Microsoft Reveals New Innocent Ways Windows Users Can Get Hacked

Microsoft earlier today released its August 2020 batch of software security updates for all supported versions of its Windows operating systems and other products.

This month's Patch Tuesday updates address a complete of 120 newly discovered software vulnerabilities, of which 17 are critical, and therefore the rest are important in severity.

In a nutshell, your Windows computer are often hacked if you:

Play a video file — because of flaws in Microsoft Media Foundation and Windows Codecs

Listen to audio — because of bugs affecting Windows Media Audio Codec

Browser an internet site — because of 'all time buggy' Internet Explorer

Edit an HTML page — because of an MSHTML Engine flaw

Read a PDF — because of a loophole in Microsoft Edge PDF Reader

Receive an email message — because of yet one more bug in Microsoft Outlook

But don't be concerned , you do not got to stop using your computer or without Windows OS thereon . All you would like to try to to is click on the beginning Menu → open Settings → click Security and Update, and install if any new update is out there .

Install Updates! Two Zero-Days Under Active Attacks

Another reason why you ought to not ignore this recommendation is that two of the safety flaws have reportedly been exploited by hackers within the wild and one publicly known at the time of release.

According to Microsoft, one among the zero-day vulnerabilities under active attack may be a remote code execution bug that resides within the scripting engine's library jscript9.dll, which is employed by default by all versions of Internet Explorer since IE9.

The vulnerability, tracked as CVE-2020-1380, was spotted by Kaspersky Labs and has been rated critical because Internet Explorer remains a crucial component of Windows because it still comes installed by default within the latest Windows.

Kaspersky researchers explain that the flaw may be a use-after-free vulnerability in JScript that corrupts the dynamic memory in Internet Explorer in such how that an attacker could execute arbitrary code within the context of the present user. So, if the present user is logged in with administrative privileges, the attacker could control the affected system.

"An attacker could also embed an ActiveX control marked "safe for initialization" in an application or Microsoft Office document that hosts the IE rendering engine. The attacker could also cash in of compromised websites and websites that accept or host user-provided content or advertisements," Microsoft says in its advisory.

Exploited by unknown threat actors as a part of 'Operation PowerFall' attacks, a proof-of-concept exploit code, and technical details for the zero-day vulnerability are published by Kaspersky.

The second zero-day vulnerability—tracked as CVE-2020-1464 and under active exploitation—is a Windows spoofing bug that exists when Windows incorrectly validates file signatures.

This zero-day bug affects all supported versions of Windows and allows attackers to load improperly signed files by bypassing security measures intended to stop incorrectly signed files from being loaded.

Besides these, notably, the batch also includes a critical patch for an elevation of privilege flaw affecting NetLogon for Windows Server editions, where this RPC service is a website controller.

Tracked as 'CVE-2020-1472,' the vulnerability are often exploited by unauthenticated attackers to use Netlogon Remote Protocol (MS-NRPC) to attach to a website Controller (DC) and acquire administrative access to run malicious applications on a tool on the network.

Home users and server administrators are strongly recommended to use the newest security patches as soon as possible to stop malware or miscreants from exploiting and gain complete remote over their vulnerable computers.