Credit to Author: Woody Leonhard| Date: Mon, 10 Feb 2020 12:13:00 -0800
Remember the frenzy after last month’s Patch Tuesday? How everybody and his twice-removed cousin — even the N forkin’ SA — told you to get patched immediately because of this big, spooky Crypto API security hole that was supposed to bring down Windows As We Know It, like, right now?
Guess what. It never materialized.
Credit to Author: Viraj Talikotkar| Date: Sat, 08 Feb 2020 09:45:00 +0000
In the last two days, we have received reports from Windows 7 users who have been unable to shut down or restart their PC and ran into the below error. While the exact cause of the issue is yet to be ascertained there is no official confirmation from Microsoft yet….
Read more
Credit to Author: Woody Leonhard| Date: Wed, 05 Feb 2020 04:42:00 -0800
Worried about the future of your Win7 machine? Welcome to the family.
Right now, we have a promise that Microsoft will fix the “Stretch” wallpaper bug it rolled out last month, and there’s some hope that it will fix the Internet Explorer JScript engine security hole CVE-2020-0674 noted last month in Security Advisory ADV200001. We don’t know how/when the fix(es) will be distributed, or if Microsoft will soften its “no free Win7 patches after January 14” edict in some other way.
Credit to Author: Preston Gralla| Date: Tue, 04 Feb 2020 03:00:00 -0800
It’s no secret that hackers the world over target Windows vulnerabilities in order to wreak havoc, hold up data and networks for ransom, pull off money-making scams, and disrupt elections and the workings of democracy. They target Windows for a simple reason: volume. The operating system is on the vast majority of desktop and laptop computers worldwide.
Over the years, the U.S. National Security Agency (NSA) has unwittingly helped hackers in some of the world’s most dangerous and notoriously successful attacks by developing tools to exploit Windows security holes, rather than alert Microsoft to those vulnerabilities. Some of the tools have been leaked to hackers and used in massive attacks, including the EternalBlue cyber-exploit, which was used in the WannaCry global ransomware attack that affected computers in more than 150 countries and is estimated to have caused billions of dollars in damage.
Credit to Author: Woody Leonhard| Date: Thu, 30 Jan 2020 10:14:00 -0800
Time and again we see the same drama play out. Microsoft releases a security patch and scary warnings appear from every corner. When your local news broadcast tells you that you better patch Windows right now…, more temperate advice should prevail.
A little over two weeks ago, on Patch Tuesday, Microsoft released a patch for a security hole known as CVE-2020-0601 – the Crypt32.dll vulnerability also called ChainOfFools or CurveBall.
Credit to Author: Woody Leonhard| Date: Fri, 24 Jan 2020 13:27:00 -0800
This month has seen a whole lotta hand waving and sky-is-falling-caliber rhetoric, but the reality is much more prosaic. If you aren’t running a major network (and thus aren’t susceptible to the imminent problems with Remote Desktop Gateway, the Citrix network bugs or the whopping 334 patches in Oracle), there’s been little reason to install this month’s updates.
Credit to Author: Woody Leonhard| Date: Thu, 23 Jan 2020 07:17:00 -0800
The big patching problems this month fell at the feet of admins who had to deal with an unholy mess of pressing exposures: Fixing the holes in Microsoft’s RD Gateway (CVE-2020-0610; see Susan Bradley’s Patch Watch, paywalled); dealing with Server 2008 R2 systems that booted to Recovery mode after installing the January patches; scrambling to pick up after breaches in Citrix networking products; or the 334 Oracle security patches. They all took a toll.
Credit to Author: Woody Leonhard| Date: Tue, 21 Jan 2020 08:03:00 -0800
Hey, admins! It’s been an exciting week, eh?
Most of you have been inundated with requests — demands — that you patch all of your systems immediately to protect them from the highly publicized CVE-2020-0601 Crypt32.dll security hole, known as “Chain Of Fools” or “CurveBall.”
While you were scrambling to comply with the NSA’s unique advertising, abetted by almost every security expert on the planet, a funny thing happened. There are no in-the-wild exploits for the ol’ CurveBall. But there are lots and lots of Citrix ADC and Citrix Gateway systems under attack, using a security hole announced in December called CVE-2019-19781.
Credit to Author: Woody Leonhard| Date: Fri, 17 Jan 2020 06:42:00 -0800
If you want to install the January Patch Tuesday patches, by all means, go right ahead. That said, I continue to recommend that you hold off installing the January Microsoft patches until we get a clearer reading on potential bugs.
The pro-patch-now argument generally goes something like this: Everybody is recommending that you install the patches to protect against the Crypto bug — almost all of the major security folks, the researchers, the big online sites, your local news station, your congresscritter, your neighbor’s nine-year-old, even the bleeping NSA. It’s a little patch. Why not just install it and be done with it?
Credit to Author: Paul Ducklin| Date: Thu, 16 Jan 2020 17:42:09 +0000
We said, “Assume that someone will find out how to do it pretty soon,” and that’s exactly what happened.<img src=”http://feeds.feedburner.com/~r/nakedsecurity/~4/XhJpjHyVCqc” height=”1″ width=”1″ alt=””/>
Read more