• JNP

    JNP

    @jnp

    Viewing 15 replies - 31 through 45 (of 47 total)
    Author
    Replies
    • Nearly all of this is correct, DEFCON being too complicated for most home users (I am a home user only), Group B being too complicated for most (I am in Group B), Canadian Tech’s points about how people de facto become Group A or Group W.

      But what is also true is Microsoft made it this way for no legitimate, helpful, real discernible reason.  Rather, this happened through indifference, or negligence that they failed to correct, or breaking things that they then couldn’t correct, like breaking WU with no way for the normal home user to figure out how to get WU back up and running, assuming they figured out WU had been broken by MS in the first place.  Sure, people like the people here figured out how to fix WU, and any home user, like myself, should be grateful for this, which I am, and for the education Ask Woody provides, which I am, but this should be what Microsoft should be doing.  And it isn’t.  This seems to be one of the few companies that can put out, or make, a product defective, and has no obligation, and quite possibly no way, to recall that product or make it work again.  How whack is that?

      Seriously, does MS need to survey its customers about bringing the old Security Bulletins back?  Of course not.  It was a valuable service to many, it was little, to no, skin off Microsoft’s back to provide this “SERVICE”.  And it would be little to no skin off Microsoft’s back to bring it back.  Using another company’s slogan: “Just Do It!”.  It’s call admitting a mistake and correcting it.

      2 users thanked author for this post.
    • Aside from the matter of telemetry, which is a consideration, in a sense what Woody just posted about Win10, and a Group B, illuminates why I decided to go with Group B and will continue to do so.  In the past year, or so, as we have all witnessed, Windows Update has been a mess.  Bad files, bogus drivers, etc.  Windows is presently, uncertain, unclear, unreliable, directionless, etc. when it comes to updating, whether it be Win 7, Win 8.1 and even Win 10.  Until the dust settles, assuming a fact not in evidence (as we say in the legal field), a less is more approach seems advisable with updates; hence Group B.  My system is stable, I possess several layers of third party security programs.  So, keep it simple, varied, and less Microsoft (like don’t use Microsoft Word or IE unless you have to) seems to be a safer, more stable approach.

      As something of an aside, but illustrative, for the past month or so, WU has been pushing, at least to me, Silverlight.  I keep hiding it, WU keeps pushing it back at me.  This is new behavior.  I have no definitive answer as to why this is happening but, as the trust level is so low right now with Microsoft, I see no compelling reason to install this optional plug-in.

       

      4 users thanked author for this post.
    • Many thanks, once again. Funny you should mention WinPatrol, I do use it, but allowed SD to make the changes, so SD did what it should do when I ran a test.vbs file.

      Also for everybody, there does not appear to be a Protected View option for versions of Word before Word 2010: https://support.office.com/en-us/article/What-is-Protected-View-d6f09ac7-e6b9-4495-8e43-2bbcdbcb6653 .

      1 user thanked author for this post.
    • Yes, thanks so much. A test.vbs file does launch Script Defender (SD), but, as you are assuming a fact not in evidence, I am not a dummy :), if SD indicates there is a script, one either bugs out of the Word file or one aborts running the VBS when prompted by SD, right? Once again, thanks.

    • Thanks for the reply, I’ve installed Scripts Defender, everybody if you do this, read the install notes because there is a certain thing one has to do to properly remove SD.  Here’s my question: Do I have to put SD in the Windows Startup folder and keep it running for full protection?  I imagine I could also just launch it when I receive a Word Document as well.  Again, thanks.

      1 user thanked author for this post.
    • The FireEye post contains this sentence: “The attack involves a threat actor emailing a Microsoft Word document to a targeted user with an embedded OLE2link object. When the user opens the document, winword.exe issues a HTTP request to a remote server to retrieve a malicious .hta file, which appears as a fake RTF file.”  Does this mean that if one opens a Word file not in MS Word, programs such as WordPerfect or Open Office, the malicious code will not execute?

    • in reply to: More problems with the March IE Security-only patches #105879

      Woody,

      Win7 SP1-64 bits, Group B.  Both kb4016446 and kb4012204 installed.  Ran SSL Qualys.  Full results:
      SSL/TLS Capabilities of Your Browser

      User Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; MDDCJS; rv:11.0) like Gecko

      Other User Agents »

      Protocol Support

      Your user agent has good protocol support.

      Your user agent supports TLS 1.2, which is recommended protocol version at the moment.

