Six Zero Days From Microsoft, One From Apple, and a CSI: Cyber Throwback

Doing this with two of my good friends, Wade Baker and Rich Mogul, and we are doing Star Wars. That's right, Hacker Movie podcast about Star Wars. Those two guys, Rich and Wade, both huge Star Wars fans. I'm a Star Wars, appreciate her. I like Star Wars. I'm not an obsessive like some folks in the security community are. I've seen all the movies. You know, I'm of the generation where the the original trilogy was our kind of thing. You know, I saw those things in the theater, so should be a fun one.

We had a few requests from people that were like, why don't you guys do Star Wars? It's like the original Hacker movie. And I thought about it a little bit. I was like, yeah, you know what kind of is? Let's do it. So watch out for that one. I'll obviously let everybody know on social media when that goes up, but it should be a really fun one. Rich and Wade know a whole lot about the whole Star Wars universe, so you might actually learn something as well as being entertained. So all right, let's dive into the news this week. It was one of those weeks where, you know, it was Microsoft Patch Tuesday, and also Apple released some pretty important security updates. Start with the Microsoft updates. You know, as usual, dozens and dozens of patches from Microsoft across all of their product lines. Windows, Windows Server, Office, you know, you know the drill. But this was kind of an unusual one because Microsoft patched 6 vulnerabilities that had been actively exploited. 6 is a lot you guys like usually if there's

one or two in the Microsoft monthly updates, it gets some attention. 6 is a whole lot. I can't recall that many in recent memory. I'm I'm sure there have been six in a month, but 6 is a ton. The total number of CVS patched this month was 60, so 10% or you know, a little more than 60 CVS. So almost 10% of the vulnerabilities have been actively exploited in the wild. It's quite a lot.

We have all the details in the story that's up on the site right now. You can go and look at that. If you haven't looked through the the Microsoft updates and advisories, you should do that for sure. If you're a window shop, which I think everybody is, you don't really have a lot of choice, but go have a look at those. There are, you know, varying degrees of seriousness of the vulnerabilities, but the fact that these six have all been exploited tells you something. At least one of them, I think maybe two were identified in conjunction with Google's threat intelligence group, which tells you something.

A couple of them are elevation of privilege. A couple of them are, you know, more serious than that. So go have a look at those. The one that kind of stood out to me was CBE 202621533, which is in the Windows Remote Desktop Services feature. It's kind of an issue with the privilege management and it was discovered by crowd strike researchers, which also tells you something.

Those are the ones you want to pay attention to. It does require authorization, but obviously there are ways to go about gaining that authorization on a Windows system. So the fact that crowd strike researchers reported this tells you that it may have been, you know, seen in in IR engagement or another incident that they're aware of. So that's something you should definitely pay attention to. I encourage you to go read our story as well as the the Microsoft advisories themselves.

They, you know, the Microsoft bulletins over time have giving you less and less information about what's actually going on. You will get the indication that something has been exploited and that Microsoft is aware of the exploitation, but you don't really get any more context in that. You essentially have to go and look at third party resources to go and find that out. Find out what the context is, how it's been used, how often it's been used, in what ways, against what kind of targets. You know, in some cases, I'd say in a lot of cases, the exploitation that's detected in these in these cases is usually targeted.

You, you will often see them say, you know, very limited cases or highly targeted or some kind of language like that, that gives you an indication that these were used in possibly just one or maybe just a handful of targeted attacks against specific victims. So, you know, that's not nothing, but it does give you some indication that, OK, this is not mass exploitation. It's not being used by, you know, every cybercrime group on Earth.

It's not, you know, thrown into some exploit kit yet. So you may have a little time there. But you know, in any case, you want to pay attention to any exploited vulnerabilities in the wild from Microsoft. So along those same lines, Apple released all their semi regular security updates this week as well. They patched dozens of vulnerabilities in Mac OS, iOS, Watch OS, the iPad OS, all the various OSS.

And the one vulnerability that sticks out there is one that has been exploited in the wild. Also in what you know, Apple describes as an extremely sophisticated attack in scare quotes there against specific targeted individuals, plural, on versions of iOS before 26. OK, so the new version that just came out is 26.3, you know, a a point release, but a pretty major one in terms of security content.

This specific vulnerability has been in iOS for a very long time. So it's in many, many versions of iOS. Most people I think are, you know, you would not unless you have like an old phone that you're using for some specific task or whatever, an old iPad that you're keeping alive for whatever reason. Most people are on relatively modern versions of iOS. You're not worried about how long it's been there, but the point is that this has been used in targeted attacks. It sounds like you know a relatively small number of them, but when Apple discloses these, this kind of exploitation, a lot, I would say I don't know. Probably most of the time these bugs are ones that have been seen by threat intelligence groups used in targeted attacks by the commercial spy Ware vendors. So think about the the vendors that sell, you know, something like, you know, the commercial

spy Ware that's used against activists, journalists, dissidents, all those types of groups that are typically at risk from commercial spy Ware vendors and their customers. A lot of times these especially iOS bugs that you see termed extremely sophisticated, used in extremely sophisticated attacks. That's where they're identified. Those are the highly complex.

