Great news for windows 10 users - Microsoft will automatically uninstall buggy software updates installed on your system if Windows 10 detects a startup failure, which could be due to incompatibility or issues in new software.

For Windows 10 users who believe that the updates in question should not have been uninstalled, Microsoft allows them to manually install driver or quality updates.

https://thehackernews.com/2019/03/windows-buggy-updates.html

Good News for windows 10 users - Microsoft has built Windows Defender to run in a sandboxed environment.

With Windows Defender running in a restrictive process execution environment, attackers who break in are stuck inside the isolated environment and can't affect the rest of the system.

The feature is now available to Windows Insiders to test in upcoming versions of Windows 10. If you are not in the program and can't wait for Microsoft to release it in full, you can force-enable Windows Defender to run in a sandbox on Windows 10 version 1703 and later.

Windows Defender runs with high privileges to scan systems for malicious content; because of this, it's already a prime target for cyberattacks. If someone successfully exploits a bug in Windows Defender, an entire system can be taken over.



https://www.darkreading.com/analytics/windows-defender-first-full-antivirus-tool-to-run-in-a-sandbox/d/d-id/1333141

When was the last time you verified your file backups? - There is a new Windows zero-day flaw that could help attackers delete your files

When was the last time you verified your file backups? - There is a new Windows zero-day flaw that affects Microsoft Data Sharing on All versions of Windows 10, including the most recent update,in addition to Server 2016 and Server 2019

The PoC shows once they have that access, an attacker would be able to eliminate files that typically require administrative privilege to delete.

https://www.darkreading.com/vulnerabilities---threats/twitter-user-discloses-second-microsoft-zero-day/d/d-id/1333115

Windows Security folks - Take a look at the list of websites and services that a Windows PC connects to after a clean install.

Check Here:

https://mspoweruser.com/these-are-the-websites-your-clean-install-windows-pc-connects-to-by-itself/

Exploit (PoC) is now available for the remote code execution vulnerability (CVE-2018-0886) in MS Windows. Applying 03/2018 Patch is not enough.Using non-privileged accounts is also recommended.

Discovered by researchers at Cybersecurity firm Preempt Security, the issue (CVE-2018-0886) is a logical cryptographic flaw in CredSSP that can be exploited by a man-in-the-middle attacker with Wi-Fi or physical access to the network to steal session authentication data and perform a Remote Procedure Call attack


When a client and server authenticate over RDP and WinRM connection protocols, a man-in-the-middle attacker can execute remote commands to compromise enterprise networks.

Though researchers also warned that patching alone is not sufficient to prevent this attack, IT professionals are also required to make some configuration to apply the patch and be protected.

Blocking the relevant application ports including RDP and DCE/RPC would also thwart the attack, but researchers say this attack could even be implemented in different ways, using different protocols.

It is a good idea to decrease the use of privileged account as much as possible and instead use non-privileged accounts whenever applicable.


https://thehackernews.com/2018/03/credssp-rdp-exploit.html

Are you sure your Windows 10 has not reached End Of Support - Remember, it is not just an OS - it is "Windows as a Service"

Here is what Microsoft is saying

Servicing extensions for Windows 10

Windows 10 is being adopted rapidly by organizations of all sizes, and as customers deploy the product they are implementing a modern servicing methodology we refer to as Windows as a service.

Many customers – including MARS, Independence Blue Cross, and Accenture – have made significant progress in moving to Windows as a Service, but some have requested an extension to the standard 18 months of support for Windows 10 releases.  To help these customers, we are announcing an additional six months of servicing for the Enterprise and Education editions of Windows 10, versions 1607, 1703, and 1709. (Additional servicing for Windows 10, version 1511 was announced in November.)  This extension will be offered via normal channels.  The chart below outlines the impact of these extensions for each of the last four Windows 10 releases.

Release	Release date	End of support	End of additional servicing for Enterprise, Education
Windows 10, version 1511	November 10, 2015	October 10, 2017	April 10, 2018
Windows 10, version 1607	August 2, 2016	April 10, 2018	October 9, 2018
Windows 10, version 1703	April 5, 2017	October 9, 2018	April 9, 2019
Windows 10, version 1709	October 17, 2017	April 9, 2019	October 8, 2019

We will also offer additional paid servicing options for Windows 10 Enterprise and Education releases starting with Windows 10 version 1607. For more information, contact your Microsoft account team.

https://blogs.technet.microsoft.com/windowsitpro/2018/02/01/changes-to-office-and-windows-servicing-and-support/

Have you heard of Windows Defender Exploit Guard (Windows 10 IPS functions)

