Exploit acquisition platform Zerodium has increased its payout for zero-click RCEs in Microsoft Outlook from $250,000 to $400,000.

Zero-click exploits let attackers compromise PCs and networks without requiring user interaction. One company that buys such exploits, Zerodium, outlines the change on its limited-time bug bounties page.

Set off the exploit

Some cyberattacks, such as phishing emails or instant messages, require people to interact with an attack in order to set off the exploit. Zero-click exploits do not require interaction, making them even more dangerous.

“We are temporarily increasing our payout for Microsoft Outlook RCEs from $250,000 to $400,000,” indicated Zerodium. “We are looking for zero-click exploits leading to remote code execution when receiving/downloading emails in Outlook, without requiring any user interaction such as reading the malicious email message or opening an attachment. Exploits relying on opening/reading an email may be acquired for a lower reward.”

Zerodium is a security company specializing in acquiring and reselling zero-day exploits and vulnerabilities. Its primary customers are government agencies in North America and Europe.

Increased payout

Microsoft increased the payout for Outlook zero-click RCEs on January 27, 2022. They will continue until a date undisclosed.

Microsoft offers bounties from $5,000 to $250,000 for reports of vulnerabilities in its software. The company paid $13.6 million for bug bounty rewards between July 2020 and July 2021.

Microsoft’s bug bounty payout is less than that of Zerodium; the bounty values vary based on the severity of the discovered vulnerability.

What is your take on Microsoft’s way around the bugs? Share your thoughts with us in the comment section below.

Microsoft’s intention is to bring all Windows 10/11 systems up to date with the latest updates. To achieve this, it has to make sure that the new features introduced with each update are compatible with all existing software and devices.

Microsoft has updated its support document for Windows 11 to explain why PCs with the latest versions of the operating system may not automatically receive future security updates. 

The explanation comes as many users are complaining about older PCs running Windows 10 being unable to install some updates in recent weeks. Microsoft has made it clear that it is the responsibility of PC makers and users themselves to install new versions of the operating system and keep them up to date.

WIndows updates are necessary

Windows Update doesn’t always install every available update for your PC. It often only installs updates for critical and security issues, and sometimes it skips optional updates.

Microsoft uses Update Connectivity to measure how Windows devices are being updated. The measurement only includes devices that have automatic updating enabled, and excludes devices that are turned off, in standby mode, or otherwise not being used.

Not every PC meets system requirements

Reports from Microsoft’s data analysts show that many Windows users are not keeping their devices current with respect to both quality and security updates. In fact, one out of two devices are not receiving the most important security updates for the device which leaves them vulnerable to malicious attacks.

Another 25% do not bother to keep up with the updates because they do not meet the system requirements are more than two months behind in the updates.

Microsoft does not recommend “forcing updates on devices.” Instead, the company recommends that organizations try to ensure that devices meet the minimum Update Connectivity measurement “by communicating with device owners”; this may include suggesting to owners to leave devices plugged in and connected instead of “powering them off overnight”. They also suggest that IT administrators should communicate with users about updates through their “end user experience,” such as by using tools such as Microsoft Intune, System Center Configuration Manager, or Windows Update for Business.

Microsoft advises users to modify their power settings to give their devices time to install security updates.

Home users may also be affected, although to a lesser degree. Users of Windows computers who use their computers for brief or light activities might find their systems not up-to-date. These users might have to run manual checks and install updates on the computer if they want to keep their computer updated.

Do you keep up with Windows updates as soon as they are released or do you hold off for a while? Share with us your thought process in the comment section.

Albeit unintentionally, Microsoft broke a new record when it managed to curb a 3.47 Tbps DDoS (Distributed Denial of Service) attack that happened last November.

Consequently, the company has shared the Azure DDoS data for Q3 2021 in a blog post where Microsoft said it experienced an increase in the amount of DDoS attacks in the latter half of 2021.

Attack services are available for cheap, so a lot of people use the hacker method called Distributed Denial of Service (DDoS) when they want to mess with websites.

Increased mitigation

Microsoft mitigated an average of 1,955 attacks per day in the second half of 2021, a 40% increase from the attacks happening per day in the first half of that year.

However, that was dwarfed by the 4,296 attacks mitigated on August 10, 2021. The company blocked 359,713 unique attacks during the second half of the same year.

While Microsoft was setting a new record with Azure servers, the company also defended against a DDoS attack that reached a peak of 3.47 Tbps and an average of 340 million packets per second.

