Privacy Ninja



        • Secure your network against various threat points. VA starts at only S$1,000, while VAPT starts at S$4,000. With Price Beat Guarantee!

        • API Penetration Testing
        • Enhance your digital security posture with our approach that identifies and addresses vulnerabilities within your API framework, ensuring robust protection against cyber threats targeting your digital interfaces.

        • On-Prem & Cloud Network Penetration Testing
        • Boost your network’s resilience with our assessment that uncovers security gaps, so you can strengthen your defences against sophisticated cyber threats targeting your network

        • Web Penetration Testing
        • Fortify your web presence with our specialised web app penetration testing service, designed to uncover and address vulnerabilities, ensuring your website stands resilient against online threats

        • Mobile Penetration Testing
        • Strengthen your mobile ecosystem’s resilience with our in-depth penetration testing service. From applications to underlying systems, we meticulously probe for vulnerabilities

        • Cyber Hygiene Training
        • Empower your team with essential cybersecurity knowledge, covering the latest vulnerabilities, best practices, and proactive defence strategies

        • Thick Client Penetration Testing
        • Elevate your application’s security with our thorough thick client penetration testing service. From standalone desktop applications to complex client-server systems, we meticulously probe for vulnerabilities to fortify your software against potential cyber threats.

        • Source Code Review
        • Ensure the integrity and security of your codebase with our comprehensive service, meticulously analysing code quality, identifying vulnerabilities, and optimising performance for various types of applications, scripts, plugins, and more

        • Email Spoofing Prevention
        • Check if your organisation’s email is vulnerable to hackers and put a stop to it. Receive your free test today!

        • Email Phishing Excercise
        • Strengthen your defense against email threats via simulated attacks that test and educate your team on spotting malicious emails, reducing breach risks and boosting security.

        • Cyber Essentials Bundle
        • Equip your organisation with essential cyber protection through our packages, featuring quarterly breached accounts monitoring, email phishing campaigns, cyber hygiene training, and more. LAUNCHING SOON.

Windows MSDT zero-day Vulnerability Gets Free Unofficial Patch

Windows MSDT zero-day Vulnerability Gets Free Unofficial Patch

A free unofficial patch is now available to block ongoing attacks against Windows systems that target a critical zero-day vulnerability known as ‘Follina.’

The bug, now tracked as CVE-2022-30190 and described by Redmond as a Microsoft Windows Support Diagnostic Tool (MSDT) remote code execution flaw, impacts all Windows versions still receiving security updates (Windows 7+ and Server 2008+).

Attackers who successfully exploit this zero-day can execute arbitrary code with the privileges of the calling app to install programs, view, change, or delete data, or create new Windows accounts as allowed by the user’s rights.

Also Read: 5 Brief Concepts Between Data Protection Directive vs GDPR

While Microsoft has not issued security updates to address this actively exploited zero-day, the company has shared mitigation measures to block attacks by disabling the MSDT URL protocol malicious actors use to execute code on vulnerable systems.

It would be best to toggle off the Preview pane in Windows Explorer to remove it as an additional attack vector exploitable when previewing malicious documents.

Secure your system until an official fix is available

This is where the 0patch micropatching service comes in, with free (and unofficial) micropatches for some versions of Windows impacted by the Follina security bug:

  • Windows 11 v21H2
  • Windows 10 (from v1803 to v21H2)
  • Windows 7
  • Windows Server 2008 R2

Instead of disabling the MSDT URL protocol handler (as advised by Microsoft), 0patch has added sanitization of the user-provided path (currently missing in the Windows script) to avoid rendering the Windows diagnostic wizardry inoperable across the OS for all applications.

“Note that it doesn’t matter which version of Office you have installed, or if you have Office installed at all: the vulnerability could also be exploited through other attack vectors,” 0patch co-founder Mitja Kolsek said

“That is why we also patched Windows 7, where the ms-msdt: URL handler is not registered at all.”

To deploy this micropatch on your Windows system (for free until Microsoft has issued an official fix), you must register a 0patch account and install the 0patch agent

Once the agent is launched, it will automatically download and apply the patch unless local security policies prevent that.

Exploited in ongoing attacks

On Monday, enterprise security firm Proofpoint revealed that the China-linked TA413 hacking group is now exploiting this vulnerability in attacks against their favorite target, Tibetan diaspora dissidents.

Also Read: Top 10 Best Freelance Testing Websites That Will Pay You

Security researcher MalwareHunterTeam also spotted malicious documents with Chinese filenames being in the wild used to deploy password-stealing trojans via http://coolrat[.]xyz.

However, the first CVE-2022-30190 attacks were spotted over a month ago using sextortion threats and invitations to Sputnik Radio interviews as baits, as a sign that the flaw was and is likely being exploited by other threat actors.

CISA has also urged Windows admins and users to disable the MSDT protocol after Microsoft reported active exploitation of the vulnerability in the wild.

Shadow Chaser Group’s CrazymanArmy, the security researcher who reported the zero-day in April, said Microsoft rejected his submission as not a “security-related issue.” However, Redmond later closed the vulnerability submission report with a remote code execution impact.



Subscribe to our mailing list to get free tips on Data Protection and Data Privacy updates weekly!

Personal Data Protection


We have assisted numerous companies to prepare proper and accurate reports to PDPC to minimise financial penalties.


Click one of our contacts below to chat on WhatsApp

× Chat with us