urlscan.io logo urlscan.io
SecurityTrails logo

www.forbes.com Open in urlscan Pro
151.101.2.49  Public Scan

Back to summary
Submitted URL: https://apple.news/AgyLSBA7-Tc6kvWCgbTgImA
Effective URL: https://www.forbes.com/sites/zakdoffman/2020/05/17/microsoft-confirms-serious-new-windows-10-security-problem-says-go-b...
Submission Tags: falconsandbox
Submission: On June 17 via api from US — Scanned from DE

Form analysis 1 forms found in the DOM

<form class="search-modal__form"><input class="search-modal__input" type="text" placeholder="Search" autofocus=""><button class="search-modal__submit" role="button" tabindex="0" title="Submit"><svg class="fs-icon fs-icon--arrow-right"
      xmlns="http://www.w3.org/2000/svg" viewBox="0 0 20 20">
      <path transform="rotate(-180 8.964 11)" d="M1 10h16v2H1z"></path>
      <path transform="rotate(134.999 14.965 13.124)" d="M11 12.1h8v2h-8z"></path>
      <path transform="rotate(-134.999 14.965 8.877)" d="M11 7.9h8v2h-8z"></path>
    </svg></button></form>

Text Content

Explore

 * Billionaires
   
    * All Billionaires
    * World's Billionaires
      
    * Forbes 400
      
    * America's Richest Self-Made Women
      
    * China's Richest
      
    * India's Richest
      
    * Indonesia's Richest
      
    * Korea's Richest
      
    * Thailand's Richest
      
    * Japan's Richest
      
    * Australia's Richest
      
    * Taiwan's Richest
      
    * Singapore's Richest
      
    * Philippines' Richest
      
    * Hong Kong's Richest
      
    * Malaysia's Richest
      
    * Money & Politics
      
    * 2020 Money
      

 * Innovation
   
    * All Innovation
    * 5G
      
    * AI
      
    * Big Data
      
    * Cloud
      
    * Cloud 100
      
    * COP26
      
    * Consumer Tech
      
    * Cybersecurity
      
    * Enterprise Tech
      
    * Future Of Work
      
    * Games
      
    * Google Cloud BrandVoice | Paid Program
      
    * Healthcare
      
    * Innovation Rules
      
    * SAP BrandVoice | Paid Program
      
    * Science
      
    * ServiceNow BrandVoice | Paid Program
      
    * Social Media
      
    * Splunk BrandVoice | Paid Program
      
    * Sustainability
      
    * Venture Capital
      
    * Wind River BrandVoice | Paid Program
      

 * Leadership
   
    * All Leadership
    * Careers
      
    * CEO Network
      
    * CFO Network
      
    * CHRO Network
      
    * CIO Network
      
    * CMO Network
      
    * CxO
      
    * Deloitte BrandVoice | Paid Program
      
    * Diversity, Equity & Inclusion
      
    * Education
      
    * Forbes EQ | Paid Program
      
    * Forbes The Culture
      
    * ForbesWomen
      
    * Leadership Strategy
      
    * PwC Cloud and Digital Transformation BrandVoice | Paid Program
      
    * Under 30
      
    * Working Remote
      
    * Over 50
      

 * Money
   
    * All Money
    * Banking & Insurance
      
    * ETFs & Mutual Funds
      
    * Fintech
      
    * Hedge Funds & Private Equity
      
    * Investing
      
    * Investing Basics | Q.ai
      
    * Markets
      
    * Personal Finance
      
    * Premium Investing Newsletters
      
    * Retirement
      
    * Taxes
      
    * Top Advisor | SHOOK
      
    * Wealth Management
      

 * Forbes Digital Assets
   
    * All Forbes Digital Assets
    * Dashboard
      
    * Traded Assets
      
    * Research
      
    * Events
      

 * Business
   
    * All Business
    * Aerospace & Defense
      
    * Energy
      
    * Food & Drink
      
    * Hollywood & Entertainment
      