The cyberwarfare attack originated from over 10,000 sources globally and included countries such as Taiwan, Indonesia, Iran, Vietnam, India, Thailand, Russia, South Korea, China, and the United States.

Additionally, the company experienced two more attacks in December with a combined throughput of 2.5 Tbps. Both attacks were in Asia.

More attacks in Asia

Microsoft also said it saw a sharp increase in distributed denial-of-service (DDoS) attacks in East Asia last year, including India and Hong Kong.

As gaming has become more popular, particularly in countries such as Hong Kong and South Korea, the increase in attacks can be viewed as a direct response to this growing trend.

Meanwhile, in India, the rise in digital adoption has exposed the country to cyber risks.

Microsoft now holds the record for mitigating the most damaging DDoS attack, but there have been other large-scale DDoS attacks in recent years that are worth noting.

Some of the attacks include the 2017 attack that was curbed by the reliability team from Google with a 2.54Tpbs throughput and the Amazon Web Service’s 2020 attack with a 2.3Tbps throughout.

What do you think about Microsoft’s cyber attack mitigation power? Share your thoughts with us in the comment section below.

It has been a big year for Facebook. The social network has solidified its messaging strategy around Messenger, a standalone mobile app with more than 900 million users. If we include Facebook messages in this chat app, then it becomes even more popular.

The reason behind its increasing popularity is that it is compatible with almost all smartphones and operating systems like Android, iOS, and Windows Phone.

With a lot of the focus in messaging being on end-to-end encryption and privacy, it’s easy to think of Messenger as the place you can freely discuss anything with anyone without needing to worry about security, but that’s not entirely true.

While there are some features built in to help you protect your privacy on Facebook’s messaging platform, and it’s very easy to chat securely with people who have Messenger and are also on an encrypted messaging service like WhatsApp, there are still some limitations.

Finally, end-to-end encryption is here

Following a multi-month beta testing period, the company finally announced the availability of E2EE on the Messenger platform for everyone.

This means that all your conversations on Messenger are end-to-end encrypted, including messages you send and receive as well as the audio calls you make and video chats you have. The encryption is built into the app and applied automatically, without any action required by you or the people you’re communicating with.

The company first started testing E2EE with a limited set of users last year, when it also introduced the ability to have group voice calls on Messenger.

More features

With this new update, if you’re in a group chat, you will first have to opt-in to make a voice call or send a disappearing message to every member in that chat. When you do so, all of your messages will be end-to-end encrypted. In addition, if someone takes a screenshot of disappearing messages, Facebook will tell you about it.

The new capabilities are available to anyone on Android, and iOS users can also now enjoy these features. While using E2EE chats, you can now send messages while offline, edit and personalize photos before sending them, as well as see when someone is typing a response.

What do you make of these new features for Facebook? Does it make Facebook worth an app having? Let us know in the comment section below.

It appears that Microsoft might be looking to capitalize on the success of Monster Hunter: World by creating its own Monster Hunter game.

You may not be aware of it, but a little-known studio called Certain Affinity has been behind some of your favorite games for years now.

The Xbox One is a powerful gaming system and if Microsoft wants to make a splash in this constantly growing market they will need to have big games available for the console.

Inspired by Monster Hunter Game

Certain Affinity is maybe best known for its work on the Halo series and other AAA brands like Call of Duty.

Microsoft is reportedly working on a game called Project Suerte, which may be an Xbox One version of Capcom’s Monster Hunter series. The reports were confirmed by Windows Central and could involve multi-player gameplay.

We don’t know anything else about Project Suerte (not even whether it will be called that when it comes out), but we can infer a few things from this announcement. From the name, which suggests that the game, codename Project Suerte, is “a ‘Monster Hunter’ inspired game,” implying big monster battles with multiplayer gameplay. If you’re going for Monster.

The cat’s out of the bag now, though, it is not clear when the official release date will be. It could be in 2023 or 2024 but will see how things progress.

In other news, feel free to use the best VPNs without lagging so you can continue enjoying Monster Hunter Game.

What do you think of the new game set to be released soon?

Teams bring together people, conversations, and content to help teams be more productive. It offers a chat-based workspace, modern meetings, and calling, alongside shared notebooks to keep everyone on the same page and a Files tab to store all your documents in one place.

