reference to Figure 2 below) [2]. Appropriate mitigations to the
applicable techniques to an incumbent AI system could be derived by referencing
the ATLAS matrix. At the same time, assessors could rely on a globally accepted
framework to guide their security assessments.
 


Figure 2: MITRE Adversarial Threat Landscape for Artificial-intelligence Systems
(ATLAS)

From a governance perspective, the Control Objectives for Information
Technologies (COBIT) (2019) could offer guidance when users are faced with a
requirement for auditing AI systems. There are risks when deploying AI systems,
such as a lack of alignment between IT and business needs, improper translation
of IT tactical plans from IT strategic plans and ineffective governance
structures to ensure accountability and responsibilities associated with the AI
function [3]. For example, COBIT’s DSS06 Manage Business Process Control
includes management practice DSS06.05 Ensure traceability and accountability.
DSS06.05 could be utilized to ensure AI activity audit trails provide sufficient
information to understand the rationale of AI decisions made within the
organization [3].

Finally, there is the philosophical perspective for AI systems. As various
organizations and users adopt AI, an AI ecosystem will inevitably form (for
better or for worse). Since the modern AI ecosystem is in its infancy,
governance of AI systems requires global consensus. A notable example was the
mapping and interoperability of national AI governance frameworks between
Singapore and United States through the Infocomm Media Development Authority
(IMDA) and US National Institute of Science and Technology (NIST) crosswalk [4].
Additionally, the AI Verify Foundation and IMDA further proposed a model AI
governance framework for Generative AI to address the apprehension and concerns
towards AI [5]. Users and organizations looking into implementing AI should
consider the nine dimensions raised in the proposed framework. These are also
summarized in Table 3 below [5]:



Table 3: Nine Dimensions for Fostering a Trusted AI Ecosystem (adapted from [5])
Dimensions Details Accountability Putting in place the right incentive structure
for different players in the AI system development life cycle to be responsible
to end-users Data Ensuring data quality and addressing potentially contentious
training data in a pragmatic way, as data is core to model development Trusted
Development and Deployment Enhancing transparency around baseline safety and
hygiene measures based on industry best practices, in development, evaluation
and disclosure Incident Reporting Implementing an incident management system for
timely notification, remediation, and continuous improvements, as no AI system
is foolproof Testing and Assurance Providing external validation and added trust
through third-party testing, and developing common AI testing standards for
consistency Security Addressing new threat vectors that arise through generative
AI models Content Provenance Transparency about where content comes from as
useful signals for end-users Safety and Alignment R&D Accelerating R&D through
global cooperation among AI Safety Institutes to improve model alignment with
human intention and values AI for Public Good Responsible AI includes harnessing
AI to benefit the public by democratizing access, improving public sector
adoption, upskilling workers and developing AI systems sustainably



I hope this primer on AI helped to get everyone up to speed on how AI systems
evolved over the years and appreciate the vast potential these systems bring.
However, we live in turbulent times where AI systems could be abused and
compromised. I also suggested potential avenues (technical, governance, and
philosophical) for AI systems to become more trustworthy despite adversarial
tactics and techniques. We live in an exciting age, and seeing how far we can
evolve by adopting AI systems will be a rewarding experience.

References:
1. Stuart Russell and Peter Norvig. 2020. Artificial Intelligence: A Modern
Approach (4th. ed.). Pearson, USA.   
2. https://atlas.mitre.org/matrices/ATLAS
3. ISACA. 2018. Auditing Artificial Intelligence. ISACA, USA.
4.
https://www.imda.gov.sg/resources/press-releases-factsheets-and-speeches/press-releases/2024/public-consult-model-ai-governance-framework-genai
5. https://aiverifyfoundation.sg/downloads/Proposed_MGF_Gen_AI_2024.pdf

-----------
Yee Ching Tok, Ph.D., ISC Handler
Personal Site
Mastodon
Twitter

Yee Ching Tok
Published: 2024-04-09 by Johannes Ullrich


APRIL 2024 MICROSOFT PATCH TUESDAY SUMMARY

This update covers a total of 157 vulnerabilities. Seven of these
vulnerabilities are Chromium vulnerabilities affecting Microsoft's Edge browser.
However, only three of these vulnerabilities are considered critical. One of the
vulnerabilities had already been disclosed and exploited.