    * Manufacturing
      
    * Media
      
    * Mitsubishi Heavy Industries BrandVoice | Paid Program
      
    * Policy
      
    * Retail
      
    * SportsMoney
      
    * Tableau BrandVoice | Paid Program
      
    * Transportation
      

 * Small Business
   
    * All Small Business
    * Entrepreneurs
      
    * Franchises
      
    * Small Business Strategy
      

 * Lifestyle
   
    * All Lifestyle
    * Arts
      
    * Boats & Planes
      
    * Cars & Bikes
      
    * Dining
      
    * ForbesLife
      
    * Forbes Travel Guide
      
    * Spirits
      
    * Style & Beauty
      
    * Travel
      
    * Vices
      
    * Watches
      

 * Real Estate
   
    * All Real Estate
    * Commercial Real Estate
      
    * Forbes Global Properties
      
    * Residential Real Estate
      

 * Store
   
    * All Store

 * Vetted
   
    * All Vetted
    * Gear
      
    * Health & Wellness
      
    * Home & Kitchen
      
    * Style
      
    * Tech & Electronics
      

 * Coupons
   
    * All Coupons
    * Purple
      
    * Squarespace
      
    * Verizon
      
    * Lululemon
      
    * AT&T
      
    * Lowe's
      
    * Brooks Brothers
      
    * Tory Burch
      
    * Dr Martens
      
    * Dell
      
    * Chewy
      

 * Advisor
   
    * All Advisor
    * The Best Credit Cards Of 2022
      
    * Best Balance Transfer Credit Cards
      
    * Best Cash Back Credit Cards
      
    * Best Travel Credit Cards
      
    * Best Business Credit Cards
      
    * Today's Mortgage Rates
      
    * Today's Refinance Rates
      
    * Best Mortgage Lenders 2022
      
    * Best Crypto Exchange 2022
      
    * Best Life Insurance
      
    * Best Travel Insurance 2022
      
    * Covid-19 Travel Insurance
      
    * Online Car Insurance Quotes
      
    * Car Insurance Companies
      
    * Pet Insurance
      
    * Personal Loans
      
    * Debt Consolidation Loans
      
    * Student Loan Refinance
      
    * Business Loans
      
    * Forbes Advisor UK
      
    * Calculators
      
    * Best Online Banks
      
    * Best CD Rates
      
    * Best Savings Accounts
      
    * Best Checking Accounts
      

 * Health
   
    * All Health
    * Mind
      
    * Online Therapy
      
    * Body
      
    * BMI Calculator
      
    * Calorie Calculator
      
    * Family
      
    * Due Date Calculator
      
    * Healthy Aging
      
    * Medical Alert Systems
      
    * Hearing Aids
      
    * Walk-In Tubs
      
    * Health Insurance
      
    * Medicare Advantage Plans
      

 * Lists
   
    * All Lists

 * Video
   
    * All Video

 * Newsletters
   
    * Crypto Confidential
      
    * Editorial Newsletters
      
    * Investing Digest
      
    * Premium Investing Newsletters
      

 * Forbes Magazine
   
    * All Forbes Magazine
    * Forbes Asia
      
    * Free Issue of Forbes
      

 * Latest
   
    * Coronavirus Coverage
      
    * Daily Cover Stories
      
    * Dark Capital
      
    * Editors' Picks
      
    * Visual Web Stories
      

 * Featured
   
    * 4 Steps To Help Your Kids Build Smart Money Habits
      
    * 30 Under 30 2022
      
    * America's Richest Self-Made Women 2022
      
    * DNA of Success
      
    * Forbes Insights With SAP Concur | Paid Program
      
    * Forbes Insights With Treasure Data | Paid Program
      
    * How To Tell What Your Car Is Worth--And How To Sell It For Top Dollar
      
    * Is It Better To Lease Or Buy A Car In Summer 2022?
      
