Sunday, March 15, 2015

…and if you did patch this week…syadmin tips and helps

Sadly, if you did apply your Windows Updates last week, it’s possible something broke.

Don’t give up hope…here are some tips and tools to keep you distracted

Cheers!

Claus Valca

Did you overlook any patching last week?

What a crazy, patch-filled couple of weeks it has been!

I’m dizzy.

First there are the Windows patches

Next there are those Adobe patches

Go get ‘em!

And for good measure, sometime recently Oracle released it’s own patches for Java. I didn’t realize I was behind until I checked!

Go get ‘em

Considerations…

Living without plug-ins such as Flash or Java - gHacks Tech News

Two EASY ways to check if you are up to date on your plugins:

Stay patched my friends!

--Claus Valca

Linkfest for Firefox, Vivaldi, and Chrome news

Firefox looks like it will be seeing some advanced feature options in an upcoming release

Vivaldi browser has some new snapshot releases out

And here is a tip that may help with image rendering speed improvement in Chrome

Cheers,

Claus Valca

Exploit Update

Why do I work so hard to bolster the defense-in-depth of our home Windows systems?

  • like keeping the browsers updated to their most current patch level?
  • like keeping all the third-party plug-ins updated to their most current patch level?
  • like running EMET, and Malwarebytes Anti-Exploit, and AV/AM software all at the same time?
  • like keeping our Windows OS’s religiously patched?

Because all it takes is tripping onto just one “good/trustworthy” website that has been exploited to serve up malware to a vulnerability and your system could be compromised and hosed.

More web exploits and attempts to stem the tide by the pros…

Constant Vigilance!

--Claus Valca

EMET 5.2 Now Out

News dropped this week that Microsoft released version 5.2 of their Enhanced Mitigation Experience Toolkit – EMET.

It has some new enhancements.

It installed just fine on both my Win 7 x64 systems along side Malwarebytes Anti-Exploit.

As previously mentioned, I’ve disabled the EMET protection for “iexplore.exe” so they play nicely, but that strategy seemed to work fine.

However, when I installed EMET 5.2 on Lavie’s Win 8.1 x64 laptop, despite disabling/removing the EMET protection settings for Internet Explorer, the browser continued to hang while I hat Malwarebytes Anti-Exploit going.

I could run just EMET 5.2 OR just Malwarebytes’ AE but I decided I still like the idea of both so I ended up having to roll back to EMET 5.1 where I don’t have an issue when iexplore.exe is disabled.

So, that’s my experience with EMET 5.2 so far.

Cheers,

--Claus Valca

Sunday, March 08, 2015

Sundry Sunday Sysadmin Links

As we face a multi-day rain deluge, and adjust to the “spring-forward” cycle of DST I’ve got a smidgen of new linkages of possible interest to sysadmins.

Take off those Wellingtons and pop open some hard-cider with me and find solace in the warmth from humming computer equipment and a good HDTV screen.

Enjoy.

I’m a bit late to the IE10/11 party for enterprise with the “Enterprise Mode” feature. We are still (yes) running IE 8 at the hot-dog factory and more than most in-house applications still require IE 8 platform compatibility – so here we stay for now. I’m hoping we can do some pilot testing of IE 11 and leverage these new IE technologies; Enterprise Mode, Enterprise site List, and Enterprise Site discovery. Hence the linkage below for additional research on my part.

Speaking of web-browsers and compatibility, careful and reflective readers of the GSD blog may recall quite the technical post (rant) a while back on Firefox and malware-detection/download monitoring that got my hackles all up and bothered.

Well, it looks like an upcoming (Firefox 39) version release will include a much-needed “bypass” option for the Safe Browsing security feature.

I get the core security concerns Safe Browsing was supposed to provide, but as a technical user, not having an easy override option was seriously frustrating. I’m glad to hear about this development.

Other Mozilla security features on the way or tips for addressing current issues from the Mozilla Security blog.

As a Samsung SSD EVO 840 user (and loving every minute of that upgrade decision), I’m always on the watch for news updates on firmware of software upgrades, and here is some tantalizing news. According to the Samsung Magician software used to manage the drive, I’ve currently got the most current firmware available; EXT0BB6Q. So I’m watching these like a hawk.

