Cybersecurity Expert

May 2019 was the busiest month of the year for critical security vulnerabilities and patch announcements. The standout was a  Microsoft critical security update for Windows, rated with a CVSS score of 9.8 of 10 . This vulnerability fixes  CVE-2019-0708  aka 'BlueKeep', which if exploited could allow the rapid propagation of malware (i.e. worm) across networked devices, similar to the devastating WannaCry ransomware attacks of 2017 .  Such is the concern at Microsoft, they have released BlueKeep patches for their unsupported versions of Windows (i.e. XP, Visa, Server 2003) , a very rare occurrence. Researchers at Errata Security said they have found almost one million internet-connected systems which are vulnerable  to the BlueKeep bug. A zero-day Microsoft vulnerability was also reported by an individual called 'SandboxEscaper ', which I expect Microsoft will patch as part of their monthly patch cycle in June.  And a past Microsoft vulnerability, CVE-201...

Quickly applying software updates (patching) to mitigate security vulnerabilities is a cornerstone of both a home and business security strategy. So it was interesting to see how the mainstream news media reported the disclosure of three separate ‘major’ security vulnerabilities this week, within WhatsApp, Microsoft Windows and Intel Processors. WhatsApp The WhatsApp security flaw by far received the most the attention of the media and was very much the leading frontpage news story for a day. The WhatsApp vulnerability ( CVE-2019-3568 ) impacts both iPhone and Android versions of the mobile messaging app, allowing an attacker to install surveillance software, namely,  spyware called Pegasus , which access can the smartphone's call logs, text messages, and can covertly enable and record the camera and microphone. From a technical perspective, the vulnerability ( CVE-2019-3568 ) can be exploited with a buffer overflow attack against WhatsApp's VOIP stack, this makes remote cod...