Best printers for Home

Best Mixer Grinder

Best wired Earphones

Best 43 Inch TV in India

Best Wi Fi Routers

Best Home Theatre in India

Smart Watch under 5000

Best Laptops for Education

Best Laptop for Students

<ul><li><keyword id="10387" type="General" weightage="100" keywordseo="microsoft" source="Orion">Microsoft</keyword> Confirms ‘<keyword id="14077881" type="General" weightage="80" keywordseo="follina" source="Orion">Follina</keyword>’ vulnerability in <keyword id="6369149" type="General" weightage="20" keywordseo="Microsoft-Office" source="Orion">Microsoft Office</keyword></li><li>Researchers suggest that the Follina <keyword id="13182919" type="General" weightage="20" keywordseo="zero-day-vulnerability" source="Orion">zero-day vulnerability</keyword> has also impacted Office 2013 version.</li><li>Instead of a security patch, Microsoft has released guidance to cope with Follina - read below.</li></ul>The independent research group named <a href="https://nao-sec.org/">nao_sec </a>has identified a new <a href="https://www.trendmicro.com/vinfo/us/security/definition/zero-day-vulnerability">zero-day vulnerability </a>in Microsoft Office that allows hackers to execute a code using an infected Word document. The security issue is known as Follina which hits the user system when they open malicious Word files. <br /><div type="twitter" handle="nao_sec" handlename="nao_sec" image="http://pbs.twimg.com/profile_images/930817201476534272/pFzs4Bqo_normal.jpg" favoritecount="1636" retweetcount="632" status="Interesting maldoc was submitted from Belarus. It uses Word's external link to load the HTML and then uses the &quot;ms-… https://t.co/YGtzXnBPjb" createdat="1653662332000" id="1530196847679401984"></div>The Tokyo based cybersecurity research organization revealed the Follina vulnerability on their Twitter handle. According to the tweet, the security lapse is allowing Microsoft Word file to execute code - Follina even if Macros is disabled as it is used to give commands for automated tasks. Meanwhile, hackers are using vulnerability for similar automation with Macros. <br /><br />On Monday, Microsoft Security Response Center responded on Office vulnerabilities and said, if a hacker exploits this vulnerability, they can install programs or applications and exploit, view or delete data. Further, they can also create new accounts using ‘user rights’ and personal information.<br /><br />Earlier, Microsoft Office versions 2013 and 2021 have been found vulnerable to attacks. In some cases even licensed versions of Microsoft 365 were also affected on Windows 10 and 11. <br /><br />Researcher and former Senior Threat Intelligence Analyst at Microsoft, <keyword id="3812614" type="General" weightage="20" keywordseo="kevin-beaumont" source="Orion">Kevin Beaumont</keyword> examine the tweet from nao_sec and <a href="https://doublepulsar.com/follina-a-microsoft-office-code-execution-vulnerability-1a47fce5629e">said</a>, “I’m surprised to see that, infected files are using Microsoft Support Diagnostics Tool to execute the code.”<br /><br /><strong>No security update or patch is available for Follina</strong><br />According to Microsoft, currently, no patch is available. Instead, the company’s security response centre team has released a set of <a href="https://msrc-blog.microsoft.com/2022/05/30/guidance-for-cve-2022-30190-microsoft-support-diagnostic-tool-vulnerability/">guidelines</a> to cope with Follina.<br /><br />Company says, the best way to cope with this vulnerability is to disable the Microsoft Support Diagnostics Tool (MSDT) URL protocol. <br /><br />Follow the given steps to disable MSDT-<br /><ul><li>Switch to Administrator and run Command Prompt.</li><li>Execute command ‘reg export HKEY_CLASSES_ROOT\ms-msdt filename’ to back up the registry key.</li></ul>If users are using Microsoft Defender Antivirus, they should turn on automatic sample submission and cloud-delivered protection. It will identify the unknown threats and stop them. <br /><br /><strong>SEE ALSO:<br /><a href="https://www.businessinsider.in/tech/apps/news/apples-new-patent-may-use-ultrasonic-haptic-technology-to-make-virtual-reality-more-realistic/articleshow/91955601.cms">Apple’s new patent may use ultrasonic haptic technology to make virtual reality more realistic</a><br /></strong><a href="https://www.businessinsider.in/tech/news/amazon-employees-storm-a-company-pride-month-celebration-protesting-the-sale-of-transphobic-content/articleshow/91950308.cms"><strong>Amazon employees storm a company Pride Month celebration, protesting the sale of transphobic content</strong></a><br />