Vulnerabilities of Interest:

CVE-2024-26234: This proxy driver spoofing vulnerability has already been
exploited and made public before today. 

CVE-2024-21322, CVE-2024-21323, CVE-2024-29053: These critical vulnerabilities
allow remote code execution in Microsoft Defender for IoT.

The update patches about 40 (sorry, lost exact count) remote code execution
vulnerabilities in Microsoft OLE Driver for SQL Server. These vulnerabilities
are rated only "important", not "critical". The vulnerability affects clients
connecting to malicious SQL servers. The client would be the target, not the
server.

The seven important remote code execution vulnerabilities in the DNS Server
Service look interesting. To achieve remote code execution, "perfect timing" is
required according to Microsoft.

Description CVE Disclosed Exploited Exploitability (old versions) current
version Severity CVSS Base (AVG) CVSS Temporal (AVG) Mariner: Openwsman Path
Traversal and process_connection() DoS vulnerability. CVE-2019-3816 No No - - -
7.5 7.5 CVE-2019-3833 No No - - - 7.5 7.5 .NET, .NET Framework, and Visual
Studio Remote Code Execution Vulnerability CVE-2024-21409 No No - - Important
7.3 6.4 Azure AI Search Information Disclosure Vulnerability CVE-2024-29063 No
No - - Important 7.3 6.6 Azure Arc-enabled Kubernetes Extension Cluster-Scope
Elevation of Privilege Vulnerability CVE-2024-28917 No No - - Important 6.2 5.4
Azure Compute Gallery Elevation of Privilege Vulnerability CVE-2024-21424 No No
- - Important 6.5 5.7 Azure CycleCloud Elevation of Privilege Vulnerability
CVE-2024-29993 No No - - Important 8.8 7.7 Azure Identity Library for .NET
Information Disclosure Vulnerability CVE-2024-29992 No No - - Moderate 5.5 5.3
Azure Migrate Remote Code Execution Vulnerability CVE-2024-26193 No No - -
Important 6.4 5.9 Azure Monitor Agent Elevation of Privilege Vulnerability
CVE-2024-29989 No No - - Important 8.4 7.3 Azure Private 5G Core Denial of
Service Vulnerability CVE-2024-20685 No No - - Moderate 5.9 5.2 BitLocker
Security Feature Bypass Vulnerability CVE-2024-20665 No No - - Important 6.1 5.3
Chromium: CVE-2024-3156 Inappropriate implementation in V8 CVE-2024-3156 No No -
- -     Chromium: CVE-2024-3158 Use after free in Bookmarks CVE-2024-3158 No No
- - -     Chromium: CVE-2024-3159 Out of bounds memory access in V8
CVE-2024-3159 No No - - -     DHCP Server Service Denial of Service
Vulnerability CVE-2024-26212 No No - - Important 7.5 6.5 CVE-2024-26215 No No -
- Important 7.5 7.2 DHCP Server Service Remote Code Execution Vulnerability
CVE-2024-26195 No No - - Important 7.2 6.3 CVE-2024-26202 No No - - Important
7.2 6.3 HTTP.sys Denial of Service Vulnerability CVE-2024-26219 No No - -
Important 7.5 6.5 Intel: CVE-2024-2201 Branch History Injection CVE-2024-2201 No
No - - Important 4.7 4.1 Lenovo: CVE-2024-23593 Zero Out Boot Manager and drop
to UEFI Shell CVE-2024-23593 No No - - Important 7.8 6.8 Lenovo: CVE-2024-23594
