We’ve all heard about it, and perhaps even experienced it — the resistance and potential issues with keeping our operating systems updated. Whether it’s a home user or businesses, each may have their own reasons for not updating their operating systems. And no one can force them. However, with Windows 7 losing support in early 2020, those users will be left with unpatched systems. To some, it may not be a big deal. Running a dated version of Windows isn’t perceived as a threat, until it is…
Ransomware Targets Unpatched Windows Machines
Regardless of the version of the operating system installed on the PC or server, users must ensure it is up to date. Why? Because if it isn’t, there are unpatched security holes that are leaving a door wide open for cyber criminals.
Am I being dramatic? No.
Recently, a security gap was found in Intel’s Processor Diagnostic Tool. The impacted versions include version 4.1.2.24 and below. For those who have installed this tool, it is imperative they complete an update immediately. Intel has identified this security hole’s severity as high due to the risk of improper access control. To access the patch, click here.
In addition to the Intel vulnerability, a new ransomware variant, called Sodin (also known as Sodinokibi or REvil), is exploiting another Windows vulnerability to gain access to unpatched Windows servers and PCs. Once hackers gain access using this security hole, they begin the installation of a malicious file, radm.exe. By using this security hole, hackers no longer need to rely on users to click on a link or attachment to download the malware. They’ve successfully eliminated the middle-man.
So how can one prevent falling victim?
There are two ways.
First, and likely the most obvious approach would be to ensure the operating systems are updated on all devices.
Second, would be the deployment of application whitelisting. Whitelisting only permits known trusted programs to run. Therefore, regardless of the type of malware the hacker attempts to install on the device, it will not install as it is not a good file.
Best practice would be both, as one should not replace the other.
