Newsletter Archives

• The sky is not falling

  Posted on March 20, 2023 at 02:41 CDT by Susan Bradley • Comment in the Forums

  PATCH WATCH

  

  By Susan Bradley

  You may have seen the headlines: Outlook is getting a patch for a zero-day attack that can’t be fixed just by turning off the preview pane.

  Don’t panic. The risk is greatest if you are connecting Outlook to an on-premises Exchange server.

  Importantly, the attacks have been seen only in targeted firms. The risk is higher for government agencies. Microsoft has even provided a script to determine whether you are at risk.

  Read the full story in our Plus Newsletter (20.12.0, 2023-03-20).

  Patch Watch Exchange Server, Microsoft Outlook, Newsletters, Patch Lady Posts, Patch Watch

• Don’t want search?

  Posted on March 19, 2023 at 00:18 CDT by Susan Bradley • Comment in the Forums

  Now I will be the first to admit that I search.  I search on Google.  I search even on Bing. But when I search – I WANT TO SEARCH. So I’ve never quite understood why Microsoft has this thing about having the Operating system search from the taskbar.  I open a browser.

  Now I do use the search box to quickly jump to a setting. If you hop back and forth between Windows 10 and 11 sometimes the brain goes… where did they move that again?

  So now we have Bing being added to search in the March updates.. but not just ANY search … it’s the chatgpt search.

  Now I’m not adverse to change but really…. do we really need all of this ChatGPT stuff given that it feels very much to me that it’s a bit too new, too much the shiny thing and hasn’t been tested for security issues, side effects and what not?

  Joe here posts about the registry key to disable or hide the search bar. You can find this by opening up the registry and

  find: Computer\HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Search

  Look for SearchboxTaskbarMode and right-click on it and select Modify.  Change it to 0

  

  I’d argue that you want it t0 search your computer, but not the web. For this you’ll add a new registry key for DisableSearchBoxSuggestions

  [HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Explorer]
  “DisableSearchBoxSuggestions”=dword:00000001

  And let’s not forget about chatgpt coming to Microsoft 365 Copilot. Stay tuned, we’ll have lots more guidance and advice on how to navigate all of these vendors “rush to the AI” trend. And how to turn some of these settings off….

  Windows 10, Windows 11 Patch Lady Posts

• Special note for Samsung users (or Pixel users too!)

  Posted on March 17, 2023 at 00:50 CDT by Susan Bradley • Comment in the Forums

  If you have any of the following read on….

  Mobile devices from Samsung, including those in the S22, M33, M13, M12, A71, A53, A33, A21, A13, A12 and A04 series;
  Mobile devices from Vivo, including those in the S16, S15, S6, X70, X60 and X30 series;
  The Pixel 6 and Pixel 7 series of devices from Google;
  any wearables that use the Exynos W920 chipset; and
  any vehicles that use the Exynos Auto T5123 chipset.

  What is this about?  Google project zero have released a blog post about a security vulnerability that impacts these devices.

  What does this mean? Tests conducted by Project Zero confirm that those four vulnerabilities allow an attacker to remotely compromise a phone at the baseband level with no user interaction, and require only that the attacker know the victim’s phone number. With limited additional research and development, we believe that skilled attackers would be able to quickly create an operational exploit to compromise affected devices silently and remotely.  So if the attacker CALLS you, they could compromise your phone.

  Note: Until security updates are available, users who wish to protect themselves from the baseband remote code execution vulnerabilities in Samsung’s Exynos chipsets can turn off Wi-Fi calling and Voice-over-LTE (VoLTE) in their device settings. Turning off these settings will remove the exploitation risk of these vulnerabilities.

  What should I do? 

  How to turn off WiFi calling on a Samsung phone

  1. Open the phone on your Samsung phone
  2. Tap the three-dot menu in the top-right corner
  3. Select Settings
  4. Find the WiFi Calling option about halfway down and toggle it off

  How to Disable VoLTE on any Samsung Galaxy Phone

  1. Head over to the Settings page on your galaxy device.
  2. Then go to the Connections section.
  3. Scroll to the Mobile network section.
  4. Within that, you should see the VoLTE Calls option. Just disable the toggle and that’s it. (note I think this should be default disabled and is probably not enabled by default)

  No patch is available at this time.  As soon as I hear word of one, I’ll add it to the master patch listing.

  Please note – each vendor of the phones can customize the deployment and thus you may not see these options in your phone.

  Android Master Patch List, Patch Lady Posts

• Master Patch list as of March 15, 2023

  Posted on March 16, 2023 at 00:54 CDT by Susan Bradley • Comment in the Forums

  

  I’ve updated the Master Patch list for the March releases.

  Remember to always review the known issues we are tracking on the Master Patch List. I will keep the latest info there.  Right now the big trending issue is the issue where Windows 10 22H2 doesn’t seemingly reboot if you manually check for updates. If you use Start11, StartAllBack, and ExplorerPatcher  make sure you update to the latest on Windows 11.