Stack Buffer Overflow in LenovoBT.efi CVE-2024-23594 No No - - Important 6.4 5.6
Microsoft Azure Kubernetes Service Confidential Container Elevation of Privilege
Vulnerability CVE-2024-29990 No No - - Important 9.0 8.1 Microsoft Brokering
File System Elevation of Privilege Vulnerability CVE-2024-28905 No No - -
Important 7.8 6.8 CVE-2024-26213 No No - - Important 7.0 6.1 CVE-2024-28904 No
No - - Important 7.8 6.8 CVE-2024-28907 No No - - Important 7.8 6.8 Microsoft
Defender for IoT Elevation of Privilege Vulnerability CVE-2024-21324 No No - -
Important 7.2 6.3 CVE-2024-29055 No No - - Important 7.2 6.3 CVE-2024-29054 No
No - - Important 7.2 6.3 Microsoft Defender for IoT Remote Code Execution
Vulnerability CVE-2024-21322 No No - - Critical 7.2 6.3 CVE-2024-21323 No No - -
Critical 8.8 7.7 CVE-2024-29053 No No - - Critical 8.8 7.7 Microsoft Edge
(Chromium-based) Spoofing Vulnerability CVE-2024-29981 No No Less Likely Less
Likely Low 4.3 3.9 Microsoft Edge (Chromium-based) Webview2 Spoofing
Vulnerability CVE-2024-29049 No No Less Likely Less Likely Moderate 4.1 3.6
Microsoft Excel Remote Code Execution Vulnerability CVE-2024-26257 No No - -
Important 7.8 7.5 Microsoft Install Service Elevation of Privilege Vulnerability
CVE-2024-26158 No No - - Important 7.8 6.8 Microsoft Local Security Authority
Subsystem Service Information Disclosure Vulnerability CVE-2024-26209 No No - -
Important 5.5 4.8 Microsoft Message Queuing (MSMQ) Remote Code Execution
Vulnerability CVE-2024-26232 No No - - Important 7.3 6.4 CVE-2024-26208 No No -
- Important 7.2 6.3 Microsoft ODBC Driver for SQL Server Remote Code Execution
Vulnerability CVE-2024-28929 No No - - Important 8.8 7.7 CVE-2024-28931 No No -
- Important 8.8 7.7 CVE-2024-28932 No No - - Important 8.8 7.7 CVE-2024-28936 No
No - - Important 8.8 7.7 CVE-2024-29043 No No - - Important 8.8 7.7
CVE-2024-28930 No No - - Important 8.8 7.7 CVE-2024-28933 No No - - Important
8.8 7.7 CVE-2024-28934 No No - - Important 8.8 7.7 CVE-2024-28935 No No - -
Important 8.8 7.7 CVE-2024-28937 No No - - Important 8.8 7.7 CVE-2024-28938 No
No - - Important 8.8 7.7 CVE-2024-28941 No No - - Important 8.8 7.7
CVE-2024-28943 No No - - Important 8.8 7.7 Microsoft OLE DB Driver for SQL
Server Remote Code Execution Vulnerability CVE-2024-28906 No No - - Important
8.8 7.7 CVE-2024-28908 No No - - Important 8.8 7.7 CVE-2024-28909 No No - -
Important 8.8 7.7 CVE-2024-28910 No No - - Important 8.8 7.7 CVE-2024-28911 No
No - - Important 8.8 7.7 CVE-2024-28912 No No - - Important 8.8 7.7
CVE-2024-28913 No No - - Important 8.8 7.7 CVE-2024-28914 No No - - Important
8.8 7.7 CVE-2024-28915 No No - - Important 8.8 7.7 CVE-2024-28939 No No - -
Important 8.8 7.7 CVE-2024-28942 No No - - Important 8.8 7.7 CVE-2024-28945 No
No - - Important 8.8 7.7 CVE-2024-29045 No No - - Important 7.5 6.5
CVE-2024-29047 No No - - Important 8.8 7.7 CVE-2024-28926 No No - - Important