The four components of Windows Defender Exploit Guard are:

Attack Surface Reduction (ASR): A set of controls that enterprises can enable to prevent malware from getting on the machine by blocking Office-, script-, and email-based threats

Network protection: Protects the endpoint against web-based threats by blocking any outbound process on the device to untrusted hosts/IP through Windows Defender SmartScreen

Controlled folder access: Protects sensitive data from ransomware by blocking untrusted processes from accessing your protected folders

Exploit protection: A set of exploit mitigations (replacing EMET) that can be easily configured to protect your system and applications

More details here:
https://blogs.technet.microsoft.com/mmpc/2017/10/23/windows-defender-exploit-guard-reduce-the-attack-surface-against-next-generation-malware/

Did you know that Windows 10 has a feature that could protect your system from ransomware

Microsoft has now introduced Controlled Folder Access feature in its Windows Defender Security Center that is available for Windows 10 Fall Creators Update (v1709)

By enabling Controlled Folder Access (CFA) on a folder, it will be possible to continuously monitor the changes in the system in real-time and timely identify any unauthorized access. In case an unauthorized process attempts to access that folder, which has been protected with CFA, it will immediately be blocked, and the user will be notified


Follow this How-To Document:
https://www.hackread.com/microsoft-windows-10-anti-ransomware/

Windows 10 Creators Update - Nice name but what is it?

Lots of tweaks and updates
(not sure how useful/relevant)


Check Here for complete details and  a short video:
http://www.windowscentral.com/windows-10-creators-update-review

Bypass Windows defenses without leaving any trace on the machine.

The strange part is that someone accidentally discovered it and exposed it.
So, I am wondering who else knew about it and has been using it.
Is this a vulnerability or kind of backdoor?

From the Article:
The flaw doesn’t trigger the AppLocker security software, which is supposed to only let users run apps from trusted sources, and it doesn’t leave any traces in the registry, as it doesn’t need administrator access.

Microsoft has not yet provided a fix for the issue, but users can disable the Regsvr program using Windows Firewall.



For More info
http://bgr.com/2016/04/25/windows-10-applocker-security-issue/

Free additional feature called "Spying on You" (my nick name to the service) without your permission - In windows 7 and 8

I am not surprised, if you are then you are not from this planet


From the article

Back in April, Microsoft released a non-security update for both Windows 7 and 8. This update, 3022345, created a new Windows service called the Diagnostics Tracking service.

The concern with the new Diagnostic Tracking service is much the same as with Windows 10's tracking: it's not clear what's being sent, and there are concerns that it can't be readily controlled.

(good news) Additionally, most or all of the traffic appears to be contingent on participating in the CEIP in the first place. If the CEIP is disabled, it appears that little or no traffic gets sent.


For More info:
http://arstechnica.com/information-technology/2015/08/microsoft-accused-of-adding-spy-features-to-windows-7-8/

TIPS-N-TRICKS - Microsoft tool to prevent some drivers from re-installing automatically

Well , we all know that all MS drivers don't work well so, there are times we don't want some of them. 

Windows 10 for home will force install updates and drivers.

So, here is a tool to defer that.


https://support.microsoft.com/en-us/kb/3073930

“You visit a website you are done. You are pwned,” (Because of a 14 year old Windows Vulnerablity ). It does not matter if you use Windows Edge (in Windows 10).

Scary news , now got scarier!
Oh Yeah, Windows 10 OS too
and
the new Edge browser too.



From the Article
A Windows vulnerability in the SMB file-sharing protocol  discovered 14 years ago and partially patched by Microsoft could still be abused via remote attacks,


Affects Internet Explorer running on all versions of Windows, even in the newly released Windows 10. It would be the first remote code exploit for the new operating system. It also affects Windows Edge, the researchers said


The researchers discovered that it was possible to steal the credentials remotely and impersonate users from the Internet.

The adversary waits for these automated systems to turn on and start scanning all the hosts on the network, atwhich point it grabs the login credentials. The attack was sucessful as soon as users were tricked into loading an image file in Internet Explorer

users are tricked into visiting a website controlled by the attackers, which then captures the user's username in plaintext and the hash of the user's password. The password can be  cracked in a manner of days because it uses an obsolete hashing algorithm

The attacker hijacks the challenge/response exchange, by waiting for someone else on the network to authenticate against any system on the network.


