Do Not Reuse Passwords

Password security is a growing field and the old conventional wisdom of using a “strong” password and changing it frequently has lead to people using the same “strong” password on many different websites, resulting in their complete identity being hijacked when any one of those sites is compromised.

HaveIBeenPwned (HIBP) is a service that collects data dumps from when websites are hacked and uses the data to provide a service to alert users whenever their accounts are compromised. It’s like a central clearinghouse for account monitoring. Unfortunately, by the time accounts are listed in HIBP it is often years after the account has been hacked and the hackers that originally took the account information have had that entire period to make use of your account details. Many websites store their passwords in plain text, and many of the others that do use password hashing algorithms to store only a mathematical representation of the password and not the password itself neglect to use properly salted hashes, which means that those hashed passwords can often be compared with rainbow tables to effectively convert them to their plain text equivalent. Seeing the passwords that people – still today – continue to use is destroying my hope in humanity. For example, “123456” is used by almost 1% of business professionals for their online social interactions. Dead serious.

The trends on these exposed passwords show that there are very common patterns and weak password consideration is the rule of the day. Few people, and by few I mean I could probably count them on one hand, actually do passwords right. It’s time to take your own security seriously, because the evidence shows that many of those you do business with do not.

Here’s the Problem

Weak passwords you’ve used on service x (Yahoo, for example) will be dumped along with all the other passwords on that hacked service. Those same weak passwords will be tested on service y and service z. And everywhere else. This process is called “password stuffing.”

If you reuse even part of your passwords then you open yourself up to being targeted either randomly or by evil people you may already know. “Script kiddies” live and die by their ability to make an example out of people who they feel have done them harm. You could also become the victim of automated scanners that consume the usernames and passwords from these dumps then try them on every known system from Facebook to Gmail to email to banking services. The passwords will be munged in order to test similar or stylistically equivalent passwords. For example, of the LinkedIn hack, almost 2.5 million accounts (or about 1.5%) used some variant of the site name in their password. Those same accounts probably use some variation of the site name in most of their passwords. This can safely be assumed to be done everywhere, meaning that if you use “linkedin123456” for LinkedIn, there’s a good chance that your Facebook password is “facebook123456”.

So when over a million people used “123456” as their LinkedIn password, not only did it expose that as a very commonly used password, but it demonstrated that those million-plus email addresses tied to those weak passwords were used by people that didn’t take security seriously. If you use a weak password anywhere, chances are good that you use weak passwords elsewhere, if not everywhere. If something as quick and easy as changing a password isn’t done, then you also probably neglect your hardware and software. You’re using older and insecure programs. You’re exposing all of yourself with a single simple decision that you think will make your life easier.

It doesn’t. Reusing even part of a password only makes life easier for whoever attacks you. They can stay in their momma’s basement and spend all day throwing your account details at different sites until they get in. When they do, it doesn’t hurt them, it hurts you. Two or three hijacked accounts, or variations on your passwords from multiple dumps show how you think, and the style and scope of password complexity you use.

Again referring to the 2012 LinkedIn hack, there were over 26,000 variations of passwords that included “12” or “2012” in the password. From this we can imply that users will seed their passwords with the year they changed it. The same accounts are probably still using the same patterns with “2019” or “2020” today.

“Different” !== Strong

Usually these dumps are sold on the black market or used by the original hacker for a while before they’re inevitably released publicly. The data is out there so it’s necessary to use defensive passwords.

You can’t just change a number at the end of your password and possibly think that it’s going to make a difference in your security. The delay it might impose against an organized attacker is less than a single second. You can’t create a strong password by typing random characters on your keyboard. You just can’t. The predictive value of muscle memory, social and cognitive signals, and even keyboard bias result in a relatively small set of potential values for manually-generated passwords.

1337-sp34k offers no additional protection.

Using a strong password is no longer a suggestion. To be secure in the current world you must use a strong, unique, randomly-generated password for any and all sites and services. Failing to do so will result in that password being used as the seed to corrupt your digital life later on. Maybe not today, maybe not tomorrow, but soon, and for the rest of eternity.

