Get Help Now
CONTACT US

RESOURCES  >   THREAT INTEL BRIEFINGS

Date: 3/14/2022

Threat Overview

Google has issued a new warning to all Chrome’s 3.2 billion users worldwide — as well as users of other Chromium-based browsers, like Microsoft Edge — to expect an increasing number of ‘zero-day’ attacks (attacks that make it into “the wild” before Google can issue a fix. 

Potential Impact

Hackers increasingly need multiple attacks to break through Chrome’s defenses due to sandboxing. This is a security mechanism for separating running programs, so successful attacks cannot spread to more vulnerable parts of the browser. However, deprecation of Adobe Flash and the dramatic rise in the popularity of Chrome and Chromium-based browsers, make Google platforms a significant target for attackers. 

Recommended Actions

Chrome and Chromium-based browsers cannot protect themselves automatically. After installing an update, Chrome and Chromium-based browsers must be restarted by users before they are protected.

Sources
https://www.forbes.com/sites/gordonkelly/2022/03/12/google-chrome-warning-security-hack-threat-zero-day-attack-chrome-update-chromium-microsoft-edge/?utm_source=newsletter&utm_medium=email&utm_campaign=follow&cdlcid=61a4db906e1a1d1211a5f100&utm_source=newsletter&utm_medium=email&utm_campaign=follow&cdlcid=61a4db906e1a1d1211a5f100&sh=5e684a6c2ef8

Threat Overview

On Tuesday, March 8, Microsoft released updates to address more than 71 security issues in multiple products. Three of the vulnerabilities are rated critical. The updates include a fix for an issue that was preventing some data from being erased after resetting Windows 10 and Windows 11.

Potential Impact

CVE-2022-23277 is another RCE for Exchange servers. It can be exploited by an authenticated user to “trigger malicious code in the context of the server’s account through a network call. The other two critical RCEs affect Microsoft’s Video Extensions products. One, CVE-2022-24501, exists in the VP9 Video Extensions app available on the Microsoft Store. An attacker could exploit this flaw by convincing a user to open a malicious video file. 

Recommended Actions

Microsoft will auto-update or customers are urged to patch as soon as possible, for these three RCE vulnerabilities. 

Sources
www.theregister.com: Microsoft patches critical remote-code-exec hole in Exchange Server and others
 www.zdnet.com: Microsoft’s latest Windows patches fix the bug causing user data not to be erased
krebsonsecurity.com: Microsoft Patch Tuesday, March 2022 Edition
threatpost.com: Microsoft Addresses 3 Zero-Days & 3 Critical Bugs for March Patch Tuesday
msrc.microsoft.com: Security Update Guide

Threat Overview

Google has issued a new warning to all Chrome’s 3.2 billion users worldwide — as well as users of other Chromium-based browsers, like Microsoft Edge — to expect an increasing number of ‘zero-day’ attacks (attacks that make it into “the wild” before Google can issue a fix. 

Potential Impact

Hackers increasingly need multiple attacks to break through Chrome’s defenses due to sandboxing. This is a security mechanism for separating running programs, so successful attacks cannot spread to more vulnerable parts of the browser. However, deprecation of Adobe Flash and the dramatic rise in the popularity of Chrome and Chromium-based browsers, make Google platforms a significant target for attackers. 

Recommended Actions

Chrome and Chromium-based browsers cannot protect themselves automatically. After installing an update, Chrome and Chromium-based browsers must be restarted by users before they are protected.

Sources
https://www.forbes.com/sites/gordonkelly/2022/03/12/google-chrome-warning-security-hack-threat-zero-day-attack-chrome-update-chromium-microsoft-edge/?utm_source=newsletter&utm_medium=email&utm_campaign=follow&cdlcid=61a4db906e1a1d1211a5f100&utm_source=newsletter&utm_medium=email&utm_campaign=follow&cdlcid=61a4db906e1a1d1211a5f100&sh=5e684a6c2ef8

For strategic clients, your vCISO will add this to your next Office Hours for further discussion. However, if you have an immediate need, concern, or question, please reach out to them directly.

For non-strategic clients, please reach out to your Advisor for further discussion.

Let’s Discuss Your Cybersecurity Needs

Privacy Settings
We use cookies to enhance your experience while using our website. If you are using our Services via a browser you can restrict, block or remove cookies through your web browser settings. We also use content and scripts from third parties that may use tracking technologies. You can selectively provide your consent below to allow such third party embeds. For complete information about the cookies we use, data we collect and how we process them, please check our Privacy Policy
Youtube
Consent to display content from - Youtube
Vimeo
Consent to display content from - Vimeo
Google Maps
Consent to display content from - Google
Spotify
Consent to display content from - Spotify
Sound Cloud
Consent to display content from - Sound
Contact Us