KBNew updated

Topic

New Reply

I just updated the list of new KB numbers, finishing off January, and starting February. January hit 1,542 entries. Just wondering… do any of you lo
[See the full post at: KBNew updated]

2 users thanked author for this post.

AJNorth, MrBrian

Reply | Quote

Replies

Now may be time un soupcon de  paranoia…

AV Test now reporting
Meltdown-Spectre: Malware is already being tested by attackers
Malware makers are experimenting with malware that exploits the Spectre and Meltdown CPU bugs.
See Liam Tung’s article ZDNet

Edit to remove HTML

Reply | Quote

As an anonymous poster your replies have to be moderated and may not show up immediately.
You do not need to repost.

1 user thanked author for this post.

woody

Reply | Quote

I see the ZDNet report here.

There have been Spectre-releated samples submitted to AV-Test since January 7. Almost all of them are the same Proof of Concept code, which needs a browser to run. Chrome and Firefox have already been hardened to block that kind of problem.

I still believe that the first working exploit we’ll see will come in through a browser – and that any patches in Windows and firmware won’t mean anything.

Of course, if you’re running a server with sensitive data on it, and multiple concurrent users, your perspective’s a little bit different.

4 users thanked author for this post.

SueW, AJNorth, Elly, ryegrass

Reply | Quote

Quoting from the ZDNet article:

He also offered a tip to minimize your risk of being hit by any more successful Spectre malware that may emerge.

“If you don’t need your PC for more than an hour, switch it off. If you go for lunch or a break, close your browser. This should decrease your attack surface a lot and also save quite some energy,” said Marx.

 

Really? Really!??! After all this humongous mess of patches and kernels being emitted and pulled back, microcode updates, Linux Torvalds’ rants and all these shenanigans, all you need to do to protect yourself against Specter is the sensible thing I’ve always been doing: suspend, hibernate or shutdown your computer when not in use!?

I’ve downgraded the whole industry to Defcon Zero. No one knows a __________ (insert your favorite swearing here) clue about what they are doing.

2 users thanked author for this post.

HiFlyer, anita.yk

Reply | Quote

Anon #163777 said:
Really? Really!??!  […] all you need to do to protect yourself against Spectre is the sensible thing I’ve always been doing: suspend, hibernate or shutdown your computer when not in use!?

It’s like the authorities sagely advising everyone to suspend our outdoor life & hibernate in the house, when there is an emerging epidemic (biological) virus circulating outside.

Hibernating & shutting down the PC when not in use is my usual practice too. If anything, it saves electricity, reduces heat emissions & also prolongs the hardware’s lifespan. On top of that, if I would be away or doing something else offline for the next 1-2 mins or more, I would disable the network connection. (I put the network shortcut on the desktop for this purpose.)

That being said, what I’m more concerned about is what happens when the PC is actively connected to the internet – because we can’t hibernate forever, right?

What else can we do – besides trying our best to secure the web browser & whatever applications with JavaScript-interpreting capabilities (eg. for email programs like ThunderBird, set JavaScript.enabled = false )?

Typically, whilst online, I also try to avoid using other local programs (except for the bare minimum), so as to reduce the attack surface area.

Other than that, I don’t suppose there is very much more I can do, since my hardware lacks immunity to Meltdown-Spectre, & my elderly CPU (born in 2010) presently does not qualify for a vaccine even if Intel & the OEMs manage to release an effective one.

Reply | Quote

P.S. If your username/password don’t work, email me! woody@AskWoody.com

Reply | Quote

PKCano. The repost was accidental. Only reason I do anonymous is my email/password combo I used last year don’t seem to work. No bother.

Reply | Quote

In case anybody is wondering why Woody mentioned Microsoft Dynamics products, the reason is because some Microsoft Knowledge Base articles are so-called “FAST PUBLISH” articles (examples: here and here). These “FAST PUBLISH” articles often (perhaps always?) seem to be for Microsoft Dynamics products. I made available a change that, among other things, adds “***FAST PUBLISH***” to the beginning of article titles that are “FAST PUBLISH” articles, because the titles for “FAST PUBLISH” articles often don’t mention that they involve Microsoft Dynamics. I’m guessing Woody is thinking of excluding “FAST PUBLISH” articles from being listed in his online spreadsheet.

3 users thanked author for this post.

Elly, woody, HiFlyer

Reply | Quote

In my opinion, it is wiser to keep the “FAST PUBLISH” articles in the online spreadsheet. Some people do use Microsoft Dynamics products, and I’m not sure if “FAST PUBLISH” articles always (and will always) be used only for Microsoft Dynamics products. With the titles of “FAST PUBLISH” articles altered such as my recent code change does, it is easy enough for the disinterested user to skip those.

3 users thanked author for this post.

woody, Elly, HiFlyer

Reply | Quote

Here are two “FAST PUBLISH” articles that don’t involve Dynamics: https://support.microsoft.com/en-us/help/2416991 and https://support.microsoft.com/en-us/help/2665695.

1 user thanked author for this post.

Elly

Reply | Quote

I need to roll your changes into my hacked-up version of the scanner….

1 user thanked author for this post.

MrBrian

Reply | Quote

@Woody: A reminder to do this if you want to and haven’t already.

Reply | Quote

I haven’t done it – and lost sight of the project already. In the final stages of wrapping the book and I’ve been scattered.

Will try to get to it RSN….

 

Reply | Quote

Here is a new “FAST PUBLISH” article that doesn’t seem to involve Microsoft Dynamics: https://support.microsoft.com/en-us/help/4095640.

Reply | Quote

Does anybody know where online is it possible to report bugs to Microsoft?

There is a bug in OneDrive that keeps going away and returning with new updates and the only place where it looked like it is for such reporting does not work.

Reply | Quote

Only place I know is the Answers forum – and it’s not a very direct conduit.

You might have better results on Reddit.

Reply | Quote

I always hated those Dynamics CRM and SQL articles, they overwhelm the KB searches for no very-affirmative reason

1 user thanked author for this post.

woody

Reply | Quote

Yes, thank you, I do need to be kept up to date on Dynamics CRM patches.

mikeperth (who can’t log in)

1 user thanked author for this post.

MrBrian

Reply | Quote