The rules used to be pretty simple, but were still never observed:

  • DO NOT use a series of numbers and a word or two. (123badpassword)
  • DO NOT use a word or two and a series of numbers. (badpassword123)
  • DO NOT use a word with numbers breaking it up. (1bad2password3)
  • DO NOT use the site name or URL as any part of the password. (mylinkedinpassword)
  • DO NOT use keyboard sequences like “qwerty” or “123456”.
  • DO NOT use any word or name related to you or your life (pets, family, friends, musicians).
  • DO NOT use dates or other simple patterns.

Unfortunately, these rules are still ignored, and even if they were followed to a T, these rules are no longer sufficient for creating a passwords or passphrases manually. Today, any password you can remember is not a good password. It’s time you put the effort into proper password management.

Fortunately, the new rules are actually simpler:

But my browser remembers my passwords!

All modern browsers (Chrome, Firefox, Edge, Safari) have password management built-in. You can use that in order to generate strong passwords and, while short, they’ll be unique for each site. Unfortunately, since these passwords are stored in the browser they can be extracted by any malicious software that manages to make it onto the device or compromise your browser Sync account, where password managers generally use much stronger encryption.

Websites are still catching up to the reality of password managers

Long passwords, 300 characters or more, are not a problem for your password manager, but they’re probably a problem for the site. BofA limits your password to 20 characters. Yahoo limits your password to 128 characters. Facebook allows much longer passwords, but only requires 6 characters and character case isn’t treated as significant so entropy is significantly reduced, especially for shorter passwords.

Some websites and app logins don’t allow you to copy & paste in the password field which means that they often don’t play well with password managers. Others (like AT&T and Yahoo) refuse to allow certain characters in passwords, so randomly generated passwords have to be manually munged instead of allowing them to be truly random.

Nevertheless, failing to use a password manager means that you’re not using random passwords at all, and are likely reusing passwords to your own peril.

The solution is to get a password manager now and immediately start working to migrate your accounts to it. Almost every password manager today offers password analysis to warn you of weak, reused, and known compromised passwords so you can prioritize changing the passwords for those accounts.

What’s your favorite password manager?

Updates 2020-06-03

Welcome back, Folks!

It’s not Patch Tuesday, but updates from Microsoft, Apple, Google, Mozilla, and many others have triggered an out-of-cycle update.

This Month in Technology

It took Apple over a month to resolve a security issue in their custom OAuth implementation, which would provide app-level access to any site that used Sign in with Apple given only an email address. Facebook and Google both suffered similar XSS issues recently, as did a very popular WordPress plugin.

Not accepting vulnerability reports doesn’t mean the vulnerabilities don’t exist, Apple. Even after vowing now to, Apple is still recording everything you say and do as long as you have Siri enabled.

It still surprises me that people that don’t read the documentation and license agreements still feel the need to sue over their failure to understand how software works. For anyone reading this years from now, browsers load web pages. “Incognito” mode (or any other privacy mode) simply prevents your data from being shared IN THE BROWSER between different sessions. It otherwise does not prevent any websites from operating exactly as they would if you were loading the web page in any other browser. As always, don’t do anything online that you don’t want to be tracked to you. Period.

Even so, eBay, Citibank, TD Bank, Ameriprise, Chick-fil-a, Equifax, and many more websites are performing port scans of visitors computers. If you’re concerned about your privacy, imagine the power companis like eBay and Equifax would have if they collected and consolidated details about every remote support platform installed and used by every visitor to their websites. We’re talking about hundreds of millions of people relying on companies that don’t have the best track record of keeping data safe in the first place.

Veracode reports that about 70% of all mobile and desktop applications contain open-source bugs. This reminds me of one of my favorite computer quotes: Every non-trivial program contains at least one bug. Every non-trivial program can be simplified by at least one line of code. The conclusion of the last two laws: Every non trivial program can be simplified to one line of code, and it will contain a bug.

A widely used EU Cookie Consent image is being used to distribute malware. Directly linking to third-party scripts and images has some serious long-term drawbacks.

As was expected by anyone that can math or understand science, suicide (as a result of the government lockdown) has killed more in California than the plandemic COVID-19. This is, of course, after churches are being burned to the ground for daring to try to serve the same people that currently frequent Walmart, Target and Lowes.