      Logjam Vulnerability
      Your user agent is not vulnerable.

      For more information about the Logjam attack, please go to weakdh.org.
      To test manually, click here. Your user agent is not vulnerable if it fails to connect to the site.

      FREAK Vulnerability
      Your user agent is not vulnerable.

      For more information about the FREAK attack, please go to http://www.freakattack.com.
      To test manually, click here. Your user agent is not vulnerable if it fails to connect to the site.

      POODLE Vulnerability
      Your user agent is not vulnerable.

      For more information about the POODLE attack, please read this blog post.

      Protocol Features

      Protocols

      TLS 1.3  No
      TLS 1.2 Yes
      TLS 1.1 Yes
      TLS 1.0 Yes
      SSL 3 No
      SSL 2 No

      Cipher Suites (in order of preference)

      TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384 (0xc028)   Forward Secrecy  256
      TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256 (0xc027)   Forward Secrecy  128
      TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA (0xc014)   Forward Secrecy  256
      TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA (0xc013)   Forward Secrecy  128
      TLS_DHE_RSA_WITH_AES_256_GCM_SHA384 (0x9f)   Forward Secrecy  256
      TLS_DHE_RSA_WITH_AES_128_GCM_SHA256 (0x9e)   Forward Secrecy  128
      TLS_DHE_RSA_WITH_AES_256_CBC_SHA (0x39)   Forward Secrecy  256
      TLS_DHE_RSA_WITH_AES_128_CBC_SHA (0x33)   Forward Secrecy  128
      TLS_RSA_WITH_AES_256_GCM_SHA384 (0x9d)  256
      TLS_RSA_WITH_AES_128_GCM_SHA256 (0x9c)  128
      TLS_RSA_WITH_AES_256_CBC_SHA256 (0x3d)  256
      TLS_RSA_WITH_AES_128_CBC_SHA256 (0x3c)  128
      TLS_RSA_WITH_AES_256_CBC_SHA (0x35)  256
      TLS_RSA_WITH_AES_128_CBC_SHA (0x2f)  128
      TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384 (0xc02c)   Forward Secrecy  256
      TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256 (0xc02b)   Forward Secrecy  128
      TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384 (0xc024)   Forward Secrecy  256
      TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256 (0xc023)   Forward Secrecy  128
      TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA (0xc00a)   Forward Secrecy  256
      TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA (0xc009)   Forward Secrecy  128
      TLS_DHE_DSS_WITH_AES_256_CBC_SHA256 (0x6a)   Forward Secrecy2  256
      TLS_DHE_DSS_WITH_AES_128_CBC_SHA256 (0x40)   Forward Secrecy2  128
      TLS_DHE_DSS_WITH_AES_256_CBC_SHA (0x38)   Forward Secrecy2  256
      TLS_DHE_DSS_WITH_AES_128_CBC_SHA (0x32)   Forward Secrecy2  128
      TLS_RSA_WITH_3DES_EDE_CBC_SHA (0xa)  112
      TLS_DHE_DSS_WITH_3DES_EDE_CBC_SHA (0x13)   Forward Secrecy2  112
      (1) When a browser supports SSL 2, its SSL 2-only suites are shown only on the very first connection to this site. To see the suites, close all browser windows, then open this exact page directly. Don’t refresh.
      (2) Cannot be used for Forward Secrecy because they require DSA keys, which are effectively limited to 1024 bits.

      Protocol Details

      Server Name Indication (SNI) Yes
      Secure Renegotiation Yes
      TLS compression No
      Session tickets No
      OCSP stapling Yes
      Signature algorithms SHA512/RSA, SHA512/ECDSA, SHA256/RSA, SHA384/RSA, SHA1/RSA, SHA256/ECDSA, SHA384/ECDSA, SHA1/ECDSA, SHA1/DSA
      Elliptic curves secp256r1, secp384r1
      Next Protocol Negotiation No
      Application Layer Protocol Negotiation No
      SSL 2 handshake compatibility No

      Mixed Content Handling

      Mixed Content Tests

      Images Passive Yes
      CSS Active No
      Scripts Active No
      XMLHttpRequest Active No
      WebSockets Active No
      Frames Active No
      (1) These tests might cause a mixed content warning in your browser. That’s expected.
      (2) If you see a failed test, try to reload the page. If the error persists, please get in touch.

