A First Look at the New Microsoft Surface Go

Browser Bugs In the Spotlight For July Patch Tuesday

Sixteen fixes for browsers should be prioritized.

Microsoft released 53 security patches for July, including 18 listed as Critical, 33 as Important, one rated as Moderate, and one considered Low in priority. According to researchers at SANS, three of these vulnerabilities have already been disclosed, but no exploits have been seen yet. The releases impact Internet Explorer (IE), Edge, ChakraCore, Windows, .NET Framework, ASP.NET, PowerShell, Visual Studio, and Microsoft Office and Office Services.

Here are highlights from this month’s release with the information you need to prioritize your patching efforts.

16 Browser Vulnerabilities

Of the more pressing concerns this month, Qualys director of product management, Jimmy Graham says admins should focus on the 16 common vulnerabilities and exposures (CVEs) covering browsers.

“The 16 CVEs covering browsers should be prioritized for workstation type devices, meaning any system where users are commonly accessing the public internet through a browser or checking email. This includes multi-user servers that are used as remote desktops for users.”

The most severe of the browser vulnerabilities are four Chakra scripting engine memory corruption vulnerabilities. You’ll want to install CVE-2018-8280, CVE-2018-8286, CVE-2018-8290, CVE-2018-8294.

CVE-2018-8306 – Microsoft Wireless Display Adapter Command Injection Vulnerability

Dustin Childs of the Zero Day Initiative says this patch will likely be very labor intensive to deploy.

“This vulnerability requires authentication and could cause the display to malfunction. While the bug itself isn’t that bad, the update scenario sounds taxing,” he notes in his blog post on this month’s roundup. “The patch is a firmware update. To get the new firmware, it has to be downloaded from the Wireless Display Adapter App available in the Microsoft App Store. That doesn’t sound like something easily automated.”

We recommend setting aside time to work through this one.

CVE-2018-8304 – Windows DNSAPI Denial of Service Vulnerability

A denial of service vulnerability exists in Windows Domain Name System (DNS) DNSAPI.dll when it fails to properly handle DNS responses.

“This bug could allow remote attackers to shut down a DNS server through merely a malformed DNS response,” says Childs “Again, that’s better than code execution, but it’s never good when an adversary can remotely shut down a part of your critical infrastructure.”

Adobe Patches

Adobe also released four patches that address 112 vulnerabilities in Flash, Adobe Reader, Experience Manager, and Adobe Connect.

Of these, Childs notes the Acrobat fix is a monster.

“The Acrobat patch is enormous, with 107 CVEs being addressed in whole. A total of 68 of these CVEs came through the ZDI program. With so many issues being fixed, it’s hard to pull out any specific ones to highlight. The types of bugs fixed by this patch include out-of-bounds reads, out-of-bounds writes, heap overflows, type confusions, and use-after-frees.  The worst of these could allow an attacker’s code to execute by opening a malicious PDF. While it’s good to see Adobe address so many issues at once, it’s a bit troubling that Adobe needs to address so many bugs at once.”

The Flash Player is getting an update that eliminates two security holes, one allowing remote code execution. Adobe Connect had three different security holes which allowed hostile hackers to take advantage of authentication bypass, and three server side request forgery bugs were patched in the Adobe Experience Manager.

*

You can find all of the updates at the Microsoft portal.

A First Look at the New Microsoft Surface Go

Hello everyone! I am taking a slightly different approach this week and not answering a question but talking about an event that happened this week — the introduction of the Microsoft Surface Go. The 10-inch tablet has a surprisingly low entry-level price of $399 – and that is before adding any accessories like a keyboard, pen and mouse.

As a 10-inch tablet with full touch and inking support, it could be a very comfortable second screen for consumption, social media and light email, not unlike the capabilities inherent in the Apple iPad.

Surface Go (Via Microsoft)

This device is going to help grow the Surface brand because it is the first time Windows-oriented consumers can pick up a branded device at this price level. (Apple’s had a low-cost iPad since March 2018.) Even the high-end Surface Go, which based on its specs would be the performance buy, is listed at $549. For what it offers — and the ease with which it moves between light entertainment and serious productivity, thanks to the full Office 365 suite of software — that’s a great bargain.

Let’s look at those specs for these two Surface Go models. As you can see, many of the specs are going to be the same whether you buy an entry-level model or a higher-end one.

The differentiators come down to the RAM and storage options. The lower-priced device has 4 GB of RAM and 64 GB of storage, while the performance device has 8 GB of RAM and 128 GB of storage.

A few notes to go along with the specs:

• A Surface Go model with LTE connectivity will be released later this year. I suspect it will have the performance specs to go along with the cellular access. No word on pricing.
• The Windows 10 Home in S Mode can be switched to regular Windows 10 Home by the user at no cost.
• Commercial customers can purchase Windows 10 Pro for an additional cost of $50.
• Expect that battery life to be shorter in everyday use.
• Microsoft is offering discounts for eligible students, parents, teachers and members of the military. That results in about $20 off the entry-level device and around $28 on the performance model.
• Pre-orders for Surface Go are already open for the device and the accessories.

Speaking of accessories, since Surface Go is a new form factor at just 10 inches, that means it needs a new keyboard and cover. The Surface Go Signature Type Cover comes in plain black for $99.99 and in Alcantara for $129.99 with Burgundy, Platinum, and Cobalt Blue options.

Surface Go and Accessories (Via Microsoft)

A new mouse has also been released alongside of Surface Go. The Surface Mobile Mouse is $34.99 and comes in matching colors with the Alcantara versions of the Type Cover – Burgundy, Platinum and Cobalt Blue. Note: This is just a Bluetooth mouse, so it can be used with any compatible PC that has Bluetooth 4.0 or higher.

Of course, Surface Pen is already available at $99.99 and is available in the full Surface color spectrum of Black, Burgundy, Platinum and Cobalt Blue.

As you can see, once you begin adding accessories, the price of Surface Go moves up the charts quickly. In fact, my math says that if you buy all of them you will be looking to add anywhere between $234 to $264 to the entire purchase.

Whatever configuration you might choose, I think the Surface Go provides a gateway into the Surface brand that has never existed before. It is going to be interesting to watch the adoption of this product over the next few months.