Hackers have found a new way to take over your computer using Microsoft Office — here’s what you can do to stay safe

<ul class="summary-list"><li>Some Twitter users said its two-factor authentication system was temporarily down on Monday.</li><li>This left them locked out of their accounts, they said.</li></ul><p>Some Twitter users said that problems with the platform's two-factor authentication system mean they were temporarily locked out of their accounts on Monday amid new owner Elon Musk's huge changes to the platform.</p><p>Musk <a href="https://www.businessinsider.com/twitter-staff-slam-elon-musk-did-you-bother-to-learn-2022-11">tweeted</a> on Monday that he was "turning off the 'microservices' bloatware." He said that less than 20% of the company's microservices were needed for Twitter to work.</p><p>The Washington Post reporter Joseph Menn <a href="https://twitter.com/josephmenn/status/1592254549833973760">tweeted</a> that Twitter's two-factor authentication system seemed to have been affected by this. <a href="https://help.twitter.com/en/managing-your-account/two-factor-authentication">The system</a>, which users can opt in to, works by requiring people to authenticate their account using a second method alongside their password. This could be a code sent by SMS, a login confirmation via an app, or a physical security key.</p><p>One Twitter user <a href="https://twitter.com/FairywrenTech/status/1592191371590631424">posted</a> on Monday morning that they had not received an SMS after trying to log in to their account using two-factor authentication.</p><p>"Can't send the confirmation code right now. Please try again later," the message from Twitter read.</p><p>They <a href="https://twitter.com/FairywrenTech/status/1592271726158974976">tweeted</a> a few hours later that the two-factor authentication service still wasn't working, attaching a screenshot of a message from Twitter saying: "You have hit the limit for SMS codes. Try again in 24 hours."</p><p><a href="https://twitter.com/thanos_engine/status/1592195820715405312">Other Twitter users</a> said they also couldn't use the two-factor authentication service via SMS and <a href="https://twitter.com/Sonaveve/status/1592266477633437697">email</a>.</p><p>Cybersecurity expert Kevin Beaumont <a href="https://twitter.com/GossiTheDog/status/1592254653378736128">tweeted</a> later on Monday that the service was working again but had been down for around 90 minutes.</p><p>Since taking ownership of Twitter on October 27, Musk has pushed ahead with plans to roll out massive changes at the platform, such as <a href="https://www.businessinsider.com/twitter-rolls-out-elon-musks-blue-check-verification-2022-11">charging users for verification</a> and <a href="https://www.businessinsider.com/elon-musk-twitter-video-youtube-content-creators-higher-pay-ads-2022-11">luring content creators over from other sites</a>. He has also touted the possibility of <a href="https://www.businessinsider.com/elon-musk-twitter-content-moderation-tiers-advertisers-brands-social-media-2022-11">introducing tiers of content moderation</a>, <a href="https://www.businessinsider.com/elon-musk-tells-twitter-engineers-ready-vine-reboot-2022-10">reviving Vine</a>, and <a href="https://www.businessinsider.com/personal-finance/elon-musk-twitter-payments-high-yield-2022-11">offering a high-yield money market account</a>.</p><p>Musk has also <a href="https://www.businessinsider.com/elon-musk-twitter-deal-lay-staff-job-hunt-severance-package-2022-11">fired around half of the company's workforce</a>, <a href="https://www.businessinsider.com/elon-musk-twitter-slightly-softens-stance-on-remote-work-2022-11">told staff to return to the office</a> or face dismissal, and <a href="https://www.businessinsider.com/elon-musk-pulls-tesla-boring-company-neuralink-employees-twitter-report-2022-11">brought in more than 50 employees from Tesla</a>.</p><p>One social-media expert <a href="https://www.businessinsider.com/elon-musk-mayhem-twitter-master-plan-super-app-2022-11">previously told Insider</a> that while Musk's decisions since taking over Twitter may look chaotic, he clearly has a "master plan."</p>

Twitter users with 2-factor authentication said they were locked out of their accounts soon after Elon Musk said he was ridding the site of 'bloatware'

