October 10, 2017 | By admin

(6 votes, 4.33 / 5

Microsoft has released a free upgrade for Genuine Windows 10 and Windows 8/8.1 users. A free upgrade is on the line, which will give them an added advantage viz-a-viz better security. The new Windows Device Guard, Hello, and Passport. Nevertheless, with this latest offering, Windows has always been in the news for its security flaws.

All software around the world is prone to vulnerabilities and keep it safe from attack is the key to success. Here are the top 10 flaws in Windows 10, and how to address it.

Top Windows 10 OS Vulnerabilities – Latest Listing 2019

(CVE-2015-0057) Win32k Elevation of Privilege Vulnerability

Windows 10 WiFi Sense Contact Sharing

(MS15-078) Microsoft Font Driver Vulnerability

(MS15-092) .NET Framework Escalation of Privilege Vulnerability

(CVE-2015-5143) Redirect to SMB Vulnerability

(MS15-098) Microsoft Windows Journal Vulnerability

(MS15-079) Internet Explorer Vulnerabilities

(MS15-080) Microsoft Graphics Component Vulnerabilities

(MS15-091) Microsoft Edge Vulnerabilities

Windows 10 Mount Manager Vulnerability (CVE-2015-1769, MS15-085)

1. (CVE-2015-0057) Win32k Elevation of Privilege Vulnerability

This is a flaw in Windows 10 GUI component, commonly known as the scrollbar element, which allows the hackers to gain control of a Windows machine through privilege escalation. Microsoft has released a patch to fix this flaw.

2. Windows 10 WiFi Sense Contact Sharing

By default, Windows 10 will share your wifi credentials to Outlook, Skype, and Facebook contacts—presumably to make wifi and hotspot sharing easier. This makes it possible for any of these said contacts to hop onto your WiFi network—if in proximity—without authorization. While not necessarily a software vulnerability, this feature can lead to compromises, and should be remediated through the following steps:

Windows by default have been designed in a way that makes hotspot sharing easily, the credentials are with Skype, outlook, and even Facebook. So this makes it vulnerable as any contact with proximity to snoop into your WiFi without authorization. This may not be a vulnerability, but it gives way to the hacker to compromise. This can be rectified with the following steps.

Change the wifi network name/SSID to include the terms “_nomap_optout,” prior to upgrading to Windows 10.

Post-upgrade, change your Windows privacy settings to disable Wifi Sense sharing.

3. (MS15-078) Microsoft Font Driver Vulnerability

Adobe Type Manager in Windows at times are not able to handle the OpenType fonts, this results in remote code execution, and its a vulnerability. This gives attackers the room to gain access to the system and install programs, and create new accounts view/change/delete data. Though Microsoft has released a patch for this flaw, still this can be manually downloaded and installed.

4. (MS15-092) .NET Framework Escalation of Privilege Vulnerability

This is the another version of the above point No.1. The .NET application can enable privilege exploits, where the user is tricked to run the application. You can read more about this vulnerability on Microsoft item security bulletin page.

5. (CVE-2015-5143) Redirect to SMB Vulnerability

A flaw that has the ability to impact all the versions of Windows. A core Window API library that connects with Windows SMB. This results in Windows user getting redirected to a malicious SMB-based server, and then their credentials get stolen. The best way to stop this is to block TCP ports 139 and 445 and disable SMB.

6. (MS15-098) Microsoft Windows Journal Vulnerability

When the user opens a specially-crafted Journal file, it tends to allow remote code execution. More details can be sought on the Windows security bulletin page.

7. (MS15-079) Internet Explorer Vulnerabilities

Remember Microsoft’s browser, which also has its share of vulnerabilities that come with Windows 10. The most dangerous of the flaw is that it allows the hackers to gain access to the system through the browser. The details of the patch are available on the security bulletin page.

8. (MS15-080) Microsoft Graphics Component Vulnerabilities

A flaw related graphic memory management and fonts, and this results in remote code execution, which directs you to some dubious website with embedded fonts. Visit the Microsoft website and get the patch under a security bulletin page.

9. (MS15-091) Microsoft Edge Vulnerabilities

The Microsoft Edge (browser) was never in the list of the secured browser. The various remote code execution and security bypass exploits enabled hackers to gain control over the system. Visit the Microsoft website and get the patch under a security bulletin page.

10. Windows 10 Mount Manager Vulnerability (CVE-2015-1769, MS15-085)

This vulnerability involves the potential escalation of privilege by inserting a USB device into the target system. Through this method, an attacker could write a malicious binary to disk and execute the code. An update is available from Microsoft to patch this vulnerability.

How to Protect Computer from Virus?