Whereas Microsoft has made headway over the past year with the Teams app with numerous updates and new improved features such as automatic music detection and noise suppression, it now seems that the app no longer supports 365 accounts.

It seems like it is not a problem with Teams per se but that business accounts are not supported. Whether it is because there’s no dedicated “business” client or because Microsoft is treating business users as individuals that use their personal accounts.

Work or school version

Microsoft Teams on Windows 11 is the future of workplace collaboration, and it’s likely to become a central component in how many businesses operate. By providing a single, unified workspace for all your team to communicate, Microsoft Teams is designed to make it easier for teams to work together.

Users gathered on a Reddit thread as they were somewhat confused when they could no longer access the application.

While there is only one Android app for teams, it supports both personal and work accounts.

The Teams Admin was prompt to respond and clarified the confusion. The version you need depends on the kind of school or business you’re involved in. The personal/home version is not intended to be used with educational institutions, so you will have to install the work/school version if your school uses it.

This is only a temporary situation as Microsoft plans to unify both sometime later.

Tell us what you think of the distinction between Teams personal and work accounts in the comment section below.

Hackers are attempting a new method of widening the scope of their phishing campaigns by using stolen Office 365 credentials to register Windows devices with Azure Active Directory.

If attackers are able to access an organization, they will launch a second wave of the campaign, which consists of sending more phishing emails to targets outside the organization as well as within.

Target areas

The Microsoft 365 Threat Intelligence Team has been tracking a malware campaign targeting organizations in Australia and Southeast Asia.

To get their targets’ information, the attackers sent out phishing emails that looked like they were from DocuSign. When users clicked on the Review Document button, they were taken to a fake login page for Office 365, already pre-filled with their usernames

“The victim’s stolen credentials were immediately used to establish a connection with Exchange Online PowerShell, most likely using an automated script as part of a phishing kit. Leveraging the Remote PowerShell connection, the attacker implemented an inbox rule via the New-InboxRule cmdlet that deleted certain messages based on keywords in the subject or body of the email message,” the intelligence team highlighted.

The filter automatically deletes messages containing certain words related to spam, phishing, junk, hacking, and password security, so the legitimate account user will not receive non-delivery reports and IT notification emails they might otherwise have seen.

The attackers then installed Microsoft Outlook on their own machine and connected it to the victim organization’s Azure Active Directory, possibly by accepting the prompt to register Outlook when it was first launched.

Finally, once the machine became part of the domain and the mail client was configured like any other regular use within the organizations, the phishing emails from the compromised account fake Sharepoint invitations pointing again to a fake Office 365 login page became more persuasive.

“Victims that entered their credentials on the second stage phishing site were similarly connected with Exchange Online PowerShell, and almost immediately had a rule created to delete emails in their respective inboxes. The rule had identical characteristics to the one created during the campaign’s first stage of the attack,” the team indicated.

How to bypass

The attackers relied on stolen credentials; however, several users had multifactor authentication (MFA) enabled, preventing the theft from occurring.

Organizations should enable multifactor authentication for all users and require it when joining devices to Azure AD, as well as consider disabling Exchange Online PowerShell for end users, the team advised.

Microsoft also shared threat hunting queries to help organizations check whether their users have been compromised via this campaign and advised that defenders must also revoke active sessions and tokens associated with compromised accounts, delete mailbox rules created by the attackers, and disable and remove malicious devices joined to the Azure AD.

“The continuous improvement of visibility and protections on managed devices has forced attackers to explore alternative avenues. While in this case device registration was used for further phishing attacks, leveraging device registration is on the rise as other use cases have been observed. Moreover, the immediate availability of pen-testing tools, designed to facilitate this technique, will only expand its usage across other actors in the future,” the team advised.

Loopholes to lookout for

Microsoft’s threat intelligence analysts recently flagged a phishing campaign that targeted hundreds of businesses, this one an attempt to trick employees into granting an app named “Upgrade” access to their Office 365 accounts.

“The phishing messages mislead users into granting the app permissions that could allow attackers to create inbox rules, read and write emails and calendar items, and read contacts. Microsoft has deactivated the app in Azure AD and has notified affected customers,” they indicated.

Attackers can also bypass Office 365 Multi-Factor Authentication by using rogue applications, stealing authorization codes, or otherwise obtaining access tokens rather than their credentials.

Have you fallen victim to these attacks by hackers before? Share your experience with us in the comment section below. 

