SoylentNews is people
SoylentNews
AtomBomb: The New Zero-Day Windows Exploit Microsoft Can't Fix?
There's a new zero-day Microsoft Windows exploit in the wild by the name of AtomBomb, and Microsoft may not be able to fix it.
Ensilo security researchers have discovered a new zero-day exploit in Windows that attackers can make use of to inject and execute malicious code. The researches call the exploit AtomBombing because of its use of a Windows function called Atom Tables.
What's particularly interesting about the exploit is that it does not rely on security vulnerabilities in Windows components but native Windows functions. This means, according to the researchers, that Microsoft won't be able to patch the issue.
It is particularly worrying that the issue affects all versions of Windows, and that security programs that run on the system -- firewall or antivirus for instance -- won't stop the execution of the exploit.
The technique works in the following way on an abstract level:
- Malicious code needs to be executed on a Windows machine. A user might run malicious code for instance.
- This code is blocked usually by antivirus software or other security software or policies.
- In the case of AtomBombing, the malicious program writes the malicious code in an atom table (which is a legitimate function of Windows and won't be stopped therefore).
- It then uses legitimate processes via APC (Async Procedure Calls) , a web browser for instance, to retrieve the code from the table undetected by security software to execute it.
You can find an extremely detailed explanation of AtomBombing here. Time to run Windows only in VMs?
New code injection attack works on all Windows versions - Help Net Security
Source: https://www.helpnetsecurity.com/2016/10/28/code-injection-windows-atombombing/
(Score: 0, Troll) by Francis on Monday October 31 2016, @04:06AM
I've tried opensource OCR and I've yet to find one that works well. Certainly not well enough for me to ditch my current system for.
IIRC, the best software I came across was Tesseract, but that didn't work very well for the things I was scanning. It's probably better now than then, but I don't see much point in dumping software and hardware I already have just to use open source. I've ditched most of the software I used to use for equivalents and that's worked fine, but as long as I can run the few remaining pieces of software in a VM, I don't see much purpose to ditching it for the sake of ditching it.
And even if I do ditch it, then I have to go back to retaining all my receipts and similar in order to do my taxes, which greatly reduces the point of using my neat receipts in the first place.
(Score: 0) by Anonymous Coward on Tuesday November 01 2016, @03:12AM
only traitors, cowards and idiots pay the federal income tax.
(Score: 2) by butthurt on Thursday November 03 2016, @02:45PM
>[...] using my neat receipts [...]
My Neat Receipts SCSA4601EU is the Plustek Opticslim M12 [...]
-- https://social.technet.microsoft.com/Forums/windows/en-US/d8a8ae0f-a709-4cbd-a40e-8fe8c1c519c8/neat-receipts?forum=w7itprohardware [microsoft.com]
Plustek OpticSlim M12 sheetfed scanner. Supported by the SANE gt68xx backend.
-- http://gkall.hobby.nl/gt6816-07b3-0412.html [hobby.nl]
You probably still need to copy the firmware manually.
-- https://bugs.launchpad.net/ubuntu/+source/sane-backends/+bug/312296 [launchpad.net]
This is from 2007 so it may be outdated:
Sheet-fed scanner. Use the firmware file that comes with your scanner. Other firmware files (including the one linked from this page) may not work. Calibration is not available, area selection is limited - positioning does currently not work.
-- http://www.meier-geinitz.de/sane/gt68xx-backend/ [meier-geinitz.de]
(Score: 2) by butthurt on Thursday November 03 2016, @02:50PM
I forgot to say, SANE is available on FreeBSD. So if you feel like trying it, you needn't make any drastic changes.