This Tuesday, 2023-07-11, was Microsoft’s Patch Tuesday for July 2023, so right here’s a short reminder to do two issues:

• Patch early, patch typically.

Greater than 100 vulnerabilities had been patched this month, together with 4 zero-day safety holes for which working exploit code already exists.

Though everybody was in danger till Tuesday, it’s essential to not be a kind of individuals who stays in danger longer than essential.

When defenders shut off holes that cybercriminals are already abusing, it’s best to assume one factor: these crooks are going to focus their consideration on the stragglers towards whom these now-patched assaults are nonetheless efficient, with a purpose to extract the final “worth” out of their former zero-day holes.

• Head to our sister website Sophos Information for official particulars about on the patches.

We’ve revealed an unavoidably prolonged checklist, based mostly on Microsoft’s official knowledge, to aid you navigate by way of the numerous CVE numbers and bug explanations related to the quite a few services and products affected.

We expect you’ll discover the data simpler to work with, as a place to begin, than Redmond’s personal tables and charts.

We’ve additionally revealed an in-depth article about an ongoing safety subject that was severe sufficient to be addressed in a Microsoft Advisory (ADV230001).

We’ve given you essential, attention-grabbing and informative element concerning the ongoing saga of malicious kernel drivers, lots of them signed and permitted by Microsoft itself, which have lastly been blocked by Home windows.

Two fast takeaways

As we’ve talked about above, you may learn up about this month’s Microsoft safety fixes on Sophos Information, however there are two components of this month’s patch set that we thought we’d cowl right here.

The primary essential merchandise is the matter of these 4 zero-days that we already referred to.

CVE-2023-32049 and CVE-2023-35311 are safety bypass exploits, which means that criminals can abuse these bugs to sidestep safety protections that might in any other case leap in that will help you keep away from malware an infection or a doable assault.

Between them, these bugs enable criminals to current you with booby-trapped internet URLs in your browser, or malicious e mail content material in Outlook, that might often pop up a warning to remind you of the dangers, and to offer you an opportunity to bail out and shield your self…

…with out these warnings showing in any respect.

Though this isn’t as harmful as a real distant code execution (RCE) gap, the place an outsider might trick you into operating a rogue program simply by viewing an internet web page or by beginning a specific community service, you may see why safety bugs of this type are gold mud to cybercriminals.

Bypasses for safety warnings that customers have come to anticipate, and maybe to depend upon, present a easy and efficient method of luring even well-informed and cautious customers into making expensive errors.

There are additionally patches for 2 zero-day elevation of privilege (EoP) exploits.

EoP exploits imply tha crooks who’re already in your community, however with out the flexibility to do a lot harm or to steal a lot knowledge, can promote themselves to sysadmin stage and thus primarily subject themselves “entry all areas” safety badges.

Dodgy driver issues

The second essential merchandise is the matter of ADV230001, Microsoft’s advisory entitled Steerage on Microsoft signed drivers getting used maliciously.

This saga began again on the finish of 2022, when Sophos researchers got here throughout one thing that you simply don’t see wherever close to as typically as you used to, particularly rogue Home windows kernel drivers:

The beauty of kernel drivers is that they supply a method for third-party software program to get usefully concerned on the very lowest ranges of the working system, comparable to supporting esoteric laptop {hardware}, offering extra cybersecurity safety, monitoring and managing in any other case invisible particulars together with reminiscence allocation and useful resource utilisation, and extra.

A kernel-level anti-virus program, for instance, can leap in earlier than each program runs, and never merely report but additionally actively block rogue software program from loading in any respect.

The not-so-great factor about kernel drivers is that they provide the exact same super-low-level, mega-dangerous and probably subversive capabilities to malware creators and cybercriminals, too.

Certainly, kernel-level malware instruments, typically often known as a rootkits, can work the identical type of low-level magic in reverse, for instance by watching out for known-bad packages and stopping them from being blocked within the first place, and even making them apparently invisible to scanning instruments, listing itemizing software program and inventory-taking purposes.

The title rootkit comes from early Unix malware, and references the thought of a equipment of software program instruments that helps you not solely to get administrator-level entry within the first place (often known as root on Unix and Unix-like methods), but additionally to go unnoticed for so long as doable.

Driver clampdown

Because of the proliferation and abuse of rootkits on Home windows XP, Microsoft began clamping down on kernel drivers, beginning again in Home windows Vista.

Certainly, in present variations of Home windows the place Safe Boot is enabled, you may solely load kernel drivers which have been formally reviewed and digitally signed by Microsoft itself. (There are exceptions to this rule, however you may’t simply create and cargo a kernel driver in the present day with out sending it to Microsoft for scrutiny first.)

Though you might, albeit reluctantly, settle for that code validation companies comparable to Apple’s App Retailer and Google’s Play Retailer will inevitably be permeable to malware, on condition that their aim is to look at and approve enormous numbers of third-party apps shortly, routinely and objectively…

…you would possibly fairly anticipate that kernel drivers, given their harmful powers and their comparative rarity in comparison with common purposes, could be pretty much as good as unattainable to sneak previous the Home windows vetting course of.

Final December’s rogue driver discoveries by SophosLabs, nonetheless, in the end turned up a important checklist of kernel-level malware, together with 100 drivers signed “personally” by Microsoft itself.

68 of the Microsoft-approved rogue drivers had been anti-anti-virus instruments, geared toward killing off safety software program “from beneath” by abusing the ability and authority of the working system.

The remaining had been extra normal rootkits geared toward spying on and manipulating knowledge contained in the working system, the place data as intimate as particular person community packets to and from each operating program will be snooped, surveilled and sneakily altered.

To be taught extra concerning the fascinating backstory of those wrongly-signed crimeware drivers, please learn our article entitled Microsoft revokes malicious drivers in Patch Tuesday Culling:

What to do?

We stated it on the high, albeit in barely completely different phrases: Don’t delay; do it in the present day.

In case you’re accountable for your individual laptop, simply go to Settings > Home windows Replace > Verify for updates to see if you happen to’re up-to-date or not.

Don’t neglect that the updates received’t be accomplished till you reboot your laptop, so purpose to do this sooner moderately than later.