    * Qlik BrandVoice | Paid Program
      
    * Right Now In Tech: PyCon U.S. 2022
      
    * The Fintech 50 2022
      
    * The Forbes Entrepreneurial CMO List: 2022
      
    * The Leukemia & Lymphoma Society BrandVoice | Paid Program
      

 * Advertise with Forbes
 * Report a Security Issue
 * Site Feedback
 * Contact Us
 * Careers at Forbes
 * Tips
 * Corrections
 * Privacy
 * Do Not Sell My Personal Information
 * Terms
 * AdChoices
 * Reprints & Permissions
   © 2022 Forbes Media LLC. All Rights Reserved

Subscribe
Sign In




















BETA
This is a BETA experience. You may opt-out by clicking here


MORE FROM FORBES

Jun 17, 2022,06:17am EDT
UK Lays Out Proposed New Data Protection Laws
Jun 17, 2022,05:00am EDT
Critical New Security Update For Millions Of Windows 10, 11 & Server Users
Jun 16, 2022,06:00am EDT
WhatsApp Warning As Free Beer For Father’s Day Scam Goes Viral
Jun 15, 2022,01:24pm EDT
Your Deleted TikTok Content Can Still Be Used Against You By The FBI
Jun 15, 2022,04:13am EDT
Act Now To Fix Under Attack Microsoft Windows 0-Day Hack
Jun 14, 2022,04:49am EDT
Wikipedia Appeals Russian 'Misinformation' Ban
Jun 13, 2022,08:15am EDT
Firefox Just Gave 3 Billion Google Chrome Users A Reason To Switch

Edit Story

Cybersecurity


MICROSOFT CONFIRMS SERIOUS NEW SECURITY PROBLEM FOR WINDOWS 10 USERS

Zak Doffman
Contributor
Opinions expressed by Forbes Contributors are their own.
I cover security and surveillance and co-host 'Straight Talking Cyber'
New! Follow this author to improve your content experience. Got it!
May 17, 2020,02:34pm EDT|


This article is more than 2 years old.
 * Share to Facebook
 * Share to Twitter
 * Share to Linkedin



SOPA Images/LightRocket via Getty Images

Microsoft has now joined Intel in confirming a newly reported security
vulnerability with Thunderbolt ports, one that enables an attacker with physical
access to a PC to modify the port’s controller firmware, disabling its security.
As I reported last week, almost all Windows PCs with Thunderbolt ports are
vulnerable, except a few from last year that shipped with Kernel DMA protection
enabled.




This new security threat has been dubbed “Thunderspy” by Björn Ruytenberg, the
Eindhoven University of Technology researcher who discovered and disclosed it.
Ruytenberg warns that despite locking or suspending a PC, setting up a Secure
Boot and strong system passwords, and enabling disk encryption, “all an attacker
needs is five minutes alone with the computer” to compromise a machine.





Such physical attacks on computers are complex, high-risk and thankfully rare.
But they do happen. A physical compromise such as this is nicknamed an “evil
maid” attack—the idea being that your machine is targeted when you’re staying in
a hotel and away from your room, or when the overnight cleaning crew come to
blitz your office. An attacker needs a few undisturbed minutes with no eyes-on.



MORE FOR YOU


IOS 15: APPLE ISSUES 22 IMPORTANT IPHONE SECURITY UPDATES


WIDELY-USED HIKVISION SECURITY CAMERAS VULNERABLE TO REMOTE HIJACKING


IOS 15 IS AVAILABLE NOW WITH THESE STUNNING NEW IPHONE PRIVACY FEATURES

If you’re a target, this will happen when you’re down at breakfast, out to
dinner or using the gym in your hotel. “I have even heard of someone finding all
the screws from his laptop on the table top after he took it out from his hotel
safe,” former British intel officer Philip Ingram told me. This is why security
professionals leave a “do not disturb” sign on their hotel room doors even when
they’re not inside—you get your room serviced by calling down and asking for it
to be done at a time of your choosing. And you have your devices with you while
it’s being done.