And yeah, I mean, the word sophisticated is beaten into the ground in this industry. But in some cases, it's apartment, these kind of exploit chains that take, you know, a lot of time, a lot of development resources, resources and a ton of money to develop. Those are the ones that end up as zero days in these commercial spyware products that are used to target, you know, the groups I mentioned, journalist dissidents at risk groups around the world.

So if you want more information on how that whole ecosystem works, you should go look at the work that the Citizen Lab does up in Canada. They are the preeminent research group that is tracking the way that the commercial spyware ecosystem works and the kind of vulnerabilities that they're they're developing and putting into their products. It's a really, we've talked about it before on this podcast. It's a really concerning and kind of gross ecosystem, even on the surface. The farther you dig into it, the the worse you will feel about the world.

So I don't know if you want to do that on a, you know, on a bleak winter day, but those are the kinds of bugs, this these kind of Apple iOS bugs and sometimes Android bugs that are extremely valuable to those types of groups. And in this case, this bug was reported to Apple by Google's threat analysis group. That group is the team at Google that specifically tracks advanced threat actors, and that word advanced is doing a lot of work there.

But what they're trying to do is keep an eye on the top level threat actors out there. You can think about APT teams, state backed groups, state aligned groups, and the people that are using commercial spyware products. So that gives you another indication, some more context around where this this bug came from. So that's that's another one you want to dig into.

If your organization, you know, deploys iOS devices, Mac OS devices, that bug was also in Mac OS, but it has not been exploited against Mac OS as far as Apple, you know, has has said it's only been exploited against iOS. So that gives you a little more context, but it's this definitely seems like like one of those point updates that you want to you want to install as soon as possible, especially on iOS devices. So let's pivot a little bit to something, you know, a little different.

If you listen to this podcast regularly, you know that we, me specifically love movies and TV shows, especially ones that have something to do with the hacker scene. Depending on your age, you might be aware of a show called CSI Cyber. That was around about 10 years ago. And I bring this up because one of the actors in that that show, James Van Der Beek, passed away this week, you know, very sad in a battle with cancer.

And I was, he was, you know, obviously well known for Dawson's Creek. I didn't, I never watched that show. But you know, he's been in a bunch of movies. Varsity Blues, probably the most famous one, but he was in the show CSI Cyber, which was a a spin off from the normal CSI mothership. And when the show came out, I was at threat post with a bunch of my friends and we decided to watch the first episode of the show, which I think came out in 2015.

And we did like this running diary. It was four of us that basically we kept a chat log of how how this show went and how silly it was. I'll try and find it and post it. It's it's pretty entertaining. I have to say. The show came on at 10:00 on like a Thursday night. So we, it was just four of us like up late watching this goofiness and, you know, talking about it. But the real reason I bring this up is because there's two, there's an episode of season 2 called Gone in Six Seconds that aired in November of 2015. And two of my friends, Charlie Miller and Chris Valasek, who are, you know, very well known security researchers, obviously most well known for their research against against on cars, you know, automotive security systems. They've both done tons and tons of other stuff in their careers. Go look at Charlie's Apple security research. He was a pioneer in that in that world. Chris has done all kinds of

crazy stuff too. But they had a cameo on this episode called Gone in Six Seconds that, you know, had a car hacking storyline. And it was kind of a big deal in the security community when this happened. Like Charlie and Chris were posting, you know, photos from the the set with some of the actors. I don't remember one with Van der Beek specifically. I do remember one with Shad Moss or one of the other actors.

I'll try and find that as well. But it's a pretty entertaining. They they have a very small cameo, but if you know those guys, you can see them in the background. You can kind of see the sardonic smiles on their faces. It's I don't know where you'd be able to find it at this point. I think it might be on Amazon, but you might have to pay to go watch this. It would probably be worth it. You might be able to find a just that clip on YouTube somewhere. But CSI cyber is an artifact from a time when the movie and TV industry was sort of, you know, obviously there's been like hacker movies like hackers and sneakers and whatever.

But this was a time when they were trying to sort of weave cybersecurity and hacking into other shows in this very odd and often like completely ridiculous way. Especially. I mean, I don't know that I ever watched more than two. I watched the first episode of the show and I watched the one that Charlie and Chris Chris were on just because I know those guys and it was funny. I don't think I ever watched any more episodes of it. It was only on for two seasons, but it was pretty funny in the premiere. I think they it centers on somebody hacking a baby monitor, which is a thing that happened.

Like there's been research on those. It's kind of silly at this point, but that's what the premier centered on or at least part of it. So it's pretty entertaining. If you are looking for something completely ridiculous and fun to watch at some point, dig into some CSI Cyber. You don't really need to know any of the storylines or anything, but if you can find that episode, it's gone in six seconds. It aired on November 8th, 2015 and you will have a good time.

I promise you, you'll you'll get a few laughs out of it. So that was just the random pop culture corner for this week. So hope that brought you a little little fun. So thanks everybody for listening and I'll talk to you again next week and keep an eye out for the Tar Wars hacker episode. That'll be U soon. Take care.