Patch Tuesday Archives

Home » Patch Tuesday

I read Microsoft’s site to a “Microsoft” scammer

Dave Farquhar scams June 22, 2016November 26, 2018malware, Netstat, Patch Tuesday

“Daniel” from “Microsoft” called me the other day. The number looked halfway legit so I picked up. He out and out claimed to be from Microsoft and said he was getting alerts from my computer. His voice sounded familiar–I think I’d talked to him before.

“Which computer?” I asked.

“Your Microsoft computer,” he said.

Dave Farquhar

David Farquhar is a computer security professional, entrepreneur, and author. He has written professionally about computers since 1991, so he was writing about retro computers when they were still new. He has been working in IT professionally since 1994 and has specialized in vulnerability management since 2013. He holds Security+ and CISSP certifications. Today he blogs five times a week, mostly about retro computers and retro gaming covering the time period from 1975 to 2000.

dfarq.homeip.net

Expect a rough road ahead for Flash

Dave Farquhar security July 15, 2015July 14, 2015android, apple, breach, chrome, IOS, ipad, iphone, oracle, os x, Patch Tuesday, yahoo

Adobe has patched Flash twice in two weeks now. The reason for this was due to Hacking Team, an Italian company that sells hacking tools to government agencies, getting hacked. Hacking Team, it turns out, knew of at least three unpatched vulnerabilities (also known as “zero-days” or “0days”) in Flash, and exploits for these vulnerabilities were among the things that got breached.

That’s why Adobe is having a bad month.

Dave Farquhar

dfarq.homeip.net

Worried about the wrong things? It’s always the wrong thing.

Dave Farquhar War Stories May 6, 2015May 2, 20151990s, DBA, Information Assurance, internet providers, passwords, Patch Tuesday, SSL, TLS

Guy Wright’s piece titled Internet Security: We were worried about the wrong things is a bit old but it’s an important point. Security is a moving target. It’s always a moving target.

I disagree, however, with the assertion that SSL (and its successor, TLS) were a waste of time.

Dave Farquhar

dfarq.homeip.net

Three things to remember from Verizon’s Data Brach Investigations Report

Dave Farquhar security April 20, 2015April 18, 2015breach, CISO, Data breach, Exploitation, Mandiant, Patch Tuesday, verizon, vulnerability

Every year around this time, Verizon releases its Data Breach Investigations Report, referred to in the trade as simply the “DBIR.” Verizon is one of two companies you call if you’ve been breached and you really want to get to the bottom of what happened and try to keep it from happening again. (Mandiant is the other.)

My CISO hates this year’s edition because of its Joy Division-inspired cover and some of the cutesy writing. But it still makes some valid points that I wish everyone would take to heart–and those points remind me why so many people in my field of work listen to Joy Division.

Dave Farquhar

dfarq.homeip.net

Why Google ratting on Microsoft isn’t all bad

Dave Farquhar security January 2, 2015January 1, 2015antivirus, Patch Tuesday, vulnerability, windows 8

This week, Google published a vulnerability in Windows 8.1 after a 90-day countdown timer automatically expired. Microsoft has not yet released a patch.

Controversy ensued. Obviously, yes, an unpatched, well-known vulnerability in Windows is troubling. But the alternative is worse.

Dave Farquhar

dfarq.homeip.net

What is Winshock?

Dave Farquhar security, Windows December 3, 2014December 2, 2014antivirus, code execution, excel, IBM, ips, Patch Tuesday, SSL, symantec, TLS, vulnerability, windows 7, windows 8, windows 9x, windows nt, Windows Server, Windows XP

So the other day I got blindsided with a question at work: What are we doing about Winshock. Winshock, I asked? I had to go look it up, and I found that’s what they dubbed what I’ve been calling MS14-066, the vulnerability in Schannel, which is Microsoft’s implementation of SSL/TLS for Windows.

Based on that, I’d argue it has more in common with Heartbleed than Shellshock, but I guess “Winshock” is catchier than “Winbleed.”

Then the lead of another team asked me to brief his team on Winshock. I actually managed to anticipate all but three of the questions they asked, too, which was better than I expected. Some of what I shared with them is probably worth sharing further.

Dave Farquhar

dfarq.homeip.net

Retracing the Home Depot attackers’ steps

Dave Farquhar security November 7, 2014November 6, 2014breach, home depot, malware, Patch Tuesday, Privilege escalation, vulnerability

New details emerged on the Home Depot attack that left 56 million consumers with compromised credit cards. The interesting thing in the new details is that it could have been much worse, but maybe not for reasons immediately obvious.

Dave Farquhar

dfarq.homeip.net

Revisiting Microsoft/Sysinternals Du as a batch file

Dave Farquhar security, Windows September 19, 2014April 24, 2017cmd, Patch Tuesday, sysinternals, Sysinternals Du

My tips for using Sysinternals’ Du.exe were well received last week, and my former coworker Charlie mentioned a GUI tool called Windirstat that I had completely forgotten about. For the command-line averse, it’s an incredibly useful tool.

But there’s one thing that Du.exe does that makes the CLI worthwhile. It will output to CSV files for further analysis. Here’s the trick.

DU -L 1 -Q -C \\SERVERNAME\C$\ >> servers.csv

Sub in the name of your server for servername. You have to have admin rights on the server to run this, of course.

For even more power, run this in a batch file containing multiple commands to query multiple servers, say, in your runup to Patch Tuesday. Open the file in your favorite spreadsheet, sort on Directory Size, and you can find candidates for cleanup.

Dave Farquhar

dfarq.homeip.net

IT jobs shortage? Slide over to security

Dave Farquhar security September 8, 2014November 20, 2018CISO, cissp, information security, infoworld, Internet Storm Center, job description, Liquid Matrix, Patch Tuesday, podcast, table of contents

IT jobs are getting scarce again, and I believe it. I don’t have a cure but I have a suggestion: Specialize. Specifically, specialize in security.

Why? Turnover. Turnover in my department is rampant, because other companies offer my coworkers more money, a promotion, or something tangible to come work for them. I asked our CISO point blank if he’s worried. He said unemployment in security is 0.6 percent, so this is normal. What we have to do is develop security people, because there aren’t enough of them.

I made that transition, largely by accident, so I’ll offer some advice. Read more

Dave Farquhar

dfarq.homeip.net

Getting started in compliance: Start by doing the right thing

Dave Farquhar security July 11, 2013July 10, 2013Patch Tuesday, Regulatory compliance

I had a couple of discussions this week about compliance, and the traps of plain old check-the-box compliance, and how to get started in it when regulatory compliance suddenly gets sprung on you.

The key is working backwards. Start with the very reason regulatory compliance exists.

Dave Farquhar

dfarq.homeip.net

← Previous