Newsletter Archives

• When Windows 10 Feature Updates don’t go smoothly

  Posted on November 15, 2019 at 21:45 CST by Kirsty • Comment in the Forums

  Last weekend, I decided to bite the bullet and update a Win10-1803 Pro machine to Win10-1809, using Windows Update. I’d taken a system image backup, and as it wasn’t my production machine, I wasn’t too worried.

  This machine is under a year old, a purchase necessary when a hardware failure put paid to my trusty Win7 Pro laptop. It allows me to work more than I can manage at my desktop, and does most of the hard yards online, especially here.

  Windows Update installed 1809 x64 2019-10B – this was before Woody changed MS-Defcon from 4 to 2. It took 20 minutes to Prepare to Install, and nearly 2 hours to download, and several hours to install.

  Needless to say, it didn’t go to plan… The first indication of a problem was after several hours of installing, when a blue screen appeared bearing the words “Stopcode” and “Bad Pool Header”. It restarted, still on 1803, pending install. It continued installing. Eventually it restarted, and I was able to see KB 4521862 and KB 4519338 had installed – along with a bunch of drivers being updated, when the Pro settings were not to download drivers from Windows. I also noticed I hadn’t had to reset the Metered Connection settings to allow the update to download!

  After it finished its update, it wasn’t working properly. It looked fairly normal, but restarting started problems – none of the visible desktop items actually worked – not the Start button, any of the TaskBar icons, or anything other than the Ctrl>Alt>Del routine.

  I tried Sign Out. It took ages. It caused a loop of: Hi; We’re getting everything ready for you; This might take several minutes – don’t turn off your PC (that part remained until it got to Hi again); Leave everything to us; Windows stays up to date to help protect you in an online world; Making sure your apps are good to go; It’s taking a bit longer than expected, but we’ll get there as fast as we can. This loop took 5 minutes to restart, again, and again, and again.

  It had been over 12 hours since the process started at this point. As I had to do my day job, I just left it chugging away in the background while I got on with earning an income. Over 5 hours later, it finally came up for air – a desktop, but still not functioning.

  Along the way, I saw various errors:
  Error 0x80072EE7
  The gpsvc service failed the sign-in – access is denied
  windows\system32\config\systemprofile\desktop is unavailable

  To add to my woes, it wanted to restart itself again, where it re-entered the 5+ hour loop. I still had work to get done, so I just let it be. No stopcodes this time, but still it didn’t work.

  I couldn’t access safe mode, even with Recovery Tool USB access. Start Up Repair “couldn’t fix [the] PC”. Using the Recovery Tool, I was able to access the Command Prompt, where SFC /SCANNOW reported “Not enough memory resources are available to process this command” the first time, and then, after it went through 100%, “Windows Resource Protection could not perform the requested operation”. Attempting to use Restore Points was another failure – they were listed, but “unavailable”.

  At this time, I decided it was time to try to restore the system image. Again, the gpsvc error. Apparently there had been some issue prior to the update attempt? I had to put it aside for a few days, until I got time to address it properly. By this stage, I was heading for an ISO file on a USB stick. This laptop now needs to be reset from the ground up, going back over all the metered connection, deferred updates, Customer Experience, Start Menu apps settings etc. etc. etc. – and I’m sure there’ll be something important I forget!

  Having got the ISO installed, I was able to run SFC / SCANNOW and DISM /Online /Cleanup-Image /RestoreHealth. All 100% clear, thank goodness.

  There are only 5-6 programs to reinstall. If this had been a production machine, I’d have dozens of programs to have to reinstall. It’s still going to take another day or two until I get it back to normal, as I have other things I need to prioritize. If I’m a bit cranky this weekend, you now know why!

  I’m really lucky I have a wealth of knowledge, support and expertise here at my disposal. A normal home user would have ended up paying for professional technical support, and if it had been my production machine, would have resulted in a loss of chargeable hours. I’m counting my blessings!

  Upgrading, Windows 10 feature update, ISO, Windows Update

• BlueKeep exploitation expected soon

  Posted on July 23, 2019 at 02:59 CDT by Kirsty • Comment in the Forums

  Several hours ago, there was a lot of noise on Twitter about a Github explanation on how to “weaponize” BlueKeep, triggering fears it could soon be widely expolited.

  BlueKeep Warning: someone published a slide deck explaining how to turn the crash PoC into RCE. I expect we'll likely see widespread exploitation soon.https://t.co/MG2IZfy5B5

  — MalwareTech (@MalwareTechBlog) July 22, 2019

  Dan Goodin‘s article on ArsTechnica.com is fairly succinct:

  BEWARE OF WORMABLE EXPLOITS —
  Chances of destructive BlueKeep exploit rise with new explainer posted online

   
  We’ll be keeping an eye on Kevin Beaumont’s Twitter feed, to see what he posts about it today.

  Are you protected?

   
  UPDATE:
  Kevin Beaumont is also warning about a more imminent threat from BlueKeep

  I've updated this thread with @0xeb_bp's #BlueKeep exploitation technical document, newly released today – it shows how to reach UAF. The bar for (unreliable) public exploitation POC is lowering significantly. https://t.co/UX1ujWaQik

  — Kevin Beaumont (@GossiTheDog) 23 July 2019

  Security, Windows Patches/Security BlueKeep, wormable

• 16-year U.S. data leakage: KrebsOnSecurity

  Posted on May 24, 2019 at 18:16 CDT by Kirsty • Comment in the Forums

  Security supremo Brian Krebs has published details of a long-standing data leak he stemmed this week:

  The Web site for Fortune 500 real estate title insurance giant First American Financial Corp. leaked hundreds of millions of documents related to mortgage deals going back to 2003, until notified this week by KrebsOnSecurity. The digitized records — including bank account numbers and statements, mortgage and tax records, Social Security numbers, wire transaction receipts, and drivers license images — were available without authentication to anyone with a Web browser.
  …
  I should emphasize that these documents were merely available from First American’s Web site; I do not have any information on whether this fact was known to fraudsters previously, nor do I have any information to suggest the documents were somehow mass-harvested (although a low-and-slow or distributed indexing of this data would not have been difficult for even a novice attacker).

  See Brian’s blogpost “First American Financial Corp. Leaked Hundreds of Millions of Title Insurance Records” for details.

  Other data breach

• WhatsApp spyware vulnerability

  Posted on May 14, 2019 at 03:13 CDT by Kirsty • Comment in the Forums

  WhatsApp users are being urged to update their apps, to address a vulnerability discovered recently. If you have family members using this platform, I trust you’ll encourage them to make sure they’re up-to-date too.

  From theguardian.com:

  Attackers could transmit the malicious code to a target’s device by calling the user and infecting the call whether or not the recipient answered the call. Logs of the incoming calls were often erased, according to the report.

  Other spyware, WhatsApp

• Windows Defender Security definition problems

  Posted on March 19, 2019 at 00:52 CDT by Kirsty • Comment in the Forums

  We’re hearing reports of problems with Definitions Update 1.289.1521.0, preventing scanning in Windows 7 and 8.0 virtual machines. Other OS versions are still being tested by @alqamar.

  Has your machine been affected by this definition update?

  UPDATE: Win 8.1 also affected, but newer OS are ok.
  @alqamar has posted his results
  (This is a real-world problem, not just limited to virtual machines, where early reports were first tested)

  RESOLVED: Microsoft has now issued an update that fixes the issue. In her article on the problem (which was noted as first being seen here), Mary Jo Foley wrote on zdnet.com that update 1.289.1588.0 was issued on March 19th. @alqamar posted his tests were fixed by update 1.289.1587.0.

  Windows Patches/Security Windows Defender Security

• High praise, indeed!

  Posted on January 18, 2019 at 14:00 CST by Kirsty • Comment in the Forums

  AskWoody.com, and its eponymous factotum (…Woody), have made it to Martin Brinkmann’s “Tech Sites We Love“, over on ghacks.net:

  AskWoody.com offers news, tips, and support for Microsoft Windows, Office, PCs and other tech. It is run by Woody Leonhard and one of the prime news sources for Windows administrators and users on the Internet…
  It is a must-visit site in my opinion as a system administrator, regardless of whether you administrate a single Home PC or PCs in a company network.

  @martinbrinkmann is a trusted MVP here (but of course, with the roles still not 100%, you may not always see a correct indication on any account!), and his articles have often been linked here on AskWoody. Judging by the number of mentions he’s received here, you must respect him too.

  In this case, I am 100% in support of Martin’s opinion – Well done, Woody!

   
  Thx @Microfix

  Other AskWoody Lounge, AskWoody Plus, ghacks

• Getting ready to track Santa

  Posted on December 24, 2018 at 01:03 CST by Kirsty • Comment in the Forums

  Norad are ready to set off their Santa Tracker, and Google’s will be going in about 3hrs. Have fun tracking Santa.

  Merry Christmas, everyone.

  

  Other Norad, Santa Tracker

• “this week in security” newsletter

  Posted on December 23, 2018 at 19:25 CST by Kirsty • Comment in the Forums

  Many of you will be familiar with Zack Whittaker’s work. Zack is now TechCrunch’s Security Editor, and was formerly the same at zdnet.com until a few months ago. We have featured his work many times, here on AskWoody.com.

  A few months ago, Zack started a weekly cyber-security newsletter, which contain links to recent interesting articles of relevance, as well as a cute cyber-cat of the week. If you haven’t seen this week’s newsletter, check it out, or the list of past issues. A subscribe link is on the top left of both pages.

  Other Security Newsletter
• « Older Entries

  Newer Entries »