8.8 7.7 CVE-2024-28927 No No - - Important 8.8 7.7 CVE-2024-28940 No No - -
Important 8.8 7.7 CVE-2024-28944 No No - - Important 8.8 7.7 CVE-2024-29044 No
No - - Important 8.8 7.7 CVE-2024-29046 No No - - Important 8.8 7.7
CVE-2024-29048 No No - - Important 8.8 7.7 CVE-2024-29982 No No - - Important
8.8 7.7 CVE-2024-29983 No No - - Important 8.8 7.7 CVE-2024-29984 No No - -
Important 8.8 7.7 CVE-2024-29985 No No - - Important 8.8 7.7 Microsoft
SharePoint Server Spoofing Vulnerability CVE-2024-26251 No No - - Important 6.8
6.5 Microsoft Virtual Machine Bus (VMBus) Denial of Service Vulnerability
CVE-2024-26254 No No - - Important 7.5 6.5 Microsoft WDAC OLE DB Provider for
SQL Server Remote Code Execution Vulnerability CVE-2024-26210 No No - -
Important 8.8 7.7 CVE-2024-26244 No No - - Important 8.8 7.7 Microsoft WDAC SQL
Server ODBC Driver Remote Code Execution Vulnerability CVE-2024-26214 No No - -
Important 8.8 7.7 Outlook for Windows Spoofing Vulnerability CVE-2024-20670 No
No - - Important 8.1 7.1 Proxy Driver Spoofing Vulnerability CVE-2024-26234 Yes
Yes - - Important 6.7 5.8 Remote Procedure Call Runtime Remote Code Execution
Vulnerability CVE-2024-20678 No No - - Important 8.8 7.7 Secure Boot Security
Feature Bypass Vulnerability CVE-2024-20669 No No - - Important 6.7 5.8
CVE-2024-20688 No No - - Important 7.1 6.2 CVE-2024-20689 No No - - Important
7.1 6.2 CVE-2024-26250 No No - - Important 6.7 5.8 CVE-2024-28920 No No - -
Important 7.8 6.8 CVE-2024-28922 No No - - Important 4.1 3.6 CVE-2024-28921 No
No - - Important 6.7 5.8 CVE-2024-28919 No No - - Important 6.7 5.8
CVE-2024-28923 No No - - Important 6.4 5.6 CVE-2024-28896 No No - - Important
7.5 6.5 CVE-2024-28898 No No - - Important 6.3 5.5 CVE-2024-28903 No No - -
Important 6.7 5.8 CVE-2024-26168 No No - - Important 6.8 5.9 CVE-2024-26171 No
No - - Important 6.7 5.8 CVE-2024-26175 No No - - Important 7.8 6.8
CVE-2024-26180 No No - - Important 8.0 7.0 CVE-2024-26189 No No - - Important
8.0 7.0 CVE-2024-26194 No No - - Important 7.4 6.4 CVE-2024-26240 No No - -
Important 8.0 7.0 CVE-2024-28924 No No - - Important 6.7 5.8 CVE-2024-28925 No
No - - Important 8.0 7.0 CVE-2024-28897 No No - - Important 6.8 5.9
CVE-2024-29061 No No - - Important 7.8 6.8 CVE-2024-29062 No No - - Important
7.1 6.2 SmartScreen Prompt Security Feature Bypass Vulnerability CVE-2024-29988
No No - - Important 8.8 8.2 Win32k Elevation of Privilege Vulnerability
CVE-2024-26241 No No - - Important 7.8 6.8 Windows Authentication Elevation of
Privilege Vulnerability CVE-2024-21447 No No - - Important 7.8 6.8
CVE-2024-29056 No No - - Important 4.3 3.8 Windows CSC Service Elevation of
Privilege Vulnerability CVE-2024-26229 No No - - Important 7.8 6.8 Windows
Cryptographic Services Remote Code Execution Vulnerability CVE-2024-29050 No No
- - Important 8.4 7.3 Windows Cryptographic Services Security Feature Bypass
Vulnerability CVE-2024-26228 No No - - Important 7.8 6.8 Windows DNS Server