      Related Functionality

      Upgrade Insecure Requests request header (more info) No

    • in reply to: Patch Tuesday just hit #101204

      For those running Windows XP, in LTSB mode, there exist a number of security updates this month as well.

    • in reply to: Flash player patch rolls out in a strange way #96409

      Woody, recheck the KB number you are using. My search of MS Update Cat. renders KB4010250. I think you missed the second zero.

      1 user thanked author for this post.
    • in reply to: The latest on disabling Flash #95843

      Noel, thanks for doing the digging, which is way beyond my skill level.

      So, once again, we are back at the topic of Microsoft’s constant attempts to bundle things that are not strictly a part of the core OS. Bundle the patches so we really don’t know what’s going on and can’t choose which things to install, other than going Group A, Group B. Then, we have the Grand Theory Of Bundling, which we’ve covered before, and has been found, previously, to possess legal problems. The absences of the Flash patch is an example of this, as was MS attempt to bundle IE back in the 90’s. Yet, MS continues to go down this path and is now bundling more than ever before.

      I understand why MS is doing this from a business model approach, although it is highly questionable whether it will succeed. The paradox is that if MS does succeed, arguably the consumer will be worse off and, if MS fails, the consumer will likely be better off, with more options and less expense to keep up with the constantly changing Win 10 model. Most of us initially migrated to the MS/Intel model, as opposed to the Apple model, to have greater flexibility, both hardware and software, and less cost, than with an Apple product. If Win 10 succeeds, it is likely the two basic reasons we purchased into the MS/Intel model in the first place will no longer be valid. Then it will become more of a direct shootout between MS Win 10 and a comparable Apple product. I don’t see this ending well for MS.

      1 user thanked author for this post.
    • in reply to: The latest on disabling Flash #95681

      Unless somebody else has already made this point very directly, I think we are missing the forest for the trees here. Flash is a third-party program/app, which MS has chosen, perhaps with Adobe’s permission, to bundle security updates to Flash, for Win 8.1 and Win 10, in the updates for IE and Edge. However, what this has done is it has made it completely impossible for the individual user to properly secure his or her own computer upon release by a third-party vendor of a security update. So, what we have is Adobe saying version 24.0.0.221 of Flash is ready to be, and should be, installed, http://www.adobe.com/software/flash/about/ , but MS is blocking this for Win 8.1 and Win 10 users. We shouldn’t be talking about how to disable Flash at all, but thanks, Noel, for telling us how. The good news is this: Send the bill to Redmond when you get infected with Flash malware ?.

      1 user thanked author for this post.
    • in reply to: The latest on disabling Flash #95658

      Noel, I am sure you are right, but if MS can re-re-re-re-release KB2952664, which was solely for the benefit MS late last month, it most certainly can issue a dedicate IE/Edge KB to secure Flash. It is simply a matter of caring about doing the right thing for your customers.

    • in reply to: The latest on disabling Flash #95585

      This, and Woody’s post on “Another Windows 0day appears”, once again highlights the poor judgment of MS by going to the “one patch” program back in, what was it October. For those with Win 8.1 and Win 10, especially the most vulnerable home users who are unaware of the issues and potential problems with Flash, they now have absolutely no option but to continue to use a less secure version of Flash. Additionally, unless we assume there was only one security fix planned for February, across all Windows operating systems, we are all being denied security fixes because one, maybe two, maybe three, things didn’t pan-out in the bundled February update. MS can write all it wants about Win 10 being the most secure version of Windows yet and, even if I accept this, I don’t think a valid claim can be made that their “one patch” program properly supports that goal. There’s nothing wrong with going back to what worked better, remember “New Coke”. Perhaps MS will take a lesson away from what has transpired this month.

      4 users thanked author for this post.
    • in reply to: February’s patch Tuesday will be in March #94598

      So, we’re in Jimi Hendrixland: “If 6 was 9”: https://www.youtube.com/watch?v=vZuFq4CfRR8 ?. Seriously, as others have written, after all the bad updates, it’s refreshing to see MS pull pack and a try to be more careful.

      1 user thanked author for this post.
    • Kirsty, I don’t know if there is a formal way to backup the config. but what you can certainly do is go into the Mozilla/Firefox Profiles folder, make a copy of your profile and then, if things go off, you can simple use this “copy” to go back to your previous state.

      9 users thanked author for this post.
    Viewing 15 replies - 31 through 45 (of 47 total)