The Spectra exploit demonstrates just how easy it’s going to be to abuse the GACT/Contact Tracing services on many devices.

Now for the good news:

Windows 10 v2004 has been released. Make sure you’ve installed v1909 recently so you won’t be forced into the new build before they work out the bugs. I don’t see a lot of differences between v2004 and v1909 that most people would benefit from, anyway, but these releases tend to take a couple months to work out most of the bugs. For example, many Windows policies are erased during the upgrade which can result in local accounts being forced into using inescapable Microsoft accounts for users that don’t understand that “not now” is an option.

Let’s Get Busy

Apple released updates for macOS Catalina 10.15.5, macOS Catalina 10.15.5 Supplemental Update, Security Update 2020-003 Mojave, Security Update 2020-003 High Sierra, Windows Migration Assistant 2.2.0.0, iCloud for Windows 7.19, iCloud for Windows 11.2, Safari 13.1.1, Xcode 11.5, iOS 13.5.1, iPadOS 13.5.1, tvOS 13.4.6, watchOS 5.3.7, watchOS 6.2.6, and iTunes 12.10.7. These are security updates.

iOS 13.5.1 and 12.4.7 are security updates. Use Settings, General, Software Update to install the most current version. This version also adds the Orwellian contact tracing feature at the system level. While “disabled” by default, you may validate that it is disabled in Settings, Privacy, Health, COVID-19 Exposure Logging, and turn off Exposure Logging.

iPadOS 13.5.1 is a security update. Use Settings, General, Software Update to install the most current version.

tvOS 13.4.6 is a security update. Use Settings, General, Updates to install the most current version.

watchOS 5.3.7 and 6.2.6 are security updates. Use your updated iPhone to install the most current version through the Watch app.
https://support.apple.com/en-us/HT204641

Google has released security updates for Android 9 and 10 which will gradually be published by individual vendors and available to you in the coming weeks. This version also adds the Orwellian contact tracing feature. Disabling Location and Bluetooth will disable the current version of contact tracing.

Google Chrome OS 83.0.4103.77 is a security update. Use Menu, Help, About to install the most current version. A reboot is required.

Important Notes

Everything above this section should be checked by everyone on every computer. Chances are good that close to every single computer you touch will be affected by those updates. This is not the case with the items below, though you should still check each line item below to see if it applies to software you have installed.

Please remember that while I list many different applications within these updates, most people should ONLY install updates for a program if they already have a previous version of that program installed.

It is essential to maintain all the applications you have installed on your computer, but often you can minimize the time investment and the potential for exploitation simply by uninstalling software you do not need.

Also note that using the applications own “check for updates” function, when available, will best preserve your current settings, and often avoid any crapware that might come with a fresh installer. Use this option if it’s available to you.

Finally, if you’re sick of doing this all yourself, let me! Call or email me any time, and we can set you up with subscription SaferPC updates which will be installed each month whenever necessary. Click, call or email for more details:
https://saferpc.info/updates/
209-565-12PD
shawn@12pointdesign.com

Driver Updates

If you’re using this hardware – these updates are for you.

Display Driver Uninstaller 18.0.2.5 resolves an AMD audio bug. This is not a security update.
https://www.wagnardsoft.com/display-driver-uninstaller-ddu

Intel Driver and Support Assistant 20.6.22 improves OEM device support, performance and resolves several bugs. This is not a security update.
https://www.intel.com/p/en_US/support/detect

Logitech Options 8.20.329 adds support for Edge and resolves several bugs. This is not a security update.
https://www.logitech.com/en-us/product/options

nVidia 446.14 improves VRSS in Onward and resolves several stability, performance, and battery life issues. This is not a security update.
https://www.nvidia.com/Download/index.aspx?lang=en-us

Browser Updates

One or more of these are likely to be of interest to everyone.

Brave 1.9.76 is a security update. Use Menu, Help, About to install the most current version.
https://brave.com/

Google Chrome 83.0.4103.97 is a security update. Use Menu, Help, About to install the most current version.

