Vulnerable to Security Risks? Monitor and Patch Your Devices Now!

NetStandard’s Security Minute Series

This week was Patch Tuesday! Microsoft released patches for 58 different bugs (the smallest number in a year!), but called out 4 as being especially noteworthy – an actively-exploited zero-day, two remote code executions, and a denial of service bug. As always, make sure you’re being patched!
Microsoft is warning about an increase in OAuth-based phishing attacks against 365. In an OAuth attack, the phishing email tricks you into clicking on a link, which opens a page asking you to give permission to your 365 tenant. If you click Accept, then the attacker has full access to everything. If something is asking for permission to access your data, stay skeptical – and if in doubt, ask! 
Want to learn about something in Active Directory that very very few people truly understand? This one’s even more obscure than ESE! Meet “managed service accounts.”
This week we learned…

• April 13, 2021 monthly update from Microsoft will remove “Microsoft Edge Legacy,” the non-Chromium version of Edge. If you’re using the old version of Edge, first of all why, but know that it will be removed from your computer soon.
• In Florida, an attacker accessed a city water treatment plant (which was using TeamViewer), and tried to poison the town by increasing the amount of sodium hydroxide in the water by a factor of more than 100. Fortunately it was caught before any damage could be done, but it’s a step closer to the nightmare scenario of attacks against local utilities.
  • Recommendations Following the Oldsmar Water Treatment Facility Cyber Attack | Dragos