<p><div class="KonaFilter image-container display-table"><div><div class="image on-image"><p class="source"><span>Chip Somodevilla/Getty Images</span></p><p class="caption">Volunteers help rescue residents from their flooded homes in New Bern, North Carolina during Hurricane Florence.</p></div><p></p></div></div></p><ul class="summary-list"><li>When <a href="https://www.businessinsider.com/category/hurricane-florence">Hurricane Florence</a> hit, Nancy Shipley and Ian Beaumont rushed to North Carolina to help with rescue efforts and disaster recovery.</li><li> The husband and wife run an adventure travel company called <a href="https://www.instagram.com/whatsnextadventures/">What's Next Adventures</a>. But their skill set has proven useful in hurricane situations.</li><li>Shipley and Beaumont told Business Insider what it was like to volunteer in the aftermath of Hurricane Florence.</li></ul><p>Nancy Shipley and Ian Beaumont have developed a new passion over the last year: assisting with rescue and recovery efforts in disaster-stricken areas.</p><p>The couple, who originally hail from Florida, run an adventure-travel company called What's Next Adventures. But they've spent the last week helping people trapped in homes that flooded during <a href="https://www.businessinsider.com/category/hurricane-florence">Hurricane Florence</a>.</p><p>"Our backgrounds are like a little puzzle that fit really well with these disasters," Shipley told Business Insider.</p><p>Shipley is a certified EMT, holds a captain's license, and is certified in swift-water and high angle rescue. Beaumont also holds a captain's license and has a host of experience in wilderness first-aid and swift-water rescue scenarios.</p><p>The couple spends the majority of their time on the road living out of their truck - which they called "really cozy"- when not guiding clients on sailing and rock-climbing adventures.</p><p>Last week, when they saw Florence approaching North Carolina, they raced over in their truck to see how they could help. </p><h2>Pulling people out of flooded homes </h2><p>On Sunday evening, during the height of Hurricane Florence's flooding, Shipley and Beaumont had just rescued some stranded people from a road that was quickly flooding when a family pulled up next to them in a car.</p><p>"They asked me which road they could take to get out of town," Beaumont said.</p><p>He told the family that they'd probably get into serious trouble if they tried navigating flooded roads in their car.</p><p>"There was a moment of realization for the mother and father. The question was asked to me: 'If these were your children, what would you do?'" Beaumont said. "That's a really powerful question."</p><p>He replied: "Well I know one thing. You guys are going to survive in the shelter, and I don't know what will happen to you if you don't." </p><p>So Beaumont and Shipley helped the family get to a shelter safely in their truck, which was able to pass over the flooded roads. </p><h2><div class="KonaFilter image-container display-table"><div><div class="image on-image"><p class="source"><span>Courtesy of Nancy Shipley and Ian Beaumont</span></p><p class="caption">Shipley and Beaumont participate in a high-water rescue in Lumberton, North Carolina.</p></div><p></p></div></div></h2><h2>'When no one else is available, we'll move in to help'</h2><p>Every day is different when you're responding to a disaster, Shipley said.</p><p>The couple is living out of their truck in North Carolina right now and working with a group of volunteer rescuers. They've spent the past few days assisting with transporting trapped residents to a local hurricane shelter. </p><p>They monitor radio channels, social media, and 911 calls, while staying in touch with local authorities to see where they're most needed. Once they get a call, they'll race out to conduct a rescue with their local partners. Often, they use their truck to tow their inflatable boat - affectionately named Red Duck - into flooded neighborhoods.</p><p>"When no one else is available, we'll move in to help," Shipley said. </p><p><div class="KonaFilter image-container display-table"><div><div class="image on-image"><p class="source"><span>Courtesy of Nancy Shipley and Ian Beaumont</span></p><p class="caption">Shipley and Beaumont's truck and their inflatable boat, Red Duck. The truck serves as both a home and a mobile operating base.</p></div><p></p></div></div></p><p>On Friday, Shipley said, the couple headed to Richlands, North Carolina, a town hit by severe flooding. On the way, the couple came across a bridge that was being overrun with water.</p><p>"We were standing by trying to see if the water would recede," Shipley said. "And while we were there, a family was trying to come across. It was a mom, dad, two young daughters, an autistic son, and three dogs."</p><p>The family was trying to cross the bridge in a friend's boat, but the boat got stuck.</p><p>"So we're carrying people and pets across the water. The woman was asthmatic. As soon as we got her over, we had to help her medically," Shipley said. She gave the woman albuterol, an asthma drug.</p><p>"Once you get on the ground, you just find yourself in a situation and you have to go from there," Shipley said.</p><p><div class="KonaFilter image-container display-table"><div><div class="image on-image"><p class="source"><span>Courtesy of Nancy Shipley and Ian Beaumont</span></p><p class="caption">Shipley and Beaumont participate in a high-water rescue in Lumberton, North Carolina.</p></div><p></p></div></div></p><p>The following day, Beaumont and Shipley were sent to help rescue a man in Lumberton, a town hit hard by the floods. The man had initially chosen not to evacuate because he had pets. </p><p>When they arrived, Shipley said, two more families also needed to be rescued. So they had to quickly adapt the plan to get everyone to safety.</p><p>One of the most interesting things about rescuing people from their homes, Beaumont said, is learning what's valuable to them.</p><p>"One of the families that we picked up, they wanted to grab photo albums," he said.</p><p>Another person they helped didn't want to take anything with him. Beaumont noticed that the man had awards from military service in his home that looked "quite prestigious." But he left them behind.</p><h2>Helping in the Keys during Hurricane Irma</h2><p><div class="KonaFilter image-container display-table"><div><div class="image on-image"><p class="source"><span>Courtesy of Nancy Shipley and Ian Beaumont</span></p><p class="caption">Shipley and Beaumont assist with the recovery after Hurricane Irma in the Florida Keys last year.</p></div><p></p></div></div></p><p><span>Beaumont and Shipley started helping with hurricane rescue work last year during Hurricane Irma.</span></p><p><span>"We ended up staying in the Florida Keys for nine weeks," Beaumont said. "We were really able to help people put their lives back together."</span></p><p><span>For the couple, assisting with that recovery effort meant loading up an 85-foot sailboat with construction materials and helping local residents in the Keys and the Bahamas clear roadways, patch roofs, and clean up their communities after the storm.</span></p><p>"It's not about big, life-saving operations," Shipley said, though the couple has participated in some hair-raising rescues. Often, their work simply involves gathering people with rakes and shovels and helping clear yards after the water recedes.</p><p><div class="KonaFilter image-container display-table"><div><div class="image on-image"><p class="source"><span>Courtesy of Nancy Shipley and Ian Beaumont</span></p><p class="caption">Shipley and Beaumont sleep in their truck, which they say is actually quite comfortable.</p></div><p></p></div></div></p><p>"We just roll with the punches," Beaumont said. "That's what we do every day, all the time."</p><p>As for what's next, Shipley said the couple plans to stay in North Carolina as long as they're needed.</p><p>"We never really have a plan," she said. The couple has also heard about bad flooding in Virginia - so if they're able to help, they'll just pack up and go overnight.</p><p>"<span style="font-weight: 400;">We live on the road, we're very comfortable just moving," Shipley said. </span></p><p><em>Kevin Reilly contributed reporting. </em></p>    <div class="margin-top">        <h3>NOW WATCH: <a href="https://www.businessinsider.com/dome-homes-stable-during-earthquakes-hurricanes-2017-2">These houses can survive natural disasters</a></h3>        <div>                    </div>    </div>