BETA: Windows Assessment and Deployment Kit (Windows ADK) for Windows 10 Technical Preview - Kurt Shintaku's Blog – Previously mentioned. I finally got around to downloading it alongside my Windows 8.1 ADK set and my Windows 7 AIK set and pulled out all the performance assessment, USMT, and deployment (WinPE) tools. Nice and sweet! Playtime continues with these upgraded Windows 10 toolsets.

INFO: Blogs, Sites & Social about Surface - Kurt Shintaku's Blog – I’m starting to familiarize myself with the Surface Pro 3 unit we got into the shop a while back. I’ve not fiddled with the stylus just yet, but the general usage is pretty straightforward. Kurt’s got some great linkage to additional blogs and sites for Surface Pro users so the best of these will be added into my RSS feed piles. The following in particular seemed quite good from a technical-support aspect (in contrast to product placement and cheerleading news).

Fixing Cisco AnyConnect Failed to Initialize Connection Subsystem on Windows 8.1 - Next of Windows – so basically a recent Windows Update may have hosed Cisco AnyConnect just a bit on Win 8.1 systems. The fix (workaround) is to just configure it to run in compatibility mode for Windows 8.

Windows: Black screen after February 2015 Update – Borns IT and Windows Blog (Google Translated from original) – I’ve seen this more than a few times at work after Windows Updates going back to at least December. The updates go on, the system reboots, and just seems to “hang” on a black screen forever. Rebooting doesn’t help and no visual indications present to let you know “something” is happening on the system. Like Gunter Born says, my experience is with some patience and waiting (from a few minutes to hours) the system finally resolves what it is doing and the “loading Windows” graphics appear and the system comes up. I’ve had techs who were too impatient and couldn’t wait and just wiped/reimaged the system so there is that approach as well, but patience goes a long way. I just wish this trend would be addressed on the next round of Windows Updates. It’s annoying at the worst and frustrating at best.

Update Error 8024001F by Microsoft FREAK workaround – Borns IT and Windows Blog (Google Translated from original) – I’ve been watching and monitoring the FREAK situation but haven’t been posting on it here. That said, Gunter Born’s post is worth reading for sysadmins, even if you aren’t directly in charge of working on the FREAK issues in your shop. For some cribbing on FREAK see below:

How to Remove uTorrent’s EpicScale Crapware From Your Computer – How-To Geek – I can’t really fault uTorrent as the installer seems to clearly indicate an option to install EpicScale “add-on” software but one wonders how many people were paying attention carefully during the installation process. That’s how lots and lots of third-party “I don’t really want or need it” enhancement-ware packages get pummeled into users’ systems. Anyway…here’s the discussion summarized and how to get it off your system if  you use uTorrent.

D-Link fixes the latest flaw in its routers, more patches on the way – Betanews – My DIR-655 router from D-Link is a hardware type “A” and as right now, I’m still running the most current (06/1/2013) firmware release version 1.37 so alas, no updates yet. Fingers crossed one will be offered in the near future. I’m not ready to pick up a new router yet as this one continues to work super-great and is more than fast enough.

DelFix deletes portable disinfection tools from your system automatically - gHacks Tech News – As someone who advocates use of free and portable adware and security tools, it’s nice to know there is a utility DelFix that can do some post-adware cleanup of the adware-cleaning software remnants. I like the concept but per Martin Brinkmann’s article on gHacks, it doesn’t currently offer a log advising you in advance what is going to get cleaned/nuked so you may be taking a risk to use it and I have to agree that I’d look forward to a future version that include some ability to review the actions to be taken (and selectivity accept them first) before execution.

Program launcher SyMenu integrates Nirsoft, Sysinternals and other programs - gHacks Tech News – I really like the SyMenu application. It is in my “projects” pile to fiddle with to see if it can help me manage my portable USB application folder. I’m sure it would do a wonderful job rather than my current method of just rummaging around in my utility folders for the tool I’m looking for. That said, it also includes the ability to integrate the NirSoft suite and the Sysinternals Suite. Pretty cool. Other tools that help with that process are:

Finally, every so often I drop in over at NoVirusThanks to check out some of their free tool offering and to see what they have been up to for new portable security and system utilities. Besides their free tools, they also offer some free network tools. Most may be replicated in other local utilities but it still may be worthwhile to bookmark them for reference just in case your USB stick isn’t handy.

