The mess behind Microsoft’s yanked UEFI patch KB 4524244

Credit to Author: Woody Leonhard| Date: Thu, 20 Feb 2020 06:23:00 -0800

Remember the warning about watching how sausage is made? This is an electronic sausage-making story with lots of dirty little bits.

First, the chronology. On February’s Patch Tuesday, Microsoft released a bizarre standalone security patch, KB 4524244, which was then called “Security update for Windows 10, version 1607, 1703, 1709, 1803, 1809, and 1903: Feb. 11, 2020.” The name has changed, but bear with me.

The original problems with KB 4524244

That patch had all sorts of weird hallmarks as I discussed at the time:

To read this article in full, please click here

Read more

Nearly half of hospital Windows systems still vulnerable to RDP bugs

Credit to Author: Danny Bradbury| Date: Thu, 20 Feb 2020 13:58:46 +0000

Almost half of connected hospital devices are still exposed to the wormable BlueKeep Windows flaw nearly a year after it was announced, according to a report released this week.<img src=”http://feeds.feedburner.com/~r/nakedsecurity/~4/wGhEwriWtkU” height=”1″ width=”1″ alt=””/>

Read more

Dump Windows 7 already! Jeez!

Credit to Author: Steven J. Vaughan-Nichols| Date: Tue, 18 Feb 2020 07:00:00 -0800

Why am I still writing about Windows 7? It’s dead, Jim! The tombstone reads, “June 22, 2009 – January 14, 2020.” It was a good run, but unless you’re shelling out some serious coin for Windows 7 Extended Security Updates (ESU), you shouldn’t be running Windows 7.

But many of you are. According to the best survey of who’s running what, the U.S. government’s Digital Analytics Program (DAP), on Feb. 14, weeks after Win7’s end of life, just over one in 20 of Windows users was still using Windows 7! Oh, come on! More than 5%! A dead and buried OS! Get with the program!

To read this article in full, please click here

Read more

Corp.com is up for sale – check your Active Directory settings!

Credit to Author: Danny Bradbury| Date: Fri, 14 Feb 2020 10:51:44 +0000

An old, dormant domain is going on sale – and the results could be catastrophic for enterprises with common Active Directory misconfigurations.<img src=”http://feeds.feedburner.com/~r/nakedsecurity/~4/eNE2lUuM6GI” height=”1″ width=”1″ alt=””/>

Read more

IE zero day and heap of RDP flaws fixed in February Patch Tuesday

Credit to Author: John E Dunn| Date: Thu, 13 Feb 2020 12:52:59 +0000

Microsoft has finally patched the Internet Explorer (IE) zero-day flaw the company said in January was being used in “limited targeted attacks”.<img src=”http://feeds.feedburner.com/~r/nakedsecurity/~4/JI_KRna6j1I” height=”1″ width=”1″ alt=””/>

Read more

Mozilla issues final warning to websites using TLS 1.0

Credit to Author: John E Dunn| Date: Wed, 12 Feb 2020 16:13:57 +0000

From March, the Firefox, Chrome, Safari and Edge browsers will show warnings when users visit websites that only support TLS versions 1.0 or 1.1.<img src=”http://feeds.feedburner.com/~r/nakedsecurity/~4/3oMQ9dp5jKA” height=”1″ width=”1″ alt=””/>

Read more

Thought you already paid for Win7 Extended Security Updates? Think again.

Credit to Author: Woody Leonhard| Date: Wed, 12 Feb 2020 05:43:00 -0800

I’m hearing lots of complaints from people who spent good money to get Win7 Extended Security Updates, but don’t see this month’s patches. There’s a reason why. Microsoft didn’t bother to tell us that you need a new patch, released yesterday, in order to start receiving Win7 ESU updates. You have to download the new patch, KB 4538483, from the Microsoft Catalog, and install it manually before the updates even appear.

Folks who spent money to get the February and later patches are livid. 

Yesterday, after releasing the February updates, Microsoft modified its ESU Procedure page to add this step:

To read this article in full, please click here

Read more

February, 2020 Patch Tuesday brings a century of updates to Microsoft, Adobe products

Credit to Author: SophosLabs Offensive Security| Date: Tue, 11 Feb 2020 20:50:22 +0000

For this second Patch Tuesday of 2020, Microsoft has released a hundred patches to Windows and other Microsoft software, including 12 vulnerabilities flagged as Critical, and 87 flagged as Important. In addition, Adobe also published updates for its Flash Player, Acrobat, Framemaker, Experience Manager, and Digital Editions products in notifications timed to coincide with Microsoft&#8217;s [&#8230;]<img src=”http://feeds.feedburner.com/~r/sophos/dgdY/~4/zpsWY9HeJhU” height=”1″ width=”1″ alt=””/>

Read more

For Patch Tuesday, verify you have 'Pause Updates' enabled

Credit to Author: Woody Leonhard| Date: Mon, 10 Feb 2020 12:13:00 -0800

Read more

Patch Tuesday’s tomorrow. Verify you have 'Pause Updates' enabled

Credit to Author: Woody Leonhard| Date: Mon, 10 Feb 2020 12:13:00 -0800

Read more