BeyondTrust

Security in Context: The BeyondTrust Blog

Welcome to Security in Context

Bringing you news and commentary on solutions and strategies for protecting critical IT infrastructure in the context of your business.

Flame Malware Burns a Little Brighter

Posted June 5, 2012    Peter McCalister

Did you know that Microsoft’s Terminal Server Licensing Service (we’ll call it TSLS for convenience) generated certificates that could be used to sign code? No? Neither did Redmond. Flame leveraged a “0day” (zero day) within TSLS to sign its own code, allowing it to appear as if the code came from Microsoft. This allowed Flame to propagate itself in a network by fooling other machines into believing it was serving Windows Update packages, when in actuality, it was serving up Microsoft signed versions of Flame. More details follow… but first, here is some actionable intelligence:

What does this mean for you and your organization? Apply this fix (Bulletin, Patch) immediately. Unless the patch is applied, your machines may end up trusting malicious code. Retina provides detection for the vulnerable certificates via audit 16497 – Microsoft Revocation of Fraudulent Certificates (2718704).

Our original post (which goes into more detail) can be found at the eEye blog “Flame Malware Burns a Little Brighter”.

Leave a Reply

Additional articles

Sudo_logo

Don’t Create a Different sudoers File for Each System

Posted May 20, 2015    Randy Franklin Smith

What if you have multiple Linux and/or Unix systems? Sudo management can become onerous and unwieldy if you try to manage a different sudoers file on each system. The good news is that sudo supports multiple systems.

password-safety

What Does Microsoft Local Administrator Password Solution Really Do?

Posted May 19, 2015    Morey Haber

LAPS is a feature that allows the randomization of local administrator accounts across the domain. Although it would seem that this capability overlaps with features in BeyondTrust’s PowerBroker Password Safe (PBPS), the reality is it is more suited for simple use cases such as changing the local Windows admin account and not much more.

Tags:
, ,
webinar_ondemand

On Demand Webinar: Securing Windows Server with Security Compliance Manager

Posted May 14, 2015    BeyondTrust Software

On Demand Webinar: Security Expert Russell Smith, explains how to use Microsoft’s free Security Compliance Manager (SCM) tool to create and deploy your own security baselines, including user and computer authentication settings.

Tags:
, ,