May 3, 2025 - Red Dot Security

Hello all,

Last week was “World Password Week”. However, this year many tech giants chose, to replace “password” with “passkey”. In fact, on what was World Password Day, Microsoft announced that all new Microsoft accounts will now be passwordless, use passkeys by default, and existing accounts will be transitioned as quickly as possible. The RSA conference didn’t unleash the hailstorm of vulnerabilities that I expected, but instead there was a steady stream of new product and enhancement announcements – most involving the use of AI. There was at least one vulnerability revealed last week that has devastating potential.

Headline NEWS:

Apple Airplay vulnerabilities revealed that can enable zero-click device takeover, DOS, Remote Code Execution (RCE), Man in The Middle (MiTM) attacks, and more. This is as serious as it gets since the defect is in the Airplay SDK itself and will need to be fixed in everything that uses it. Attackers can use these flaws to set up beachheads for other attacks, to spy on networks, and to surreptitiously exfiltrate data. Check your devices for updates. If you don’t need Airplay active, turn it off.
iOS Vulnerability in Darwin Notifications System, a part of the operating system that lets processes communicate with each other, has a defect that could crash the operating system with a single line of code. The fix is to update to iOS version 18.3 or later.
Linux Kernel defect dubbed “Attack of the Vsock” was revealed this week that could allow for privilege escalation all the way to root. Check with your favored penguin vendor for updates to plug this hole.
Microsoft Passwordless future is here. Big Redmond has flipped the switch, and all new accounts will now be created with passkeys vs. passwords. Any existing accounts that use a password and MFA will be prompted to create a passkey after successful login. Upon next login, you’ll be prompted to log in with the new passkey. It is unclear at this time how organizations that use other MFA methods and have complex Conditional Access Policies surrounding logons will be affected by this change.

In Ransomware, Malware, and Vulnerabilities News:

Microsoft Windows RDP caches passwords – indefinitely. A researcher discovered that RDP sessions cache passwords locally, and even if you change the password in Azure, the old password still works on the Windows RDP machine. In fact, many old passwords work! When brought to Microsoft’s attention, they said that this was by design and had no plans to change it. Since this story broke this week, there has been a lot of press about it, so I expect that this unbelievable hole will get plugged soon – I hope.

In Other News Events of Note and Interest:

Windows Server Hot patching – pay to play. I was excited when I first learned that Microsoft would include the ability to hot patch locally run versions of Windows Server 2025. Previously, this had only been available to Azure hosted Windows servers. Unfortunately, the world learned this week that Microsoft wants to charge us $1.50 per core per month for the privilege of only needing to reboot once a quarter. Somehow this seems like a money grab to me.

Musings:

I saw a shirt on LinkedIn this week with #NaaS on it. This stands for “Not as a Service”. Hundreds of people commented on the picture that they agree. I’m old enough to recall that you could purchase software (or a license to use it, as vendors are apt to say) and it was perpetual. If you didn’t want new versions, you could keep using that same version on your systems until either the software wouldn’t work with your operating system, or the silicon turned back into sand, whichever came first. Nowadays, nearly everything is a service that you pay for monthly. The last two generations have mostly grown up with the mindset of “What is my monthly payment?” for just about anything. And as long as they have enough money to pay the bills, they’re content, never considering the long-term cost of use or ownership. Subscription everything. Car leases, finance a $1000 cellphone monthly, prepared meals delivered home, and monthly software subscriptions. I must admit that in some ways, always having the most up to date “thing” is a nice benefit of a subscription, but how many of the new features or enhancements do you truly find useful? I suspect that I could do pretty much everything I needed to do regarding document writing with Microsoft Word 6.0. But maybe my luddite ways need to ease up a bit, because purely from a security mindset, subscription services for software have been a godsend in that holes are continually plugged, and threat actors have a significantly harder time doing their evil work. So, I guess the hashtag should be #EiiSBaS, “Evaluate if it Should Be a Service”, because not everything should. Still, Microsoft’s recent announcement that hot patching of security updates will require a subscription seems downright wrong, like a money-grab. Alas, based on our “What’s my monthly payment?” culture, I expect that enough organizations will sign up and this new revenue stream will become standard.

Headline NEWS

Ransomware, Malware, and Vulnerabilities News

Other News Events of Note and Interest

Like this: