|
Patch reliability is unclear, but widespread attacks make patching prudent. Go ahead and patch, but watch out for potential problems. |
It’s that time of the month again that we wait on news of update side effects. It’s my philosophy that you shouldn’t rush into anything and patching (
[See the full post at: February 2022 Patch Tuesday early reports]
Susan Bradley Patch Lady/Prudent patcher
AKB 2000003 has been updated for Group B Win7 (ESU) and Win8.1 on Feb 8, 2022.
There is a Security-only Update for those with Win7 ESU subscriptions.
There was no Feb. IE11 CU for Win7.
February Rollup KB5010404 Download 32-bit or 64-bit for those with Win7 ESU subscriptions.
You must have at least the August 2020 Servicing Stack KB4570673 previously installed to receive these updates).
There is a February 2022 Servicing Stack KB5010451– Download 32-bit or 64-bit for those with Win7 ESU subscriptions.
There is a revised Licensing Preparation Package KB4575903 dated 7/29/2020 for Win7 ESU subscriptions, if you need it.
There are .NET updates listed for Win7. See #2424003.
2022-02 .NET 5.0.14 Security Update for x64 Client (KB5011093)
2022-02 .NET 6.0.2 Security Update for x64 Client (KB5011094)
2022-02 Cumulative Update for Windows 11 for x64-based Systems (KB5010386)
Installed with no problems on Win11 Pro.
--Joe
.NET update 2-8 for Windows 8.1 installed with no problems. It seemed to install faster than normal.
I will wait to install the security-only 2-8 update for Windows 8.1.
KB5010395 Windows 8.1 64bit installed OK. Feb.14 2022.
It takes time/energy/targeting. Multi factor means the bad guys go after someone else without it. Multi factor still has value. Seriously. When only 22% of Azure admins use it (if I remember my stats correctly) the attackers will go after the 80 someodd percent that don’t as the easier target.
Susan Bradley Patch Lady/Prudent patcher
I’m also referring to authentication apps on your phone. While I know that certain people ARE targeted, the vast majority of us do not have attackers cloning our SIM chips. Just because something is theoretically possible doesn’t mean that someone actually does it.
Attackers go after low hanging fruit: reuse of the same password on multiple web sites. If a two factor/multi factor slows them down they are on to the next victim.
Here at askwoody.com we are realists, not conspiracy theorists.
Susan Bradley Patch Lady/Prudent patcher
Installed Windows Malicious Software Removal Tool x64 – v5.98 (KB890830) this morning on Win11 Pro.
--Joe
No problems here.
21H2? Do you remember exactly what got installed? Would you mind a bit more detail as I’m not seeing anything here in my early testbeds.
Susan Bradley Patch Lady/Prudent patcher
I still get the Out-of-band Update KB5010798 as an optional Update offered, although the latest rollup KB5010404 (which includes the Ofb) has been installed.
Does anyone else have this “problem”?
Yes, they did not add supersedence metadata for it yet
While it is too late to prevent the updates completing, it isn’t too late to take a backup. An image backup will however back up your system still pending updates, so a full restore would get you back to your current situation, but as your restored system boots, it will complete the updates.
So, first take a backup, then allow the updates to complete. If they prove to be a problem, you can probably uninstall them (problem updates don’t usually prevent that.) If that doesn’t produce a working system, go back to a previous backup, restore that, then restore your important files from the latest backup.
The catalog has ‘Windows 10’ in the name for KB5009467, as well as Windows 10 LTSB. Same goes for CU KB5010342. See attachments.
any suggestions on how I can prevent potential damage?
You can clear the updates and defer again.
See https://www.askwoody.com/forums/topic/how-to-delete-driver-updates-downloaded-by-windows-update-but-not-installed/
This is alarmist nonsense. You’d have to be specifically physically targeted. Hate to break it to you, nobody is following you around trying to clone your MFA.
When I was out of work, I was hired to ride the train with a small device to get sim cards info. I was paid $100 per hour plus the cost of train tickets for two weeks but no more than 4 hours since the device had battery that lasted only about 5 hours. If the device captured more than 400 numbers, I would get a $50 per ever 100. On busy days, I got over 800 numbers. Some days that were slow only got 200. The group that hired me did not care whose phone they got. I need the money to buy food. I know that this exists.
We’re not saying it doesn’t exist. But it also takes time and effort to go after each one of those numbers. In addition for many on this site they aren’t riding trains every day.
Especially in California where I live our train service is not great. So set the risk of these type of attacks based on where you are and what you do. The risk of SIM attacks is not the same across the world.
And I hope you find a better way to earn money as it puts you at risk as well.
Susan Bradley Patch Lady/Prudent patcher
The anonymous poster point to something that existing in the world.
Read these for more info:
FBI alert backs up Microsoft’s call to avoid using phone numbers for two-factor authentication.
T-Mobile confirms SIM swapping attacks led to breach
SIM swap horror story: I’ve lost decades of data and Google won’t lift a finger
Currently Win 10 v21H2 Build 19044.1466 (i.e., have not installed Feb 2022 KB5010342 / OS Build 19044.1526) and use Microsoft Defender as my AV.
I have a question regarding Sergiu Gatlan’s 10-Feb-2022 Microsoft Fixes Defender Flaw Letting Hackers Bypass Antivirus Scans. That article suggests this vulnerability was “silently” patched by the Feb 2022 Patch Tuesday updates, but I noticed my Windows Update history shows my antimalware platform (client) was updated to v4.18.2201.10 on 10-Feb-2022.
Does anyone know if the latest antimalware platform v4.18.2201.10 will patch this vulnerability if the Feb 2022 Patch Tuesday updates haven’t been applied? I checked the release notes for the latest January-2022 | Platform: 4.18.2201.10 | Engine: 1.1.18900.2 (rel. 09-Feb-2022) update at https://docs.microsoft.com/en-us/microsoft-365/security/defender-endpoint/manage-updates-baselines-microsoft-defender-antivirus?view=o365-worldwide#monthly-platform-and-engine-versions but the What’s New section only mentions a vague “Tamper protection improvements“.
———–
Dell Inspiron 5584 * 64-bit Win 10 Pro v21H2 build 19044.1466 * Firefox v97.0.0 * Microsoft Defender v4.18.2201.10-1.1.18900.3 * Malwarebytes Premium v4.5.2.157-1.0.1562
Does anyone know if the latest antimalware platform v4.18.2201.10 will patch this vulnerability if the Feb 2022 Patch Tuesday updates haven’t been applied?
Extremely likely in my opinion:
On the other hand, Will Dormann, a vulnerability analyst for CERT/CC, noted that he received the permissions change without installing any updates, indicating that the change could be added by both Windows updates and Microsoft Defender security intelligence updates.
Does anyone know if the latest antimalware platform v4.18.2201.10 will patch this vulnerability if the Feb 2022 Patch Tuesday updates haven’t been applied?
Hi Alex5723 / b:
There seemed to be conflicting opinions in the articles you referenced as to which “silent” update fixes this MS Defender vulnerability, so I ran my own test and found that my MS Defender antimalware platform (client) update to v4.18.2201.10 on 10-Feb-2022 didn’t patch this MS Defender vulnerability – at least not by itself. The fix was not applied until I installed my Feb 2022 Patch Tuesday updates.
To test I created a new local user account with standard permissions called StandardTester, and when I signed in with this account on 13-Feb-2022 (Win 10 Pro v21H2 build 19044.1466 / MS Defender v4.18.2201.10-1.1.18900.3) I was still able to view my scan exclusions for Malwarebytes Premium at Settings | Update & Security | Windows Security | Virus & Threat Protection | Virus & Threat Protection Settings | Manage Settings | Exclusions; entering reg query “HKLM\Software\Microsoft\Windows Defender\Exclusions” /s in a command prompt as suggested in one of those articles also displayed my scan exclusions.
I then installed my February Patch Tuesday updates on 14-Feb-2022 and signed in with the same StandardTester account (Win 10 Pro v21H2 build 19044.15266 / still MS Defender v4.18.2201.10-1.1.18900.3) and I now see the expected message “You don’t have proper permissions to view this page” at Settings | Update & Security | Windows Security | Virus & Threat Protection | Virus & Threat Protection Settings | Manage Settings | Exclusions (*** see note below); entering reg query “HKLM\Software\Microsoft\Windows Defender\Exclusions” /s in a command prompt now reports “ERROR: Access is denied“.
I can view and add/remove scan exclusions without any restrictions in my MS Defender settings and view those exclusions from a command prompt as long as I am signed in with a user account that has Administrator rights.
*** Note that when I’m signed in as StandardTester with standard user permissions and try to view my Exclusions in my MS Defender settings, I now see a prompt that gives me the option of entering the username and password of the Administrator account on my laptop. If I choose to do this I am given temporary access to my Exclusion list and I can view and add/remove exclusions while I’m still signed in as StandardTester.
———-
Dell Inspiron 5584 * 64-bit Win 10 Pro v21H2 build 19044.1526 * Firefox v97.0.0 * Microsoft Defender v4.18.2201.10-1.1.18900.3 * Malwarebytes Premium v4.5.2.157-1.0.1562
Windows 7 SP1 Pro x64. I normally wait for Defcon 3 or better to apply the patches, but wanted to try out abbodi86’s W7ESUI and dotNetFx4_ESU installers. Using these (highly appreciated!) installers and instructions, I successfully installed the Feb rollup (KB5010404), Feb SSU (KB5010451) and Feb dotNet 4.8 rollup (KB5010457). Used Windows Update to install the MSRT. This was all done several days ago, and I haven’t experienced any problems.
Donations from Plus members keep this site going. You can identify the people who support AskWoody by the Plus badge on their avatars.
AskWoody Plus members not only get access to all of the contents of this site -- including Susan Bradley's frequently updated Patch Watch listing -- they also receive weekly AskWoody Plus Newsletters (formerly Windows Secrets Newsletter) and AskWoody Plus Alerts, emails when there are important breaking developments.