This couple spends their free time rescuing people in the aftermath of hurricanes - here's what it's been like for them in North Carolina

<p></p><div class="KonaFilter image-container display-table"><div><div class="image on-image"></div><p></p></div></div><ul><li><strong>The Millennium Falcon used for the "Star Wars" movies is on Google Maps.</strong></li><li><strong>The iconic spaceship, which we believe was used&#xa0;in filming "The Last Jedi," is surrounded by shipping containers, seemingly in an attempt to hide it.&#xa0;</strong></li><li><strong>It's hilarious, especially because Disney has been very secretive about the films.&#xa0;</strong></li></ul><p><br>Disney has managed to keep details on all the new "Star Wars" movies really tight. But&#xa0;its&#xa0;strategy has been breached by Google Maps.</br></p><p>On Google Maps, you can look at the street view of addresses all across the world via satellite images. Satellite updates are typically between one and three years old.</p><p>Kevin Beaumont looked at&#xa0;<a href="https://www.google.co.uk/maps/place/Longcross+Studios/@51.3837961,-0.5819077,168m/data=!3m1!1e3!4m5!3m4!1s0x487678495aefe75b:0x21d6d7c791c6a1b7!8m2!3d51.3832643!4d-0.5938267">Longcross Studios on Google Maps</a>, and found something interesting: the Millennium Falcon is on site, or at least near a golf course close to the studio. And it's surrounded by shipping containers, seemingly in an attempt to hide it.&#xa0;But&#xa0;Disney&#xa0;couldn't hide from Google.&#xa0;</p><p>Longcross Studios is a film and television production facility about 25 miles west of central London. Many huge films have&#xa0;been shot&#xa0;there including "Thor: The Dark World," "Skyfall," and "Guardians of the Galaxy."</p><p>This&#xa0;Millennium Falcon was likely hidden by shipping containers during filming of "The Last Jedi," which was shot at Longcross Studios. "The Force Awakens" was filmed at&#xa0;Pinewood Studios in Buckinghamshire,&#xa0;UK.&#xa0;</p><p>You can catch the&#xa0;Millennium Falcon (not surrounded by shipping containers) when "The Last Jedi" hits theaters December 15.&#xa0;</p><div></div>    <div class="margin-top">        <h3>NOW WATCH: <a href="http://www.businessinsider.com/what-melissa-joan-hart-is-doing-today-clarissa-sabrina-teenage-witch-joey-explains-it-all-interview-2017-10">Here's what Melissa Joan Hart - who played Clarissa and Sabrina the Teenage Witch - is doing today</a></h3>        <div>                    </div>    </div></hr>