Microsoft Edge 83.0.478.44 is a security update. Use Menu, Help, About to install the most current version.
https://www.microsoft.com/en-us/edge/business/download

Firefox 77.0 and 77.0.1 are security updates. Use Menu, Help, About to install the most current version.

Firefox ESR 68.9.0 is a security update. Use Menu, Help, About to install the most current version.

Email Updates

One or more of these are likely to be of interest to everyone.

Mailspring 1.7.8 is a security update.
https://getmailspring.com/

OutlookAttachView 3.40 changes the Image Preview feature to Preview Pane which will show other attachment types than images. This is not a security update.
https://www.nirsoft.net/utils/outlook_attachment.html

Internet Updates

One or more of these are likely to be of interest to everyone.

Trillian 6.3.0.5 resolves @mentions. This is not a security update.
https://www.trillian.im/

Trillian Mac 6.3.0.3 resolves a tooltip bug and removes some unused entitlements. This is not a security update.
https://www.trillian.im/

FileZilla Client 3.48.1 is not a security update.
https://filezilla-project.org/

FreeFileSync 10.24 resolves several bugs, improves compatibility, adds new macros and improves error handling. This is not a security update.
https://www.freefilesync.org/download.php

Zoom 5.0.26213.0602 resolves several bugs, enables GIPHY, improves privacy controls and admin controls, improves unmute behavior, and adds waiting room ringtone. This is not a security update.
https://zoom.us/

WinSCP 5.17.6 resolves several bugs. The installation package is a security update.
https://winscp.net/eng/index.php

Media Updates

These are unlikely to be of interest to most people.

iTunes 12.10.7 is a security update. Use Apple Software Update to install the most current version.

Game Updates

These are unlikely to be of interest to most people.

Steam 2020.06.01 adds “Play Next”, direct IP connectivity for Remote Play, P2P improvements, and resolves several bugs. This is not a security update.

PlayStation PS4 7.51 improves performance. This is not a security update.
https://www.playstation.com/en-us/support/system-updates/ps4/

Office Updates

One or more of these are likely to be of interest to most people.

Adobe Reader DC 20.009.20067 resolves several stability and reliability issues. This is not a security update. Use Help, Check for updates to get the most current version.

Atom 1.47.0 updates libraries and resolves several bugs. This is not a security update.
https://atom.io/

Audacity 2.4.1 resolves several bugs. This is not a security update.
https://www.fosshub.com/Audacity.html

LibreOffice Fresh 6.4.4 resolves nearly 100 bugs. This is not a security update. Be advised that “Fresh” is the beta version and should be avoided by most people.
https://www.libreoffice.org/

Lightworks NLE 2020.1 resolves hundreds of bugs and adds several new features. This is not a security update.
https://www.lwks.com/

Paint.net 4.2.12 resolves several bugs and improves metadata export between formats. This is not a security update.
https://www.getpaint.net/

MyPaint 2.0.1 resolves several bugs, including a repetitive load image quality loss bug. This is not a security update.
https://github.com/mypaint/mypaint/releases/latest

Security Software Updates

One or more of these is likely to be of interest to most people.

RogueKiller 14.5.0 updates the RKSvc, core engine, and resolves several bugs. This is not a security update.
https://www.adlice.com/download/roguekiller/

uBlock Origin 1.27.10 resolves several bugs. This is not a security update.

Capture Updates

These are unlikely to be of interest to most people.

ScreenToGif 2.24.2 resolves FFmpeg compatibility. This is not a security update.
https://github.com/NickeManarin/ScreenToGif/releases/latest

Converter Updates

These are unlikely to be of interest to most people.

DVDFab 11.0.8.9 adds support for new encodings and resolves several bugs. This is not a security update.
https://www.dvdfab.cn/download.htm

Utility Updates

These are unlikely to be of interest to most people.