The Battlefield franchise has been a mainstay of the Xbox Live charts for years but it seems the luck is changing if the latest reports are anything to go by. 

When the official date and game requirements were announced, things seemed to be moving swiftly in the right direction.

However, the recent release of Battlefield 2042 has not only been a disappointment for fans of the Battlefield franchise but it’s also brought down the series’ ranking in the top 50 played games on Xbox Live.

The game suffered from technical issues at launch, including rampant crashes and memory leaks. The game also featured a revamped progression system that turned off many fans of the classic Battlefield experience.

Drop from the top

Battlefield 2042 is not in the top 50 most-played games on the system, despite releasing just about three months ago. Battlefield 2042 has been on a downward trend for months, with many users complaining about bugs, glitches and boring gameplay.

This is pretty surprising, considering that Battlefield 2042 was once the most played Xbox game on Steam. Now, Battlefield 5 seems to be progressing at a faster rate leaving Battlefield 2042 behind.

In fact, according to data from Steam Charts, Battlefield 5 is now more popular than Battlefield 2042 on PC.  Server issues aren’t the whole story here, though. The game’s retention numbers are also low, with about half of all players who try the game giving up after just one match.

A fall from grace

Battlefield 2042 is no longer being played by many people and has fallen off a major leaderboard that tracks the most popular multiplayer games on the Xbox One. The slip from charts is not a good sign as reports also indicate the numbers on Steam are also not doing so well.

This isn’t a good sign for the game’s future, because if there aren’t that many people playing it, then it’s probably on its way towards going free-to-play.

A quick glance at the top 50 most-played games on Xbox includes; Halo Infinite, Apex Legends, Grand Theft Auto 5, Call of Duty: Modern Warfare, and Fortnite, with the number 50 slot going to Call of Duty: Black Ops 3.

Free or not, problems are still there

EA hasn’t made any official announcements about Battlefield 2042 going free-to-play, but this move would make a lot of sense for them.

If Battlefield 2042 is going to make a comeback, it’s going to need to do more than just make its premium content free – it will need to overhaul the game’s core mechanics.

EA has been under a lot of pressure recently due to the loot box debacle and some other decisions that upset their customers. This is mostly because the last Battlefield game did not meet expectations within the company.

Do you think there is anything that can be done to salvage Battlefield 2042 dwindling fame among gamers? Share your thoughts in the comment section below.

Microsoft has altered its practices in how it handles the automatic renewal of contracts for online gaming services.

The company offers the Xbox Live Gold and Game Pass products, which allow customers to access a library of games and play together online.

Memberships are billed on an automatic renewal basis. If you do not cancel your membership, your credit/debit card will be charged at the end of your initial contract period unless you contact them to cancel your membership.

As part of an investigation into the online console video gaming sector, the UK’s Competition and Markets Authority issued a statement regarding its concerns with Microsoft’s auto-renewing subscriptions. The concern was that consumers did not fully understand the implications of signing up for this service.

Agreeable terms

The CMA has secured undertakings from Microsoft which address these concerns. The new terms include:

• Better upfront information: Microsoft will provide more transparent, upfront information to help customers understand their Xbox membership – making clear, for example, that the subscription will auto-renew unless the customer turns off auto-renewal; when the subscription will auto-renew; how much it will cost; and how the customer can receive a refund after an accidental renewal
• Refunds: Microsoft will contact existing customers on recurring 12-month contracts and give them the option to end their contract and claim a pro-rata refund
• Inactive memberships: Microsoft will also contact existing customers who haven’t used their memberships for a long time but are still paying. These customers will be reminded how to stop payments, and if they continue not to use their memberships, Microsoft will ultimately stop taking further payments
• Better information about price increases: Microsoft will give clearer notifications of any future price rises, and will ensure people know how to turn off auto-renewal if they don’t want to pay the higher price.

Here’s what Michael Grenfell, the Executive Director of Enforcement had to say at the CMA:

“Gamers need to be given clear and timely information to make informed choices when signing up for auto-renewing memberships and subscriptions. We are therefore pleased that Microsoft has given the CMA these formal undertakings to improve the fairness of their practices and protect consumers, and will be offering refunds to certain customers.“

“Other companies offering memberships and subscriptions that auto-renew should take note, and review their practices to ensure they comply with consumer protection law.”

What are your thoughts on the new auto-renewal policies in place? Let us know in the comment section below.