For More info:
http://www.darkreading.com/vulnerabilities---threats/new-smb-relay-attack-steals-user-credentials-over-internet/d/d-id/1321633

Windows 10 Enterprise Security Features

From the article:

• Microsoft’s new Edge browser improves security in a variety of ways, from running in the app container sandbox to removing ActiveX controls, VBScript, toolbars and Browser Helper Objects. 
• Windows 10 also works with hardware for palm vein prints, iris recognition and 3D facial recognition, using the Intel RealSense camera that’s being built into various notebook computers. The feature also accounts for temperature using infrared sensors, so it won’t be fooled by photos and masks.
• You’ll also need to plan ahead to use Windows Passport, the Fast Identity Online (FIDO) -compliant next-generation credentials in Windows 10. These can be certificates distributed using an existing Public Key Infrastructure or key pairs generated by Windows itself, and they’re stored securely in the TPM, and unlocked using biometrics or a PIN (or a picture password).
• When content comes from those locations, the network knows where it comes from and we can say let's go ahead and encrypt that at the file level.”

For more info:
http://www.csoonline.com/article/2955303/operating-system-security/how-to-get-the-most-out-of-windows-10-enterprise-security-features.html#tk.rss_dataprotection

Fun Read - 20 new/improved features in Windows 10

Few interesting ones below:

• Windows 10 can use your face or your iris to log you on to your PC
• Includes a new app to help you get your phone set up to work with your PC and with any Microsoft services you use
• If there's an update that will need a restart you can have Windows ask when you want to schedule that for
• If you need to arrange a lot of windows and you don't have multiple monitors, you can put them on multiple virtual desktops

For more info:
http://www.techradar.com/us/news/software/operating-systems/10-great-new-features-in-windows-10-1267365

Watchout - Fake Windows 10 Upgrade (phishing) mail carries Ransomware

Anyone surprised?

Every time there is a popular news (need not be good news, it can be bad news like Hurricane), there is always a surge in SPAM /PHISHING emails trying to get you.


From the Article:

Researchers at Cisco TALOS said on Friday they spotted spam carrying an archived attachment from an email address in Thailand spoofing update at Microsoft[.]com. Users who download and execute the files inside the zip archive are hit by the CTB-Locker brand of ransomware. 

CTB-Locker behaves like most strains of crypto-ransomware; it’s spread via email, exploit kits or drive-by downloads, encrypts documents stored on the computers and demands a ransom paid in Bitcoin in exchange for the encryption key. This campaign gives users a 96-hour window to deliver payment, which is shorter than other campaigns making use of CTB-Locker.

For More info:
https://threatpost.com/windows-10-upgrade-spam-carries-ctb-locker-ransomware/114114

I did not know this - Windows "Disk Cleanup" now includes option to remove outdated Windows Update

IMPORTANT:
Search for "disk cleaner" and make sure you choose "run as administrator"


Something new to learn everyday.

Some use "cccleaner" but this one is part of the OS and gets an nice upgrade



Details on How to do it:
http://blogs.technet.com/b/askpfeplat/archive/2013/10/07/breaking-news-reduce-the-size-of-the-winsxs-directory-and-free-up-disk-space-with-a-new-update-for-windows-7-sp1-clients.aspx

Screen Recording tool in Windows 10

Nice to know

Hit the Windows key and G, and a popup will appear asking if you would like to open Game bar -- there are no Yes and No buttons, but check the 'Yes, this is a game' box (you will have to do this the first time you access the screen recorder in any application).

For More info:
http://betanews.com/2015/07/19/windows-10-secret-screen-recording-tool/

Does your organization still use NTLM authentication (I hope not) - Then you should know about Windows folder poisoning Attack

According to the article:-

Endpoint security vendor Imperva, who said they've discovered a way to poison Windows folders and gain the access rights of anyone who browses to that folder. The hack involves exploiting a relaying feature in Microsoft NT LAN Manager (NTLM), which is a widely used Windows challenge-response authentication protocol.

Anyone who can be tricked into clicking on a folder containing such a shortcut icon will launch an NTLM relay, which passes their authentication credentials via the compromised PC to Active Directory and then gives the compromised PC the same access rights

Shulman said similar types of attacks can be launched beyond Windows. Other potential targets include Jive, SharePoint, or other collaboration software, especially if it includes the ability to publish small blurbs of information via feeds, together with small images, as these images can used by attackers to point to remote machines and launch NTLM relay attacks.

The link below has more information:-

http://www.darkreading.com/vulnerabilities---threats/sneaky-windows-folder-poisoning-attack-steals-access-rights/d/d-id/1251025

RAT Dissected - I mean Remote Administration tool - in this case WinSpy

The interesting part is it it has both Windows and Android components.



The links below has more information:

http://www.fireeye.com/blog/technical/2014/03/from-windows-to-droids-an-insight-in-to-multi-vector-attack-mechanisms-in-rats.html