 Disney tried to hide the Millennium Falcon with shipping containers - but it's on Google Maps 

<p><div class="KonaFilter image-container display-table"><div><div class="image on-image"><p class="source"><span><a href="https://www.facebook.com/Idezu10">Facebook</a></span></p><p class="caption">Izzy Dezu.</p></div><p></p></div></div></p><ul><li><strong>A talented young footballer collapsed and died during an academy game in Dublin earlier this week.</strong></li><li><strong>Izzy Dezu, a Sherbourne FC striker, fell ill during a match against St Kevin's Boys on Tuesday.</strong></li><li><strong>He was treated on the pitch, rushed to hospital, but was pronounced dead.</strong></li><li><strong>The Republic of Ireland national team will pay tribute to Dezu during its next home game at the Aviva Stadium.</strong></li></ul><p> </p><p>A promising 16-year-old footballer fell ill during a league game in Dublin and died by the time he reached a hospital.</p><p>Sherbourne FC's Izzy Dezu collapsed during a District Schoolboys League match against St Kevin's Boys on Tuesday evening.</p><p>He was treated on the Athletic Union League Complex pitch by paramedics from the Dublin Fire Brigade then was rushed to Beaumont Hospital which was just five kilometres away, but was pronounced dead upon arrival by doctors.</p><p>Dezu was "widely regarded as one of the most promising players at this age level in the country," according to The Football Association of Ireland (FAI) chief executive John Delaney, <a href="http://www.bbc.co.uk/news/world-europe-42340222" target="_blank" rel="noopener">as per a statement via the BBC</a>.</p><p>Kevin O'Reilly, who was Dezu's strike partner at Sherbourne FC, told <a href="https://www.irishtimes.com/sport/soccer/national-league/tributes-to-selfless-izzy-dezu-16-who-died-during-football-match-1.3325722" target="_blank" rel="noopener">The Irish Times</a> that Dezu "was the nicest person" he ever met, that he was always playing music, and messed around in the dressing room after training.</p><p>The FAI will pay tribute to Dezu during the Republic of Ireland's next home game at the Aviva Stadium.</p>    <div class="margin-top">        <h3>NOW WATCH: <a href="http://www.businessinsider.com/how-rafael-nadal-makes-spends-millions-money-world-number-one-french-open-2017-11">Here's how tennis great and world No. 1 Rafael Nadal makes and spends his millions</a></h3>        <div>                    </div>    </div>

One of 'the most promising young footballers in Ireland' died during a league game at the age of 16

