Newsletter Archives

• MS-DEFCON 4: The gift of patching

  Posted on December 24, 2024 at 02:45 CST by Susan Bradley • Comment in the Forums

  

  ISSUE 21.52.1 • 2024-12-24

  

  By Susan Bradley • Comment about this alert

  ’Twas the night before Christmas, and all through the house and office, not a creature was stirring — except yours truly, because I was checking my systems to see whether they were all fully up to date.

  Seriously, I always find that the time around the holidays is a good moment to do your patching. After the holiday dinner has been served and everyone is in their holiday ham or turkey coma, I can sneak away to review my technology. The end of the year is just a week away, and as I always say, you should start the new year with everything polished and shiny. Therefore, I’m lowering the MS-DEFCON level to 4.

  Anyone can read the full MS-DEFCON Alert (21.52.1, 2024-12-24).

  AskWoody Plus Alert, MS-DEFCON Alerts, Crowdstrike, CVE-2024-49112, CVE-2024-49138, iOS 18, iOS 18.2, KB4484305, MS-DEFCON, MS-DEFCON 4, Outlook (new), Patch Lady Posts

• Lessons learned from CrowdStrike

  Posted on July 29, 2024 at 02:45 CDT by Susan Bradley • Comment in the Forums

  

  ISSUE 21.31 • 2024-07-29

  ON SECURITY

  

  By Susan Bradley

  It’s been over a week since the technology meltdown that impacted airlines, some banks, and even my sister’s Starbucks order through Uber Eats on Friday morning.

  Despite the carnage, only a very small segment of computer systems was impacted. In the Official Microsoft Blog, the post Helping our customers through the CrowdStrike outage pointed out that less than one percent of all Windows machines were affected.

  So why was this so impactful? More important, what lessons have we learned from this event? Is there anything we can do better next time?

  Read the full story in our Plus Newsletter (21.31.0, 2024-07-29).
  This story also appears in our public Newsletter.

  On Security BitLocker, Crowdstrike, CVE-2024-26184, CVE-2024-28899, Microsoft Defender, Newsletters, Patch Lady Posts, Recovery, Recovery Keys, Windows 11 24H2

• Bad antivirus definition triggers shutdowns

  Posted on July 20, 2024 at 02:45 CDT by Susan Bradley • Comment in the Forums

  

  ISSUE 21.29.1 • 2024-07-20

  

  By Susan Bradley

  It was a really bad day for IT admins.

  Late Thursday night, the security protection company CrowdStrike sent a bad antivirus definition file to its entire customer base. Because this faulty data file inserts itself into the Windows kernel, Windows does what it was designed to do — it goes directly to the blue screen of death (BSOD).

  Most of us can rest easy. CrowdStrike is not a product for the consumer or for a very small business. It’s an enterprise product, and thus its impact was widely seen in very large companies, triggering service interruptions for airlines, banks, healthcare providers — worldwide.

  Read the full Plus Alert (21.29.1, 2024-07-20).

  AskWoody Plus Alert Alerts, Antivirus, Blue screens of death, Crowdstrike, Outage, Patch Lady Posts

• If an advanced government-sponsored hacking team is out to get you, kiss your keester goodbye

  Posted on February 19, 2019 at 07:29 CST by woody • Comment in the Forums

  Security research firm Crowdstrike just published a report that should bring a chill to the heart of anyone working in security for a large firm or organization. They found that the “breakout time” — the amount of time from first penetration of a network to completely taking it over — varies depending on the source of the attack. If you’re up against an attack from one of the advanced Russian APT groups you have, on average, under 20  minutes to discover the intrusion and plug it.

  Twenty minutes.

  It is quite remarkable to see that Russia-based threat actors are almost 8 times as fast as their speediest competitor — North Korea-based adversaries, who themselves are almost twice as fast as intrusion groups from China.

  So if you’re getting attacked by a Chinese APT group, on average, you have five hours to knock them out.

  You have to sign up in order to get the report, but it makes very interesting reading. The graphics alone are worth the price of admission.

  

  (Bear = Russia, Chollima = North Korea, Panda = China, Kitten = Iran, Spider = ecrime groups)

  Thx Catalin Cimpanu, ZDNet

  Other APT, Crowdstrike