For the second of our game reviews, since returning to covering games, we decided to look at the Microsoft flagship game RedFall. If you have heard of this game, it has probably been in a negative light. Most reviews have already come in and they are not good. Everything from calling the writing and plot “Woke” to buggy graphics, enemy AI, and terrible stylized artwork. So, with this list of negatives already in place, why even bother? Well, I am a glutton for punishment, I like terrible games (at times) and it was free on Game Pass… incidentally I also thought it might be funny to see if this game was as bad as everyone said and add something to the pool of snark surrounding it. For this review we will be covering the Game Pass PC version and playing it on the Xbox One Series X.

RedFall by Akrane Austin was not a well-received game. It has been pretty much panned by everyone that played it. The complaints range from a bad story line and plot to bad graphics, game lag and terrible AI (you can read our review to see our thoughts). Well, it seems that the developers at Arkane Austin were not happy with the game either and were hoping that Microsoft would step in and alter the course before launch.

A couple of days ago an email was sent to me about a new tool kit being sold on the darker side of the internet. The claim what that this new tool could kill the processes behind “any” AV, EDR, or XDR running on Windows 7 and newer. The same email included a link to what was supposed to be proof of its efficacy. I opened the link in a sandbox on a controlled VM just to be sure the link was not malicious all on its own. What I saw was nothing all that new, although it was a bit worrying.

This one goes in both the “failure of imagination” and “this is why we can’t have nice things” category. It seems that Gigabyte, for some reason, decided to embed an insecure update function into the UEFI BIOS of their motherboards, then shipped roughly 7 million of them to customers. The fatal flaw? Well, this is an update function that runs on startup. It writes a file to disk, reaches out to update servers over open HTTP then downloads any updates and installs them.

The RomCom backdoor malware appears to have a new campaign running. The new campaign is using impersonation attacks for different software packages (some real, some not). The goal is to trick the unwary into downloading, and hopefully launching malicious payloads. This type of campaign leverages ad services like Google Ads as a “trusted” platform using ads for software that is either often sought after or currently very popular, like ChatGPT, PDF readers, Remote Management software, etc. They are also, at times, leveraged as links in targeted or blanket phishing and social engineering attacks to get the malware on the targeted systems.

On May 19th 2023 Barracuda disclosed that there was a critical vulnerability in their Email Security Gateway appliances. This vulnerability is tracked under CVE-2023-2868 and is listed as a remote command injection vulnerability. The flaw is present in software versions 5.1.3.001 up to 9.2.0.006 for the ESG appliances only. As this was disclosed as a Zero-Day vulnerability there was an accelerated patch release schedules with the first patches made available on May 20th.

Apple’s System Integrity Protocol (SIP) has been something of a mix bag when it comes to security. It is a great feature from a raw and basic security viewpoint, but the same feature also has created challenges for the installation of third-party anti-malware and other security tools since its launch. All that aside, Microsoft, of all people, has shared details on a vulnerability that can be used by attackers to completely bypass the protections that SIP is supposed to offer.

There is no such thing as a coincidence, especially in the business world. If you hear of something and the timing seems suspicious, it is because someone pushed something in the right direction at the right time. This is the case that we see here with Sony now being under investigation by the Romanian Competition Council for possible market abuse at a time when Microsoft is trying to gain a market advantage. If this news does not seem odd to you, you might not be paying attention.

Google has been very interested in pushing new standards for messaging, Rich Communication Services. RCS started in 2007 as a new way to make “texting” more functional and complete. This included things like read receipts, response indictors (typing icon) and more. It was a way to make standard android messaging services on par with apps like Signal, WhatsApp, and Telegram. In and of itself it is a great feature and one that enhances standard SMS and MMS functionality. Along the journey Google and others started to add encryption (end-to-end) as a way of protecting the message content (which was a core component of RCS).

This one will get filed in the “you knew it was going to happen” file. After the announcement of a few new top-level domains (TLDs) including .zip and .mov by Google the security world silently shook its head. The concept of using file extensions as TLDs is one that defies logic. As soon as I read about these new domains, I knew someone was going to create phishing or malware attacks with URLs that look like common file names. These attacks can leverage modern web design to make a target think they are using an application to run or open the file when they are really executing commands in the background to compromise their systems. Lo and behold! We now have file archiver in the browser as shown off by mr.d0x.