TweakHound

Computer stuff...

Security

Email Encryption Vulnerable

By Leave a Comment

“A group of European security researchers have released a warning about a set of vulnerabilities affecting users of PGP and S/MIME. EFF has been in communication with the research team, and can confirm that these vulnerabilities pose an immediate risk to those using these tools for email communication, including the potential exposure of the contents of past messages.“

Attention PGP Users: New Vulnerabilities Require You To Take Action Now

Officially called “EFAIL”: https://efail.de/

A number of platforms are said to be vulnerable.
Quotes include, “Email is no longer a secure communication medium” and “can confirm that these vulnerabilities pose an immediate risk to those using these tools for email communication, including the potential exposure of the contents of past messages.”.
IMHO there seems to be a bit of hysteria going on about this this morning. On the other hand, I’m no security expert so what do I know.

Protonmail has stated,
“ProtonMail is safe against the efail PGP vulnerability. The real vulnerability is implementation errors in various PGP clients. PGP (and OpenPGP) is fine. Any service that uses our @openpgpjs library is also safe as long the default settings aren’t changed.”

I dunno, I never really believed anything on a computer was 100% secure or private and tend to conduct myself accordingly. Of course I’m just an average, boring dude so I’ve no idea why someone would waste the effort to read my email.

There is gonna be a lot more to read on this in the coming days.

AMD Spectre Mitigation Update

By Leave a Comment

“Today, AMD is providing updates regarding our recommended mitigations for Google Project Zero (GPZ) Variant 2 (Spectre) for Microsoft Windows users. These mitigations require a combination of processor microcode updates from our OEM and motherboard partners, as well as running the current and fully up-to-date version of Windows. For Linux users, AMD recommended mitigations for GPZ Variant 2 were made available to our Linux partners and have been released to distribution earlier this year…
Microsoft is releasing an operating system update containing Variant 2 (Spectre) mitigations for AMD users running Windows 10 (version 1709) today. Support for these mitigations for AMD processors in Windows Server 2016 is expected to be available following final validation and testing.
In addition, microcode updates with our recommended mitigations addressing Variant 2 (Spectre) have been released to our customers and ecosystem partners for AMD processors dating back to the first “Bulldozer” core products introduced in 2011.
AMD customers will be able to install the microcode by downloading BIOS updates provided by PC and server manufacturers and motherboard providers. Please check with your provider for the latest updates.”
Spectre Mitigation Update – Mark Papermaster, Senior Vice President and Chief Technology Officer

Patch Tuesday

By Leave a Comment

*This post will be updated as info comes in.
Microsoft Security Update Summary at bottom of post.

Windows 7 SP1 – April 10, 2018—KB4093118 (Monthly Rollup)

Win10 1709 – April 10, 2018—KB4093112 (OS Build 16299.371)
“This update includes quality improvements. No new operating system features are being introduced in this update.”
Win10 1703 – April 10, 2018—KB4093107 (OS Build 15063.1029)
“This update includes quality improvements. No new operating system features are being introduced in this update.”
Win10 1607 – April 10, 2018—KB4093119 (OS Build 14393.2189)
“Windows 10 version 1607 will reach end of service on April 10, 2018. Devices running Windows 10 Home or Pro editions will no longer receive monthly security and quality updates that contain protection from the latest security threats. To continue receiving security and quality updates, Microsoft recommends updating to the latest version of Windows 10.”

Insider builds also get the above updates (KB4100375).
[Read more…] about Patch Tuesday

Windows Defender Vulnerability

By 1 Comment

I’m in front of the boob tube last night and I get this email entitled “Microsoft Security Update Releases” (full email posted below).
CVE-2018-0986 | Microsoft Malware Protection Engine Remote Code Execution Vulnerability
The gist of the alert is that all versions of Windows Defender have a vulnerability.
If Windows Defender scans an infected file then a hacker could own your system.
Rephrased…
If the product that is supposed to protect your system just SCANS a bad file you could be OWNED.
Fortunately this has been patched. Windows Defender should update automatically but you can force an update.
Press the Windows + R keys > copy paste the following: “%ProgramFiles%\Windows Defender\MSASCui.exe” -Update
[Read more…] about Windows Defender Vulnerability

Patch Tuesday

By

Updates available for all things Windows. I am still not updating my Windows 7 machines. The only Win10 machine I am updating is my main rig. I have switched that over to Windows Insider Fast Lane so I can get a head start on the Spring Creators Update that comes out next month. The things I do for you guys.

Full Windows Update info at the bottom of this post.
Win10 version 1709: March 13, 2018—KB4088776 (OS Build 16299.309)
“This update includes quality improvements. No new operating system features are being introduced in this update.”
Win10 version 1703: March 13, 2018—KB4088782 (OS Build 15063.966)
“This update includes quality improvements. No new operating system features are being introduced in this update.”

Firefox 59
Firefox 32-bit
Firefox 64-bit
All downloads
Release Notes. Be sure to check these out as there are a couple of new features you’ll want to know about.
Related: Tor Browser 7.5.1 released and Tails 3.6 too.

CCleaner 5.41
Release Announcement
Download (I use the portable version)
Thanks Arthur!

Adobe Flash Player 29.0.0.113
for Firefox, Opera
for Internet Explorer

[Read more…] about Patch Tuesday

AMDFLAWS.com

By

So this is a thing: https://amdflaws.com/
Slashdot links to this article: AMD has a Spectre/Meltdown-like security flaw of its own
They say, “13 Critical Security Vulnerabilities and Manufacturer Backdoors discovered throughout AMD Ryzen & EPYC product lines.” Apparently they only gave AMD a 24 hour heads up.
Just you break out the popcorn, sit back, put your feet up and watch what comes of this.

Patch Tuesday

By

I’m not patching. See the previous post: Patch Tuesday, Part 1 as to why.

Windows 10: February 13, 2018—KB4074588 (OS Build 16299.248)

Warning – Windows 7 Users, KB2952664 Is Back
It has been moved to “Important” again. We Geeks don’t like it because it is telemetry related.
KB2952664 – Compatibility update for keeping Windows up-to-date in Windows 7
In Windows Update you can right-click and hide this.
My script to block this and other sneaky updates: https://www.tweakhound.com/2015/11/01/remove-and-block-gwx-in-windows-7-2/

Microsoft Security Update Summary for February 13, 2018
I post this for your info when Microsoft sends it to me.
[Read more…] about Patch Tuesday