Show Posts

This section allows you to view all posts made by this member. Note that you can only see posts made in areas you currently have access to.


Topics - Corrine

Pages: [1] 2 3
1
Best Security Practices / Servicing Stack Updates (SSU)
« on: August 02, 2019, 05:56:42 pm »
Servicing Stack Updates (SSU) seem to cause a lot of confusion.  Users see posts mentioning a SSU update but when viewing Update History, only the latest Cumulative Update is listed.  So, what is the Servicing Stack and why are the updates important?

What is the Servicing Stack?

Simply stated, the Servicing Stack is what actually installs Windows Updates.  However, it also contains the "component-based servicing stack" (CBS).  The CBS is key to DISM, SFC, as well as changing Windows features or roles, and repairing components.

Why are the SSU Updates Important?

The Microsoft Docs article referenced below explains the importance of SSU's as follows:

Quote
"Servicing stack updates improve the reliability of the update process to mitigate potential issues while installing the latest quality updates and feature updates. If you don't install the latest servicing stack update, there's a risk that your device can't be updated with the latest Microsoft security fixes."

As an example of a SSU update, following are the issues addressed in the July 26, 2019 Servicing Stack Update for Windows 10, 1903 x64-based Systems:
  • Addresses an issue in which an update may not install with certain other updates and upon start up after installation of the other updates, will require a second scan of Windows Update and a second restart to complete installation.
  • Addresses an issue in which reserved disk space may not be returned to free space when installation of Language Packs or Features on Demand (FODs) fails or is canceled.  The disk space is returned to free space when Storage Sense is run.
  • Addresses an issue when Windows Update Check for updates is run during the installation or uninstallation of an update, Features on Demand (FODs) or Language packs, which may cause the installation to fail and may cause a restart to take up to an hour.
Getting the SSU:

When there is a Servicing Stack Update released with security or cumulative updates, the updates are automatically installed with Windows Update (you won't see the SSU offered in the list of updates available).  Because each Servicing Stack Update replaces the complete "stack" they do not require a restart.

If you are unsure whether you have the latest Servicing Stack Updates installed, the list of SSU's is at https://portal.msrc.microsoft.com/en-us/security-guidance/advisory/ADV990001.  Locate the update for your operating system.  Clicking the KB number will take you to the update, which includes the date of the last update.  You can now find the date of the last update on your device in the link to "View installed updates" located in Programs and Features of the Control Panel.

References:

2
Quote
Windows Defender Antivirus has hit a new milestone: the built-in antivirus capabilities on Windows can now run within a sandbox. With this new development, Windows Defender Antivirus becomes the first complete antivirus solution to have this capability and continues to lead the industry in raising the bar for security.

Putting Windows Defender Antivirus in a restrictive process execution environment is a direct result of feedback that we received from the security industry and the research community. It was a complex undertaking: we had to carefully study the implications of such an enhancement on performance and functionality. More importantly, we had to identify high-risk areas and make sure that sandboxing did not adversely affect the level of security we have been providing.

While it was a tall order, we knew it was the right investment and the next step in our innovation journey. It is available to Windows Insiders today. We encourage researchers and partners to try and examine this feature and give us feedback, so we can fine-tune performance, functionality, and security before we make it broadly available.

More at Windows Defender Antivirus can now run in a sandbox.

3
Updates Talk / Windows 10 October 2018 Update Released
« on: October 02, 2018, 11:19:36 pm »
The October 2018 Update has been released.  Note, however that it is in a phased and controlled rollout. 

Quote
While we encourage you to wait until the update is offered to your device, if you’re an advanced user on an actively serviced version of Windows 10 and would like to install the Windows 10 October 2018 Update now, you can do so by manually checking for updates. In the Search box in the taskbar, type “Check for updates.” Once there, simply click “Check for updates” to begin the download and installation process. We are also streamlining the ability for users who seek to manually check for updates by limiting this to devices with no known key blocking issues, based on our ML model.  If we detect that your device has a compatibility issue, we will not install the update until that issue is resolved, even if you “Check for updates.”  You can also watch this video that outlines how to get the October 2018 Update.

See How to get the Windows 10 October 2018 Update - Windows Experience Blog for additional information about the update, including "Improving the update experience".

4
I guess we know now why Google dropped the "Don't Be Evil" motto.

Quote
Over a week after Google admitted the company tracks users' location even after they disable location history, it has now been revealed that the tech giant has signed a secret deal with Mastercard that allows it to track what users buy offline.

Google has paid Mastercard millions of dollars in exchange to access this information.

Full story at Google Secretly Tracks What You Buy Offline Using Mastercard Data

5
Quote
This week users of Avast's antivirus product have reported Internet problems after performing an upgrade of a product. If users also have Malwarebytes installed, reports are coming in that Avast is causing conflicts with that program as well.

See the complete article at BC, Avast Users Having Internet Issues & Malwarebytes Conflicts After Upgrade.

6
Windows / How to upgrade from Windows 10 Home to Pro for free
« on: May 29, 2018, 08:56:30 pm »
How to upgrade from Windows 10 Home to Pro for free | ZDNet
Quote
You've got a new PC running Windows 10 Home. You want to upgrade to Windows 10 Pro. Here's how to get that upgrade for free. All you need is a Pro/Ultimate product key from an older version of Windows.

7
Firefox 60 to Show Sponsored Content for US Users
Quote
Mozilla announced this week plans to show sponsored content to US users starting with the release of Firefox 60.

The sponsored content will appear as suggested stories inside Firefox New Tab page. The stories will be pulled from Pocket's recommendation list.

The Mozilla Foundation acquired Pocket (formerly known as Read It Later), a service for managing article reading lists, in February 2017.

Mozilla has been testing sponsored content in Firefox Nightly and Beta versions for a few months.

Mozilla Blog Post:  A Privacy-Conscious Approach to Sponsored Content - Future Releases

8
Updates Talk / New Calendar, Mail, and mobile Outlook features
« on: April 30, 2018, 11:56:22 pm »
New Calendar, Mail, and mobile Outlook features help you get things done - Microsoft 365 Blog

Quote
You have emails to respond to, things to take care of, and places to be! New Outlook features—across Windows, Mac, web, and mobile—help you manage your time and keep what matters most front and center. Also, new features—coming soon in Outlook for iOS and Android—will connect you to the people, apps, and technology that power your productivity and help protect you and your business.

New in Outlook Calendar

-- Bill pay reminders
-- Suggested event locations and meeting rooms
-- Meeting RSVP tracking and forwarding
-- Multiple time zones

New in Outlook Mail:
-- Show organization directory details
-- Proxy support
-- Bcc warning

See the above-referenced article for details about the new features as well as what is coming soon to Outlook for iOS and Android.

9
The April 2018 Update will be available as a free download beginning Monday, April 30.  Read about the changes for the update at Make the most of your time with the new Windows 10 update - Windows Experience BlogWindows Experience Blog

10
From Oath’s new privacy policy allows it to scan your Yahoo and AOL mail for targeted advertising - The Verge:

Oath confirmed to CNet that it rolled out a unified privacy policy to its AOL and Yahoo brands. The updated policy (spotted by Jason Kint) states that the company “analyzes and stores all communications content, including email content from incoming and outgoing mail,” which will allow it to “deliver, personalize and develop relevant features, content, advertising and Services.”

The policy also states that the company can “analyze your content and other information (including emails, instant messages, posts photos, attachments, and other communications),” and it singles out messaging from financial institutions, saying that it “may analyze user content around certain interactions with financial institutions.” Oath says that its automated systems will strip out “information that on its own could reasonably identify the recipient.” It might also collect Exchangeable Image File Format (EXIF) data from images that you upload, and utilize image recognition to “identify and tag scenes, color, best crop coordinates, text, actions, objects, or public figures.”

12
Intel CPUs Vulnerable to New 'BranchScope' Attack | SecurityWeek.Com
Quote
Researchers have discovered a new side-channel attack method that can be launched against devices with Intel processors, and the patches released in response to the Spectre and Meltdown vulnerabilities might not prevent these types of attacks.

The new attack, dubbed BranchScope, has been identified and demonstrated by a team of researchers from the College of William & Mary, University of California Riverside, Carnegie Mellon University in Qatar, and Binghamton University.

Similar to Meltdown and Spectre, BranchScope can be exploited by an attacker to obtain potentially sensitive information they normally would not be able to access directly. The attacker needs to have access to the targeted system and they must be able to execute arbitrary code.

More at the source.

13
UK Government website offline after hack infects thousands more worldwide

Quote
More than 5,000 websites have been hacked to force visitors' computers to run software that mines a cryptocurrency similar to Bitcoin.

Users loading the websites of the Information Commissioner's Office, the Student Loans Company, as well as the council websites for Manchester City, Camden, and Croydon - and even the homepage of the United States Courts - had their computers' processing power hijacked by hackers.

Malicious code for software known as "Coinhive", a program advertising itself as "A Crypto Miner for your Website" would start running in the background until the webpage is closed.

Security researcher Scott Helme was alerted to the hack by a friend who sent him antivirus software warnings received after visiting a UK Government website.

14
Alerts, Advisories & Bulletins / Security Advisory for NETGEAR Routers
« on: February 10, 2018, 04:43:53 pm »
Security Advisory for Password Recovery and File Access on Some Routers and Modem Routers, PSV-2017-0677 | Answer | NETGEAR Support
Quote
NETGEAR is aware of a password recovery and file access security vulnerability on some routers and modem routers.

NETGEAR strongly recommends that you download the latest firmware as soon as possible.

The list of products is in the above-referenced topic.

More info at Researcher found multiple vulnerabilities in NETGEAR Routers, update them now!Security Affairs:

Quote
Netgear has just released many security updates that address vulnerabilities in a couple of dozen models.

The vulnerabilities have been reported by security researchers Martin Rakhmanov from Trustwave, which conducted a one-year-study on the firmware running on Netgear’s box.

Users are recommended to apply the security patches as soon as possible, they can be exploited by hackers to compromise gateways and wireless points.

The expert discovered that 17 different Netgear routers are affected by a remote authentication bypass that could be exploited by a remote attacker to access target networks without having to provide a password.

15
J2 Global Buys VIPRE Security:
Quote
Headquartered in Clearwater, Fla., VIPRE makes endpoint, email, and network security products, and offers threat intelligence services. It now joins eFax, SugarSync, and SaaS distributor Excel Micro in j2’s portfolio of cloud-related businesses.

j2 also owns FuseMail, a provider of email security, archiving, and hosting services. “Vipre complements the security suite of services of FuseMail,” says an investor’s presentation posted by j2 yesterday.

The presentation also references plans to expand VIPRE’s footprint in the European Union going forward. j2 does business globally, and generated over $1.1 billion in worldwide revenues during 2017. Its digital media properties include PC Magazine, Mashable, and Ziff Davis B2B.

VIPRE Announcement

 

Pages: [1] 2 3