<p>Republican presidential candidate Donald J. Trump has a worryingly insecure internet setup.</p><p>Websites representing Trump's organization - his hotels, golf courses, realty business, and more - are all running internet server technology that's riddled with holes, <a href="http://motherboard.vice.com/read/trump-is-running-some-really-insecure-email-servers">according to a security architect speaking with Vice's Motherboard</a>.</p><p>The news might not be such a big deal in another election, but <a href="http://www.businessinsider.com/trump-clinton-cyber-vulnerability-2016-9">Trump has repeatedly leaned into his opponent</a>, Democratic presidential nominee Hillary Clinton, for her use of an insecure private email server while serving as Secretary of State.</p><p>"Running outdated software and operating systems for your publicly facing email infrastructure is problematic, especially when you're a high profile organization," security architect Kevin Beaumont told Motherboard. Beaumont is the man who discovered the holes in the Trump organization's internet security.&#xa0;</p><p>He first tweeted about the holes on October 17:<div></div></p><p>"During an election where cybersecurity is such a big issue, I was a little amazed at what I saw," he said.&#xa0;</p><p>More problematically, the internet security holes in Trump's organization also affect email servers; in several instances, email servers of Trump's are running software that has reached "end-of-life" status - the company that originally made said software (Microsoft in this case) will no longer issue security patches and updates. And that leaves it vulnerable to attack.</p><p>Due to the age of the software and the setup of the system, the Trump organization isn't using industry-standard safety measures like two-factor authorization, which enables users to confirm authenticity through their mobile phone (or another third-party factor).</p>    <div class="margin-top">        <h3>NOW WATCH: <a href="http://www.businessinsider.com/why-you-should-cover-your-laptop-camera-for-security-2016-10">A security expert explains why you should put tape over your laptop camera</a></h3>        <div>            <div>        <div class="ooyala-video-player" data-video-autoplay="false" data-video-id="t1am1mNDE6iBoFJh7a3nVlZgbkMc_kCv" data-player-variable="ooyalapopvideo" id="ooyalaplayer_popvideo" style="width:1280px;height:720px"></div>        </div>        </div>            </div>

Donald Trump's email servers are not secure

<p></p><div class="KonaFilter image-container display-table float_right"><div><div class="image on-image"></div><p></p></div></div>Real-estate mogul Donald Trump argued on Saturday that <a href="http://www.businessinsider.com/displays-solidarity-paris-attacks-newspaper-front-pages-2015-11">the terrorist attack in Paris</a>&#xa0;the previous night would have been "much, much different" if people&#xa0;there had been armed.<p>"When you look at Paris - the toughest gun laws in the world, Paris - nobody had guns but the bad guys. Nobody. Nobody had guns," Trump said at&#xa0;a presidential campaign rally in Beaumont, Texas.</p><p>"They were just shooting them one by one," the Republican presidential front-runner lamented.</p><p>Most of Friday night's violence occurred at&#xa0;<span>Paris' Bataclan concert&#xa0;venue, where attackers opened fire and then took hostages. Authorities said 112 people were killed there.</span></p><p>Trump did not say what exactly would have been different if Parisians had gun rights, or that the 129 people who authorities have said died in the series of attacks would have been saved. However, he suggested that right-t0-carry laws would have helped stopped the attackers, who <a href="http://www.businessinsider.com/displays-solidarity-paris-attacks-newspaper-front-pages-2015-11">were armed with machine guns and explosives</a>.</p><p>"I'll tell you what. You can say what you want, but if they had guns -&#xa0;if our people had guns, if they were allowed to carry -&#xa0;it would've been a much, much different situation," he said to cheers.</p><p>Trump then noted that much of the gun&#xa0;violence in the US occurs in cities that have strict gun laws.</p><p>"I hear it all the time," he said. "You look at certain cities that have the highest violence, the highest problem with guns and shootings and killings. Chicago as an example, toughest gun laws in the United States. Nothing but problems. So our country better get smart, because we're not smart right now."</p><p>He also said the Paris attacks clarified how "insane" it would be for the US to take in a large number of Syrian refugees fleeing the violence there.</p><h3>Watch below:</h3><p><div></div></p>

Donald Trump on Paris massacre: 'Nobody had guns but the bad guys'