Now Microsoft has confirmed the risk that “an attacker with physical access to a
system can use Thunderspy to read and copy data even from systems that have
encryption with password protection enabled.” The vulnerability is in hardware,
and so cannot be patched. According to Microsoft, someone with physical access
to the device “could sign in and exfiltrate data or install malicious software.”
Microsoft’s advice to “stay ahead of advanced data theft” is to buy a new PC.

PLAY Forbes Innovation Video Settings Full Screen About Connatix V166967 Read
More Read More Read More Read More Read More Read More ‘Stranger Things’
Showrunners Now Regret KillingOff A Character, Again 1/1 Skip Ad Continue
watching after the ad Visit Advertiser websiteGO TO PAGE



Not just any PC, of course, but one of their newly minted “secured-core PCs.”
These have been around since late last year and come with all the security bells
and whistles enabled in hardware and firmware, “mitigating Thunderspy and any
similar attacks that rely on malicious DMA.” Intel told me that a Thunderspy
attack “could not be successfully demonstrated on systems with Kernel DMA
protection,” a feature enabled by default on Microsoft’s Secured-core PCs.



How a Thunderspy attack works.

Microsoft

As Microsoft explains, “even if an attacker was able to copy malicious
Thunderbolt firmware to a device, the Kernel DMA protection on a Secured-core PC
would prevent any accesses over the Thunderbolt port unless the attacker gains
the user’s password... significantly raising the degree of difficulty.”

There is now a range of Secured-core PCs available, aimed at business users,
likely those with a heightened sense of security awareness, who travel regularly
(albeit not just at the moment), and who have valuable data on their machines.
This isn’t just spooks—business leaders, VIPs, negotiators, politicians, anyone
with sensitive data who travels and leaves their PC out of sight for periods of
time.

The alternative mitigation to a locked-down machine, according to Ingram, is
worse. “Take a burner device with only the data you need for those meetings on a
separate USB. Never connect it to any network when you return home and only use
it for travel to that country. If you ever leave it unattended assume the
hardware has been compromised. If you have been subject to extended searches at
an airport and have lost sight of your IT, assume it has been compromised.” You
get the point.

As security vulnerabilities go, Thunderspy is pretty niche—an issue on a massive
scale, but one which realistically only puts a very small percentage of users at
risk. That said, it is a security flaw and it does leave PCs open to compromise.
With that in mind, plus the fact this is now in the public domain, I’m sure many
users will look at the availability of Kernel DMA protection when they next
trade-up.


Follow me on Twitter or LinkedIn. 
Zak Doffman



Zak is a widely recognized expert on surveillance and cyber, as well as the
security and privacy risks associated with big tech, social media, IoT and
smartphone

... Read More



 * Editorial Standards
 * Print
 * Reprints & Permissions



Ukrainian Government And Banks Hit By New Wave Of Cyberattacks






Cookies on Forbes
YOUR CHOICES REGARDING COOKIES ON THIS SITE
Please choose whether this site may use cookies or related technologies such as
web beacons, pixel tags, and Flash objects ("Cookies") as described below. You
can learn more about how this site uses cookies and related technologies by
reading our privacy policy linked to below. Your choices on this site will be
applied globally. This means that your settings will be available on other sites
that set your choices globally. You can change your mind and revisit your
preferences at any time by accessing the "Cookie on Forbes" button on the left
side of this site.



While we need to use required cookies to make our site work, we won't set
optional cookies unless you enable them.
WE AND OUR PARTNERS

We and our partners: process personal data such as IP Address, Unique ID,
browsing data for: Informationen auf einem Gerät speichern und/oder abrufen |
Personalisierte Anzeigen, Anzeigenmessung und Erkenntnisse über Zielgruppen |
Personalisierte Inhalte und Inhaltemessung | Produkte entwickeln und verbessern
| Genaue Standortdaten verwenden | Geräteeigenschaften zur Identifikation aktiv
abfragen.

Accept All Choose Cookies
Privacy Statement
Powered by: