Security | Threat Detection | Cyberattacks | DevSecOps | Compliance

On June 7, 2024, a new critical PHP vulnerability CVE-2024-4577 was revealed, mainly impacting XAMPP on Windows. It happens when PHP runs in CGI mode with specific language settings, like Chinese or Japanese. The problem comes from how PHP handles certain characters, allowing attackers to inject code through web requests and take control of servers. This vulnerability, if exploited, could lead to the execution of arbitrary code, a scenario with severe consequences for system integrity and data security.

Windows credential manager securely stores and manages user credentials such as usernames, passwords, and certificates. These credentials are often used to access various resources, including network shares, websites, and applications, facilitating access to information and managing digital identities.

The distribution of component object models across different computers is called Distributed Component Object Model (DCOM). DCOM in Windows means an object of the client program can request services from objects on the server program on other computers within the same network. DCOM can also be implemented on a majority of UNIX platforms and aids communication among software components across different computers within a wide area network, local area network(LAN), or over the internet.

Best practices for mitigating various attack vectors are changing depending on the environment and server functionality. CIS baselines cover most of the relevant scenarios by addressing the first stage of your Hardening Windows Server project. CIS Benchmarks -What are They and How to Use Them Microsoft has been doing some work related to default security configuration, but there is still a big gap between security best practices (i.e. common benchmarks) and the default Windows configuration.

Microsoft’s initiative to phase out NTLM authentication in favor of the more secure Kerberos protocol was originally announced back in October 2023. At that time, the Windows maker declared its intention to deprecate NTLM and encourage organizations to transition to Kerberos for authentication purposes across its ecosystem. Microsoft announced this week that later this year they are expecting to retire NTLM authentication in Windows 11.

User Account Control (UAC) serves as a security feature in Windows, aiming to safeguard the operating system from unauthorized modifications. Whenever alterations demand administrator-level permissions, UAC prompts the user, allowing them to either authorize or reject the requested change. User Account Control (UAC) provides several benefits, especially in maintaining security and minimizing risks associated with administrative privilege.

This Windows policy specifies which accounts can keep data in physical memory, preventing the system from paging it to virtual memory on disk. RAM (Random Access Memory) and virtual storage serve as two types of memory in a computer system, each with distinct functions and characteristics. RAM, the physical memory installed in a computer, provides fast access to actively used data by the CPU, determining the system’s multitasking capabilities.

Keeping Windows Server systems updated with the latest patches is one of the key things that administrators can do to ensure their Windows Server environments are stable and secure. Patching is one of the necessary evils that administrators need to manage to keep Windows, Linux, and other environments healthy. Hyper-V hosts are part of the infrastructure that also needs to be kept updated.

WDigest Authentication is a method used in Windows operating systems for verifying user credentials during authentication. It’s a way for computers to prove their identity to servers by storing a copy of the user’s plaintext password in memory. It uses Hypertext Transfer Protocol (HTTP) along with Simple Authentication Security Layer (SASL) exchanges for authentication purposes. The name “WDigest” comes from its function and purpose within the Windows operating system.