<p></p><div class="KonaFilter image-container display-table"><div><div class="image on-image"></div><p></p></div></div><ul><li><strong>Researchers from CTS Labs found serious and potentially dangerous flaws in computer chips manufactured by AMD.</strong></li><li><strong>But exactly how CTS disclosed the vulnerabilities has raised concerns among security researchers: It allegedly didn't give AMD enough time to respond and get fixes ready before going public.</strong></li><li><strong>Some skeptics believe that CTS might have a financial interest in seeing AMD flounder in response.</strong></li><li><strong>The flaws are unlikely to affect individual users, and will be most concerning to big businesses using AMD chips.</strong></li><li><strong>CTS has also been criticized for failing to provide key technical details of the vulnerabilities.</strong></li></ul><p>On Tuesday, an Israeli-based security firm named CTS Labs <a href="http://www.amdflaws.com">revealed a series of "critical" vulnerabilities</a> affecting computer processors made by $11 billion chipmaker AMD - serious flaws that, in the wrong hands, could allow hackers access to otherwise-secure systems.&#xa0;</p><p>While the dangers posed by these vulnerabilities may well be real, the whole episode is raising eyebrows among the security community. First, CTS didn't follow security industry protocol in revealing these flaws to the world. That, coupled with the fact that CTS didn't disclose certain key technical details, has some experts scratching their heads.</p><p>And AMD doesn't appear to be happy about it, either.&#xa0;In an <a href="http://ir.amd.com/news-releases/news-release-details/view-our-corner-street-0">official blog entry</a>, AMD said that it is investigating the claims made by CTS, but expressed disapproval for the way the vulnerabilities were disclosed.&#xa0;</p><p>"<span>This company was previously unknown to AMD and we find it unusual for a security firm to publish its research to the press without providing a reasonable amount of time for the company to investigate and address its findings," the post reads.</span></p><p><span>Despite the uncertainty, though, the vulnerabilities appear to be real. Still, unless you're in the IT department of a Fortune 500 company, you probably shouldn't worry too much about the CTS report.</span></p><p><span>"This is not something the general public should lose sleep over. <keyword id="6356323" type="ENTERTAINMENT" weightage="100" keywordseo="Enterprise">Enterprise</keyword> customers will have to deal with this more as their threat models and workloads are significantly different and these vulnerabilities would expose them to more risk," Jake Williams, <a href="https://www.renditioninfosec.com/">founder of security firm RenditionSec</a>, told Business Insider.&#xa0;</span><span></span></p><p><span>AMD had no official comment beyond the blog entry. CTS did not immediately respond to a request for comment.</span></p><h2>CTS appears to have flouted normal protocol</h2><p>CTS unveiled the flaws on a slick website, amdflaws.com, which comes complete with showy graphics and a 20-page whitepaper explaining the vulnerabilities in high-level terms. They even gave the vulnerabilities flashy names: "Ryzenfall," "Fallout," "Masterkey," and "Chimera" - echoing <a href="http://www.businessinsider.com/intel-chip-bug-meltdown-and-spectre-explained-2018-1">Google's high-profile disclosures of the "Spectre" and "Meltdown" security vulnerabilities earlier this year</a>.</p><p>The CTS-made website also includes a video of both the CEO and the CFO of CTS-Labs talking about the vulnerabilities in front of what appears to be a greenscreen.&#xa0;</p><p>But it's exactly the level of sophistication in the announcement that has security researchers <a href="https://doublepulsar.com/on-amd-flaws-from-cts-labs-f167ea00e4e8">suspicious:</a>&#xa0;The way that&#xa0; CTS handled the disclosure, and the website itself, are "highly unusual" in the security industry, says RenditionSec's Williams.</p><p>On the amdflaws.com website, CTS says that it<span>&#xa0;"has shared this information with AMD, Microsoft, and a small number of companies that could produce patches and mitigations."&#xa0;</span></p><p><span><div class="KonaFilter image-container display-table"><div><div class="image on-image"></div><p></p></div></div></span></p><p>Yet, CTS only informed AMD about the flaws 24 hours before the site went live, according to a person familiar with the situation - a timeframe that flouts industry protocol. Microsoft did not immediately respond to a request for comment.</p><p>Normally, researchers are supposed to inform companies between 60 and 90 days in advance of public disclosure.&#xa0;For example: Intel, AMD, and other chip manufacturers <a href="https://www.theverge.com/2018/1/11/16878670/meltdown-spectre-disclosure-embargo-google-microsoft-linux">had about a seven month lead time</a> before "Spectre" and "Meltdown" became public. That time was used to develop and deploy at least partial fixes. That was an extreme case, given the massive impact of those vulnerabilities.</p><p>Meanwhile, according to publicly-searachable <a href="https://whois.icann.org/en/Lookup?name=amdflaws.com">domain records</a>, amdflaws.com was registered on February 22 - weeks before CTS first appraised AMD of the situation. Williams believes that such a short span didn't give AMD any time to respond, let alone start on the difficult task of solving the problem.