DesktopOK 7.27 adds delete confirmation. This is not a security update.
https://www.softwareok.com/?seite=Freeware/DesktopOK

Easy2Boot 2.03 resolves several bugs and updates libraries. This is not a security update.
https://www.fosshub.com/Easy2Boot.html

Etcher 1.5.96 updates libraries and resolves several bugs. This should be treated as a security update.
https://www.balena.io/etcher/

GoodSync 11.2.0 improves compatibility and stability. This is not a security update.
https://12pd.com/click?goodsync

MPI Tool Kit 0.099 doesn’t provide a changelog so should be treated as a security update.
https://www.fosshub.com/Easy2Boot.html

MS ISO Downloader 8.37 adds images for developer and insider releases of Win10 build 19628, Office 2016/2019 for Mac, and resolves accessibility issues. This is not a security update.
https://www.heidoc.net/joomla/technology-science/microsoft/67-microsoft-windows-and-office-iso-download-tool

PointerStick 4.11 improves compatibility. This is not a security update.
https://www.softwareok.com/?seite=Freeware/PointerStick

PowerToys 0.18.1 adds Run and Keyboard manager, and resolves several bugs. This is not a security update.
https://github.com/microsoft/PowerToys/releases/latest

TeamViewer 15.6.7 improves performance of multi-participant sessions, allows disabling the Outlook add-in during installation, and resolves several bugs. This is not a security update.
https://www.teamviewer.com/en/download/windows/

WakeMeOnLan 1.86 updates the internal MAC address database. This is not a security update.
https://www.nirsoft.net/utils/wake_on_lan.html

WinScan2PDF 5.41 improves detection of multi-function devices. This is not a security update.
https://www.softwareok.com/?seite=Microsoft/WinScan2PDF

WizTree 3.33 resolves network drive access issues, improves export/import accuracy, and resolves several bugs. This is not a security update.
https://antibody-software.com/web/software/software/wiztree-finds-the-files-and-folders-using-the-most-disk-space-on-your-hard-drive/

ControlMyMonitor 1.26 now displays an error code if unable to parse settings from the display. This is not a security update.
https://www.nirsoft.net/utils/control_my_monitor.html

Cygwin 3.1.5 adds support for WSL symlinks and resolves several bugs. This is not a security update.
https://cygwin.com/

DesktopOK 7.41 resolves installation and removal bugs. This is not a security update.
https://www.softwareok.com/?seite=Freeware/DesktopOK

DevManView 1.67 adds an option to uninstall the selected device. This is not a security update.
https://www.nirsoft.net/utils/device_manager_view.html

FileLocator Pro 8.5.2946 resolves several bugs. This is not a security update.
https://www.mythicsoft.com/filelocatorpro/download

NetworkInterfacesView 1.21 adds Interface LUID column. This is not a security update.
https://www.nirsoft.net/utils/network_interfaces.html

Bitcoin 0.20.0 improves reliability and stability, removes dependency on OpenSSL, and resolves several bugs. This is not a security update.
https://bitcoin.org/en/download

NTLite 1.9.0.7490 adds several new setting controls and resolves several bugs.
https://www.ntlite.com/download/

WinScan2PDF 5.51 improves translations. This is not a security update.
https://www.softwareok.com/?seite=Microsoft/WinScan2PDF

Windows 10 Media Creation Tool v2004 is now available. This is not a security update.
https://www.microsoft.com/en-us/software-download/windows10

Developer Updates

These are unlikely to be of interest to most people.

ADB 30.0.0 adds support for wireless pairing, incremental APK installation, client-side support for compression of various commands with Android 11, and improves performance. This is not a security update.
https://developer.android.com/studio/releases/platform-tools

Inno Setup 6.0.5 is a security update.
https://www.jrsoftware.org/isdl.php

Node.js 14.4.0 resolves dozens of bugs. This is a security update.
https://nodejs.org/en/

Node.js 12.18.0 is a security update.
https://nodejs.org/en/

Android Studio 4.0.0.16 is a major update and adds several new features and improvements. This is not a security update.
https://developer.android.com/studio

SQLite 3.32.1 is a security update.
https://www.sqlite.org/download.html

TortoiseSVN 1.14.0 resolves several bugs. This is not a security update.
https://tortoisesvn.net/downloads.html

Virtual Machine Updates

These are unlikely to be of interest to most people.

VirtualBox 6.1.8-137981 resolves several bugs. This is not a security update.
https://www.virtualbox.org/wiki/Downloads

Web Package Updates

These are likely to be of interest only to web developers.

