AskWoody

Second July cumulative update for Win10 1809 drops

Yesterday Microsoft released KB 4505658, the second “optional” July cumulative update for Win10 version 1809. We still haven’t seen the second July cumulative update for Win10 1903. Martin Brinkmann has details.

Of course, I don’t recommend that you install it. Let’s see what happens to the cannon fodder.

Per @Microfix

MSFT have also released an updated SSU patch and compatibility update for W10 v1809 yesterday 22nd July 2019. More info over in the Microsoft Catalog :

KB4505657 – Compatibility update for installing Windows 10, version 1809

KB4512937 – Servicing Stack Update for Windows 10 Version 1809

Thx to @Microfix, @b, @EP, @Alex5723.

BlueKeep exploitation expected soon

Several hours ago, there was a lot of noise on Twitter about a Github explanation on how to “weaponize” BlueKeep, triggering fears it could soon be widely expolited.

BlueKeep Warning: someone published a slide deck explaining how to turn the crash PoC into RCE. I expect we'll likely see widespread exploitation soon.https://t.co/MG2IZfy5B5

— MalwareTech (@MalwareTechBlog) July 22, 2019

Dan Goodin‘s article on ArsTechnica.com is fairly succinct:

BEWARE OF WORMABLE EXPLOITS —
Chances of destructive BlueKeep exploit rise with new explainer posted online

 
We’ll be keeping an eye on Kevin Beaumont’s Twitter feed, to see what he posts about it today.

Are you protected?

 
UPDATE:
Kevin Beaumont is also warning about a more imminent threat from BlueKeep

I've updated this thread with @0xeb_bp's #BlueKeep exploitation technical document, newly released today – it shows how to reach UAF. The bar for (unreliable) public exploitation POC is lowering significantly. https://t.co/UX1ujWaQik

— Kevin Beaumont (@GossiTheDog) 23 July 2019

Internet Explorer and Edge send the full URL of every page you visit to MS, plus your unique account ID

I didn’t know that.

😱 Edge apparently sends the full URL of pages you visit (minus a few popular sites) to Microsoft. And, in contrast to documentation, includes your very non-anonymous account ID (SID). pic.twitter.com/zHMLUGwo9w

— scriptjunkie (@scriptjunkie1) July 19, 2019

It all has to do with the “SmartScreen Filter,” designed to keep you away from malicious sites. Chrome, Firefox and Safari solved the phone home problem years ago with techniques that vet bad sites locally, on your computer, without leaving a trail in the sky.

Thx Catalin Cimpanu, @campuscodi, who adds “this has been known since 2005. Documented in official MSFT FAQ pages.”

Why can’t Microsoft reliably patch its own hardware?

WOODY’S WINDOWS WATCH

By Woody Leonhard

You don’t need me to tell you that Windows patches are too often of, uh, questionable quality.

But the latest screw-up with Win10 Version 1903 and top-of-the-line Microsoft Surface Book 2 PCs really takes the cake.

Read the full story in AskWoody Plus Newsletter 16.27.0 (2019-07-22).

Decoding a vague “Unknown Device” error

LANGALIST

By Fred Langa

When device problems arise, Windows often produces frustratingly vague error messages.

That makes it difficult to know which device is actually causing trouble. But a little experimentation can usually isolate the problem and point toward a solution.

Plus: Why does Windows hide file extensions by default?

Read the full story in AskWoody Plus Newsletter 16.27.0 (2019-07-22).

Deciphering Task Manager’s App History

WIN10 TUTORIAL

By TB Capen

The most recent versions of Windows 10 feature a Task Manager with new capabilities.

But some of these new features are, unfortunately, poorly documented. One example is the App History tab, which provides interesting and potentially useful information about system-resource use.

Read the full story in AskWoody Plus Newsletter 16.27.0 (2019-07-22).

Taking control of default apps in Win10

CONQUERING WINDOWS 10

By Lance Whitney

As with most things Windows, there’s more than one way to control or customize something — your preferred default applications, for example.

It’s also true that some Windows settings can be less than intuitive — or occasionally downright annoying. Here’s how to take full control over Win10’s default applications — or, when needed, select the best app for the task.

Read the full story in AskWoody Plus Newsletter 16.27.0 (2019-07-22).

Patch Lady – MSRC blog moves

Microsoft has been slowly migrating all of its blog properties over to new platforms.  I noticed tonight that the Microsoft Security Response Center has moved several of it’s security related blog properties over to a new url

https://msrc-blog.microsoft.com/

They’ve also put the Japanese security blog under that umbrella url as well.  What?  Can’t read Japanese?  No worries, go to a browser like Chrome and https://msrc-blog.microsoft.com/2019/07/09/201907-security-updates/ will automatically translated.

And actually that has a really nice recap of what priority one should put on the various patches.  Check it out!