Remote Code Execution Vulnerability CVE-2024-26221 No No - - Important 7.2 6.3
CVE-2024-26222 No No - - Important 7.2 6.3 CVE-2024-26223 No No - - Important
7.2 6.3 CVE-2024-26224 No No - - Important 7.2 6.3 CVE-2024-26227 No No - -
Important 7.2 6.3 CVE-2024-26231 No No - - Important 7.2 6.3 CVE-2024-26233 No
No - - Important 7.2 6.3 Windows DWM Core Library Information Disclosure
Vulnerability CVE-2024-26172 No No - - Important 5.5 4.8 Windows Defender
Credential Guard Elevation of Privilege Vulnerability CVE-2024-26237 No No - -
Important 7.8 6.8 Windows Distributed File System (DFS) Information Disclosure
Vulnerability CVE-2024-26226 No No - - Important 6.5 5.7 Windows Distributed
File System (DFS) Remote Code Execution Vulnerability CVE-2024-29066 No No - -
Important 7.2 6.3 Windows File Server Resource Management Service Elevation of
Privilege Vulnerability CVE-2024-26216 No No - - Important 7.3 6.4 Windows
Hyper-V Denial of Service Vulnerability CVE-2024-29064 No No - - Important 6.2
5.4 Windows Kerberos Denial of Service Vulnerability CVE-2024-26183 No No - -
Important 6.5 5.7 Windows Kerberos Elevation of Privilege Vulnerability
CVE-2024-26248 No No - - Important 7.5 6.5 Windows Kernel Elevation of Privilege
Vulnerability CVE-2024-20693 No No - - Important 7.8 6.8 CVE-2024-26218 No No -
- Important 7.8 6.8 Windows Mobile Hotspot Information Disclosure Vulnerability
CVE-2024-26220 No No - - Important 5.0 4.4 Windows Remote Access Connection
Manager Elevation of Privilege Vulnerability CVE-2024-26211 No No - - Important
7.8 6.8 Windows Remote Access Connection Manager Information Disclosure
Vulnerability CVE-2024-26255 No No - - Important 5.5 4.8 CVE-2024-28901 No No -
- Important 5.5 4.8 CVE-2024-28902 No No - - Important 5.5 4.8 CVE-2024-26207 No
No - - Important 5.5 4.8 CVE-2024-26217 No No - - Important 5.5 4.8
CVE-2024-28900 No No - - Important 5.5 4.8 Windows Routing and Remote Access
Service (RRAS) Remote Code Execution Vulnerability CVE-2024-26179 No No - -
Important 8.8 7.7 CVE-2024-26200 No No - - Important 8.8 7.7 CVE-2024-26205 No
No - - Important 8.8 7.7 Windows SMB Elevation of Privilege Vulnerability
CVE-2024-26245 No No - - Important 7.8 6.8 Windows Storage Elevation of
Privilege Vulnerability CVE-2024-29052 No No - - Important 7.8 6.8 Windows
Telephony Server Elevation of Privilege Vulnerability CVE-2024-26242 No No - -
Important 7.0 6.1 CVE-2024-26230 No No - - Important 7.8 6.8 CVE-2024-26239 No
No - - Important 7.8 6.8 Windows USB Print Driver Elevation of Privilege
Vulnerability CVE-2024-26243 No No - - Important 7.0 6.1 Windows Update Stack
Elevation of Privilege Vulnerability CVE-2024-26235 No No - - Important 7.8 6.8
CVE-2024-26236 No No - - Important 7.0 6.1 Windows rndismp6.sys Remote Code
Execution Vulnerability CVE-2024-26252 No No - - Important 6.8 5.9
CVE-2024-26253 No No - - Important 6.8 5.9 libarchive Remote Code Execution
Vulnerability CVE-2024-26256 No No - - Important 7.8 6.8