  I am recommending at this time that you install Apple updates, I’m not recommending Windows updates at this time. I’ll have more details in the newsletter on Monday.

  • Windows 11 22H2: Not recommended
  • Windows 11 21H2: If you have a Windows 11 PC, recommended
  • Windows 10 22H2: Recommended
  • Windows 10 21H2: Recommended (if a vendor won’t support 22H2)
  • Apple Ventura – Recommended for newer hardware – as always check with the applications you rely on if they recommend this release.

  As always, thank you all for supporting the cause! Remember a donation will give you access and if you donate $50 or more you’ll get a special code to enable text messages sent to your phone each time the Master Patch List gets updated and when I change the MS-DEFCON level.

  Windows Security Master Patch List, Patch Lady Posts

• March madness here we come

  Posted on March 14, 2023 at 12:50 CDT by Susan Bradley • Comment in the Forums

  Ready or not – here comes the March updates. Remember by this time you need to have a backup and defer updates (unless you are one of the souls who like to be the beta testers for the rest of us.

  Interesting items of note:  Outlook vulnerability used in TARGETED only attacks and impacting NTLM (translation – businesses with Exchange servers not consumers/home users. If you have click to run Office this will be auto updated.

  There is also a ‘smartscreen’ vulnerability where Edge can be tricked into thinking something isn’t from the web and not scan it. This will be auto updated when Edge updates.  When we finally update Windows the smartscreen as a whole will be updated. But again, we don’t blindly download things do we?

  Both are more business only – not consumer/home targeted so I’m not changing my “hold off and wait to patch” stance in any way.

  Remember Windows 11 22H2 gets “moments” releases – I’ll be reporting if my registry key works on Windows 11 Home computers.

  More links as they come live…..

  Also business impact:

  This update implements phase three of Distributed Component Object Model (DCOM) hardening. See KB5004442. After you install this update, you cannot turn off the changes using the registry key.

  This update addresses an issue that affects a computer account and Active Directory. When you reuse an existing computer account to join an Active Directory domain, joining fails. This occurs on devices that have installed Windows updates dated October 11, 2022 or later. The error message is, “Error 0xaac (2732): NERR_AccountReuseBlockedByPolicy: ‘An account with the same name exists in Active Directory. Re-using the account was blocked by security policy.’” For more information, see KB5020276.

  Dustin Childs’ zero day blog

  Windows Security March 2023 Black Tuesday, Patch Lady Posts

• Ensuring you can recover

  Posted on March 13, 2023 at 02:41 CDT by Susan Bradley • Comment in the Forums

  PATCH WATCH

  

  By Susan Bradley

  Anyone reading the title of this edition of Patch Watch may think I’m talking about a Windows update issue.

  But no matter what your technology, I want to remind you that having a backup means that you will be able to recover.

  A good friend of mine, totally ensconced in the Apple world, reported that her older Apple computer running Monterey was not a happy camper. She had been traveling and did not want to install updates. Once at home after her travels, she attempted to update. That’s when the “fun” started.

  Read the full story in our Plus Newsletter (20.11.0, 2023-03-13).

  Patch Watch backup, Group Policy Editor, Intel, Newsletters, Patch Lady Posts, Reinstall, Upgrade blocking, Zero Day

• Don’t forget about….

  Posted on March 12, 2023 at 00:29 CST by Susan Bradley • Comment in the Forums

  The other day I was reminded that sometimes it feels like we focus on the new shiny thing instead of the thing we’ve had for years.  Not to worry…. all of this Windows 11 coverage isn’t going to crowd out me making sure that you have all the information you need to use your Windows 10 machine. We still also have forums for Windows 8.1, Windows 7 and even older operating systems. If anyone starts to wax poetic about Windows NT, however, I draw the line. Dealing with drivers and dip switches on that platform was NOT fun.

  Windows 10 is going to be supported until October 14, 2025 and if you are like me, you are going to squeeze every single last bit out of that operating system – or rather – until the hardware won’t run it or it it’s too risky to run it anymore. Like many other businesses and consumers of every size and budget, I have too many systems still running it and even with budgeting for upgrades, I still predict that once 2025 comes, they will allow extended security updates – but probably with a hook to Microsoft 365 subscriptions.

  Therein is my first reminder of anyone using hardware that is starting to get a bit older. Make sure you take care of it. Start always with having a backup of that operating system. I will once again urge everyone to ensure you have a backup method that makes sense to you. If you want an EXACT image of your computer, make sure you have a third party backup software that makes an exact copy.

  It annoys me that to this day Microsoft stresses backing up to their cloud (onedrive) as a preferred way to backup rather than making sure we backup the operating system. Sorry Microsoft, Apple is superior here with their built in backup solution versus your “Windows 7” era backup solution.

  So it’s the weekend before Patch Tuesday. Set your deferrals to ensure that you won’t receive updates right away?

  If you do have Windows 11 Home, look out for a registry key in Monday’s newsletter that I’m hoping will keep Home systems from receiving “moment” updates.

  So? Got your backup running this weekend?

  Backup Patch Lady Posts

• MS-DEFCON 2: March Madness begins

  Posted on March 9, 2023 at 02:45 CST by Susan Bradley • Comment in the Forums

  

  ISSUE 20.10.1 • 2023-03-09

  

  By Susan Bradley

  Ready for Windows 11 dribbles?

  In addition to waiting for side effects of security patches to manifest themselves, sometimes you need to wait to see the impact of changes from the prior month’s preview updates. This month more than ever, you should to delay or defer to see the impact of the March changes for Windows 11 22H2.

  Accordingly, I am raising the MS-DEFCON level to 2.

  Anyone can read the full MS-DEFCON Alert (20.10.1, 2023-03-09).

  AskWoody Plus Alert, MS-DEFCON Alerts, MS-DEFCON, MS-DEFCON 2, Windows 11 22H2

• When you are flagged as malicious

  Posted on March 6, 2023 at 02:42 CST by Susan Bradley • Comment in the Forums

  ON SECURITY

  

  By Susan Bradley

  We rely too much on automated reporting in our security solutions.

  Most of the time, such automation works pretty well. When it doesn’t, the consequences can be quite damaging. We can think back to many times when antivirus updates accidentally flagged a file as malicious, and all sorts of fun ensued.

  Just recently, an update to Microsoft Defender interacted with Attack Surface Reduction rules and removed shortcuts on the desktop. If you were on Defender and had the “Block Win32 API calls from Office macro” Attack Surface Reduction rule in place, then updated to security intelligence builds between 1.381.2134.0 and 1.381.2163.0, you would find your icons missing. IT admins were scrambling for days to fix the resulting mess.

  Read the full story in our Plus Newsletter (20.10.0, 2023-03-06).

  On Security Abuse Reporting, false positive, Flagged websites, Newsletters, Patch Lady Posts, security

• Is your backup encrypted?

  Posted on March 4, 2023 at 23:10 CST by Susan Bradley • Comment in the Forums

  Just a reminder that if you are an iphone user, you can turn on Advanced Data Protection.  This enables end to end encryption on your iCloud backups so that you and only people you choose (and not attackers that gain access to your password) get access to your photos and data.

  Now that said… be aware of some limitations. If you have an older Mac computer you won’t be able to enable this.

  Also once you enable it, you’ll need to approve access when you log into icloud on the web.

  And THEN, make sure you document that encryption password and have various recovery methods to ensure should you need to get back in, you can. Therein lies the rub.  Only turn on encryption if you’ve ensured that you have documented how to recover.

  Requirements
  To turn on Advanced Data Protection for iCloud, you need:

  An Apple ID with two-factor authentication.
  A passcode or password set for your device.
  At least one account recovery contact or recovery key. If you don’t already have one, you’ll be guided to set one up when you turn on Advanced Data Protection.
  Updated software on all of the devices where you’re signed in with your Apple ID:
  iPhone with iOS 16.2 or later
  iPad with iPadOS 16.2 or later
  Mac with macOS 13.1 or later
  Apple Watch with watchOS 9.2 or later
  Apple TV with tvOS 16.2 or later
  HomePod with software version 16.0 or later
  Windows computer with iCloud for Windows 14.1 or later

  Apple Patch Lady Posts

• MS-DEFCON 4: Wrapping up a short month

  Posted on February 28, 2023 at 02:45 CST by Susan Bradley • Comment in the Forums

  

  ISSUE 20.09.1 • 2023-02-28

  

  By Susan Bradley

  February’s patches affected you either severely, or not at all.

  The good news: If you are a consumer, home user, or business that does not use Windows Server 2022 or any version of on-premises Exchange server, you will be just fine installing the updates at this time. Therefore, I am very comfortable with lowering the MS-DEFCON level to 4.

  However, if you are a business patcher with Windows Server 2022 hosted in VMware, you may have been significantly impacted. In addition, patch administrators are still dealing with the side effects of the Exchange updates.

  Anyone can read the full MS-DEFCON Alert (20.09.1, 2023-02-28).

  AskWoody Plus Alert, MS-DEFCON Alerts, Exchange Server, MS-DEFCON, MS-DEFCON 4, VMWare, Windows Server 2022, Windows Update, Windows Update block

• Being legal, supported, and secure

  Posted on February 27, 2023 at 02:43 CST by Susan Bradley • Comment in the Forums

  ON SECURITY

  

  By Susan Bradley

  Who regulates your software decisions?

  As an operating system comes to the end of its life span, we users have to decide what to do with our technology. Do we continue using it as is, with no consideration of risks? Do we stop using the technology and look for alternatives? Or do some of us do a combination of both?

  With proprietary software, our decisions are often driven by what type of customer we are.

  Read the full story in our Plus Newsletter (20.09.0, 2023-02-27).

  On Security Licensing, Newsletters, Patch Lady Posts, Risk, Software, updates
• « Older Entries