Cheers!

Claus Valca

Harmonizing EMET and MBAE

In the GSD post “Anti-Virus Software Update - GSD Thoughts” I outlined the layered security approach I generally take on our Windows systems.

My layered use of the following products meets my own household needs but may not be adequate for less-than-advanced users.

  1. Free Firewall Software by GlassWire - Monitors and logs network connections…more used for logging than “active firewall blocking”.
  2. Sysmon - Sysinternals core service to log application/network executions
  3. Enhanced Mitigation Experience Toolkit - EMET - TechNet Security
  4. Microsoft Security Essentials - Microsoft Windows - Core AV protection
  5. Malwarebytes Premium - Supplemental real-time AV/AM protection
  6. (Optionally) Malwarebytes Anti-Exploit - Free Zero-Day Exploit Protection - browser layer protection

What I failed to clearly explain in that list is the following potential “gotcha” one may trip over.

Microsoft’s Enhanced Mitigation Experience Toolkit (EMET) – while generally very compatible both with Malwarebytes and Malwarebytes Anti-Exploit (MBAE) – seems to prevent smooth launching of the Internet Explorer web-browser when both are using default settings.

On both my Win 7 x64 and Lavie’s Win 8.1 x64 systems Firefox, Chrome/Chromium, and Vivaldi browsers all seem to work just fine with EMET and MBAE running…though I just keep to the default EMET configurations on install and don’t specifically add custom protection for Firefox/Chrome/Vivaldi to EMET. Internet Explorer (iexplore.exe) is included in the default EMET protection. And the free version of MBAE protects Firefox, Chrome, Internet Explorer and Opera browsers.

Many MBAE users recommend just skipping (or uninstalling) EMET but I find they do compliment each other nicely with the exception of Internet Explorer so I continue to run them together at the same time. With the following conditions noted below.

On Lavie’s Windows 8.1 system I actually - though great trial and error – arrived at a combination of EMET iexplore.exe protection feature checks/unchecks to get IE running smoothing with no issues along site MBAE. (When I can get Lavie’s laptop away from her, I’ll update this post with a screen shot of her Windows 8.1 MBAE configuration.)

On both my Windows 7 systems I just punted and disabled EMET protection for Internet Explorer entirely as I almost never use IE myself and will just trust MBAE to cover the EMET opening I’ve created with that strategy.

image

Likewise if you have the paid version of MBAE, you could optionally disable the IE protection in MBAE and leave the EMET protection in place; the free version doesn’t allow adding of processes or disabling of protections.

There are some Malwarebytes MBAE forum threads that try to address the tweaking of EMET more methodically.

Again, I managed to do that on Lavie’s Win 8.1 system and will eventually get around (probably) to either confirming the configuration for iexplore.exe in EMET 5.1 noted in the forum post above. Or I will find the combo that works on my Win 7 systems and post an update here as well.

In case you are curious to know if MBAE is actually protecting  your system, they do offer a series of tests files you can use to trigger the MBAE protection alert for validation.

In case you are curious, while working on researching this post, I found a few notices that a new version of Malwarebytes Anti-Malware (2.1) will be on the way soon. It is currently available in a Beta form if you are daring.

I’m looking forward to the changes and promised performance improvements.

Finally, in case you are interested, the Vivaldi browser I’ve been crushing on lately isn’t included in the free-version of MBAE protection. Again, if I was using the paid version, I’m pretty sure I could add the exe file to the list manually to provide customized protection. I imagine it should play well as it is based on Chrome/Chromium which does get protected by MBAE via its chrome.exe host process coverage.

I did pop into the Protection for new browsers - News, Questions and Comments Malwarebytes Forum and did the responsible thing by asking for vivaldi.exe to be added to the default protected browser list in MBAE.

Time will tell.

Cheers,

Claus Valca