---
Johannes B. Ullrich, Ph.D. , Dean of Research, SANS.edu
Twitter|

Johannes Ullrich


PODCASTS


VIEW ALL





ISC STORMCAST FOR FRIDAY, APRIL 12TH, 2024

Released: 2024-04-12 02:00:02

A daily summary of cyber security news from the SANS Internet Stormcenter

Listen Now


ISC STORMCAST FOR THURSDAY, APRIL 11TH, 2024

Released: 2024-04-11 02:00:02

A daily summary of cyber security news from the SANS Internet Stormcenter

Listen Now


ISC STORMCAST FOR WEDNESDAY, APRIL 10TH, 2024

Released: 2024-04-10 02:00:02

A daily summary of cyber security news from the SANS Internet Stormcenter

Listen Now


ISC STORMCAST FOR TUESDAY, APRIL 9TH, 2024

Released: 2024-04-09 02:00:01

A daily summary of cyber security news from the SANS Internet Stormcenter

Listen Now


ISC STORMCAST FOR MONDAY, APRIL 8TH, 2024

Released: 2024-04-08 02:00:02

A daily summary of cyber security news from the SANS Internet Stormcenter

Listen Now


ISC STORMCAST FOR FRIDAY, APRIL 5TH, 2024

Released: 2024-04-05 02:00:02

A daily summary of cyber security news from the SANS Internet Stormcenter

Listen Now


ISC STORMCAST FOR THURSDAY, APRIL 4TH, 2024

Released: 2024-04-04 02:00:02

A daily summary of cyber security news from the SANS Internet Stormcenter

Listen Now


JOBS


VIEW ALL



American Electric Power • US, REMOTE


SECURITY SPECIALIST

GREM, GMON, GCED, GPEN, GCIH, GCIA, GNFA, GCFA

View Details Apply Now
MetLife • Cary, NC


INFRASTRUCTURE VULNERABILITY ASSESSMENT CONSULTANT

GISF, GSEC, GCED, GPEN, GXPN, GCIH, GPYC, GCLD, GCPN, or other GIAC

View Details Apply Now
Capital One • McLean, VA


ACTIVE DEFENSE ANALYST, CYBER DEFENSE

GSEC, GCIH

View Details Apply Now
Wurth IT USA • Chicago, IL / Northern Suburbs


SOC - CYBER SECURITY ANALYST

GSOC

View Details Apply Now
City of New York / NYC Cyber Command • Brooklyn, NY


SOC THREAT ANALYST

GSOC, GCIH, GCIA, GCFA, GNFA

View Details Apply Now
CACI • Washington, DC


CLOUD ARCHITECTS AND ENGINEERS

GCIH, GPEN

View Details Apply Now
WIN Technology • Eau Claire, Wisconsin (USA)


INFORMATION SECURITY ENGINEER

GCIH, GPEN, GWAPT, GAWN, GDAT, GMON, GCED, GSIP, GCFA, GCCC, and other GIAC

View Details Apply Now
Microsoft Federal • Washington, DC


SECURITY CLOUD SOLUTION ARCHITECT - CTJ (JUNIOR/MID-LEVEL)

GPCS, GCLD, GCFE, GCFA

View Details Apply Now
Microsoft Federal • Reston, VA


SECURITY CLOUD SOLUTION ARCHITECT - CTJ (SENIOR LEVEL)

GCED, GCFA, GCIH, GICSP, OR GCIP, GPEN, GRID, GWAPT

View Details Apply Now
Liberty Utilities • US or Canada (Remote)


ANALYST III, SECURITY OPERATIONS

GSEC

View Details Apply Now
Raymond James • Canada


LEAD CYBER THREAT INTELLIGENCE

GPEN, GCFA, GDAT, GCTI

View Details Apply Now
ADP • Roseland NJ / Hybrid - remote possible


LEAD INCIDENT RESPONSE SECURITY ANALYST

GCIH GCIA GCFA GSEC GREM GCFE

View Details Apply Now
The Hershey Company • Hershey, PA or Remote


STAFF SECURITY ENGINEER

GCSA, GPCS, GDSA, GSP, GPEN, GSE,

View Details Apply Now
The Hershey Company • Hershey, PA or Remote


SENIOR SECURITY ENGINEER

GSEC, GCIH, GCIA, GCDA, GMON

View Details Apply Now
Liberty Utilities • US or Canada (Remote)


ARCHITECT, CYBERSECURITY

GSEC

View Details Apply Now
Liberty Utilities • US or Canada (Remote)


ENGINEER, CYBERSECURITY ENGINEERING (OT)

GSEC

View Details Apply Now
Liberty Utilities • US or Canada (Remote)


ANALYST II, SECURITY OPERATIONS

GSEC

View Details Apply Now
   
 * Homepage
 * Diaries
 * Podcasts
 * Jobs
 * Data
   * TCP/UDP Port Activity
   * Port Trends
   * SSH/Telnet Scanning Activity
   * Weblogs
   * Threat Feeds Activity
   * Threat Feeds Map
   * Useful InfoSec Links
   * Presentations & Papers
   * Research Papers
   * API
 * Tools
   * DShield Sensor
   * DNS Looking Glass
   * Honeypot (RPi/AWS)
   * InfoSec Glossary
 * Contact Us
   * Contact Us
   * About Us
   * Handlers
 * About Us

Slack Channel

Mastodon

Bluesky

X

Subscribe to the daily podcast via RSS or iTunes

© 2024 SANS™ Internet Storm Center Developers: We have an API for you!  
 * Link To Us
 * About Us
 * Handlers
 * Privacy Policy

 * 
 * 
 * 
 * 
 *