&#xa0;</p><p>"There's no point in reaching out 24 hours in advance, unless you want to check that box that you've reached out in advance," Williams said.&#xa0;</p><p>Additionally, the CTS website contains a disclaimer, saying that it may have&#xa0;<span>"an economic interest in the performance of the securities of the companies." This gives skeptics reason to believe that CTS is using these flaws to bet against AMD's stock, Williams said.</span></p><p><span> "Most security researchers aren't financially involved in the companies they're researching," Williams said.</span></p><p><span>CTS told <a href="https://www.cnet.com/news/amd-has-a-spectre-meltdown-like-security-flaw-of-its-own/">CNET</a> that it doesn't have "any investment (long or short) in Intel or AMD."</span></p><h2><span>The problems seem to be real, but details are missing</span></h2><p>In a technical sense, the vulnerabilities discovered by CTS have to do with AMD's Secure Processor. The Secure Processor is, essentially, a second processor that comes embedded in certain AMD chips. It's designed to handle sensitive computing tasks.</p><p></p><div class="KonaFilter image-container display-table"><div><div class="image on-image"></div><p></p></div></div><p>These vulnerabilities would provide a way for an attacker to get into the AMD Secure Processor and allow them to both access sensitive data, and potentially install malware that would go undetected by any conventional means. It's not known if a hacker has taken advantage of these vulnerabilities for an attack in the real world.&#xa0;</p><p>According to the CTS whitepaper, malicious actors could permanently install malicious code and "expose AMD customers to industrial espionage that is virtually undetectable by most security solutions." It also says that it's not aware of a fix - and that fixing "Chimera" might require AMD to redesign its processor hardware.</p><p><span>Still, despite the unusual nature of how the CTS revealed the vulnerabilities, many seem to believe the company's conclusions. On Twitter,&#xa0;Dan Guido, the <a href="https://doublepulsar.com/on-amd-flaws-from-cts-labs-f167ea00e4e8">CEO of security research firm Trail of Bits</a>, claimed that his team had been contracted by CTS to review the findings before release - and verified that the issues are real.</span></p><p><span>"Regardless of the hype around the release, the bugs are real, accurately described in their technical report (which is not public afaik), and their exploit code works," wrote Guido in a tweet.&#xa0;</span><span>Guido did not respond to Business Insider's request for comment.</span></p><p>&#xa0;</p><p><span>Still, other researchers are skeptical of the stated danger of the security flaws because only very limited technical details were released. This was by design, says CTS-Labs.&#xa0;</span></p><p><span>"All technical details that could be used to reproduce the vulnerabilities have been redacted from this publication," writes amdflaws.com in its FAQ section. Experts don't seem impressed by this logic.&#xa0;</span></p><p><span>"The website makes extreme claims about the vulnerabilities - the FAQ section is worse than Buffy fanfic. No mitigation advice was provided to organisations," security researcher Kevin Beaumont <a href="https://doublepulsar.com/on-amd-flaws-from-cts-labs-f167ea00e4e8">wrote in a post on Medium</a>.</span><span></span></p><p>But, to Williams' earlier point: even if the CTS revelations pan out, the attacks in question are generally hard to pull off. So generally speaking, it's not worth worrying too much about - especially since fixes are on the way.</p><p>CTS did not respond to a request for comment at the time of publication.</p><p class="tagline">Get the latest Intel stock price<a href="http://markets.businessinsider.com/stock/intc-Quote"> here.</a></p><div></div>    <div class="margin-top">        <h3>NOW WATCH: <a href="http://www.businessinsider.com/what-the-blockchain-hype-is-really-about-cryptocurrencies-tech-2018-2">Put simply, blockchain technology is 'a security and transparency innovation'</a></h3>        <div>                    </div>    </div></hr>

You Searched For "kevin beaumont" and got 8 results

Hackers have found a new way to take over your computer using Microsoft Office — here’s what you can do to stay safe

Rahul Verma

Twitter users with 2-factor authentication said they were locked out of their accounts soon after Elon Musk said he was ridding the site of 'bloatware'

Grace Dean

This couple spends their free time rescuing people in the aftermath of hurricanes - here's what it's been like for them in North Carolina

Jeremy Berke

Disney tried to hide the Millennium Falcon with shipping containers - but it's on Google Maps

Carrie Wittmer

One of 'the most promising young footballers in Ireland' died during a league game at the age of 16

Alan Dawson

Donald Trump's email servers are not secure

Ben Gilbert

Donald Trump on Paris massacre: 'Nobody had guns but the bad guys'

Colin Campbell

A security company unveiled 'critical' security vulnerabilities in AMD processors - but the way they did it has experts worried

Rachel Sandler

Popular Keywords

Buying Guides