Published: June 25, 2020 on our newsletter Security Fraud News & Alerts Newsletter.
Sometimes we need a reminder of some serious cybersecurity-related issue. And fortunately, Microsoft has recently given us an opportunity to revisit a zero-day vulnerability. Actually, in this case, Trend Micro’s Zero Day Initiative team has given us three zero-day vulnerabilities to work with for our periodic reminder. All are with respect to Microsoft Windows and may allow an attacker to gain escalated privileges to an infected machine.
A zero-day vulnerability is a flaw that is unpatched and that may be exploited until a fix is released. These issues, reported as CVE-2020-0916, CVE-2020-0986, and CVE-2020-0915 were provided to Microsoft in December of last year, but were not fixed in the May 2020 Patch Tuesday from the company. Therefore, Trend Micro released the information to the public to raise awareness of them. They affect the user-mode printer driver host process splwow64.exe.
Because they are zero-day, anyone using Windows should be diligent about a few things. First, always make sure what patches and updates are available for all devices are applied and all software versions are current. Next, be on the lookout for phishing email messages. If anything comes across the inbox that is from an unknown sender, is not expected, or contains an attachment or link, be extra cautious about clicking anything. Take an extra minute and contact the sender separately to make sure it’s real. When not using your Windows computer, turn it off and make sure all routers and WiFi access points at home are updated.
In addition, if you use public WiFi for work purposes, be sure to use a VPN to encrypt the link and secure the information being transferred between you and the office.
Don’t do critical tasks on your computer on public WiFi. Wait until you can connect to a secured site, such as at home or the office. If you have to, use your mobile devices cellular data to perform the task. It’s safer than unprotected WiFi. Finally, always keep antivirus software on all devices and ensure that it’s set to automatically update, so you don’t have to do it manually.
Keep up to date: Sign up for our Fraud alerts and Updates newsletter
Want to schedule a conversation? Please email us at advisor@nadicent.com