Drupal 8.9.0 is the final minor build of the 8.x series and updates libraries and resolves several bugs. Drupal 8.8.6 and 8.7.14 are security updates.
https://drupal.org/download

HumHub 1.5.2 resolves over 25 bugs. This is not a security update.
https://www.humhub.com/en/download

Nextcloud Server 19.0.0 adds document collaboration to video chats, password-less login, performance improvements, guest groups and more. This should be treated as a security update.
https://nextcloud.com/

Joomla 3.9.19 is a security update.
https://www.joomla.org/

phpList 3.5.4 is a security update.
https://www.phplist.org/

ScreenConnect 20.5.28493.7445 resolves several bugs. This is not a security update.
https://www.connectwise.com/software/control/download

Autoptimize 2.7.2 resolves several bugs. This is a security update.

BuddyPress 6.0.0 is a major update adding several new features and resolving many bugs. This is a security update.

Contact Form 7 5.1.9 resolves several bugs. This is not a security update.

myStickymenu 2.4.1 is a cosmetic update. This is not a security update.

Postie 1.9.52 resolves a category parsing bug. This is not a security update.

WooCommerce 4.2.0 resolves dozens of bugs. This is not a security update.

bbPress 2.6.5 doesn’t provide a changelog so should be treated as a security update.

Redirection 4.8 resolves two minor bugs and adds importer. This is not a security update.

Social Post Feed 2.15.1 adds several new features. This is not a security update.

Theme My Login 7.1 adds a new dashboard action, improves performance and resolves several bugs. This is not a security update.

W3 Total Cache 0.14.1 resolves several bugs. This is not a security update.

That’s all for now folks. Keep it clean out there. 😉

Regards,

Shawn K. Hall
https://SaferPC.info/
https://12PointDesign.com/

Updates 2020-05-12

Welcome back, Folks!

Today is Patch Tuesday for May 2020.

The next build of Windows 10 will be released in only two weeks. If you don’t want to be the guinea pig I strongly suggest you update to v1909 as soon as possible if you’re running an older build. This will grant you a reprieve from the new version for a couple months. Let everyone else beta test and you can upgrade when they’ve worked out the bugs.

Furthermore, yesterday was the last day of support for commercial versions of Windows 10 prior to v1809 (build 17763). If you’re running an older version upgrade to v1909 ASAP to maintain security updates for your device.

This Month in Technology

Send a text, get root.

Even more bad news for Apple devices, as Google’s Project Zero has discovered “numerous new vulnerabilities” on all Apple hardware, and all Apple devices with Thunderbolt ports are vulnerable to an unpatchable security exploit.

But it’s not just Apple. Samsung is patching recent devices from their Galaxy line, though every Galaxy device they produced over the last 7 years is vulnerable to a similar “perfect 10” vulnerability in image parsing.

Ghost and LineageOS were hacked using known vulnerabilities in SaltStack that were left unaddressed. Fortunately it doesn’t look like any serious damage was done.

Pitney Bowes has been hacked again.

Watering holes (places that aggregate data from many accounts and services) will always be prime targets. If you’re not increasing your defense-in-depth posture at your watering hole, expect to be repeatedly violated. Ask LabCorp.

Government-approved monopolies are far too frequently granted exceptions others are not. PG&E, despite causing the fires that killed over a hundred people and destroyed over 25,000 homes and triggering the current insurance crisis in California, has had their $200 million fine waived.

Racists take aim at technology, banning the use of names of colors in the UK.

If you support the lockdown, is it because you hate science or just math? Face masks increase your risk, not the other way around. There’s no such thing as perfect safety.

I won’t try to make a distinction between the junk science you worship and actual science. You’re too far gone for that.

The lockdown is proving more lethal than the coronavirus as suicides exceed COVID-19 deaths in Australia.

Now for the good news:

A massive 10,000+ device botnet is dying out. Sadly, this isn’t one of the truly evil ones that was used for severe malicious actions, but rather just for downloading Anime.

Let’s Get Busy

Now back to our regularly scheduled program. Thanks to the unstopping barrage of updates pushed during “weekly update quarantine”, Patch Tuesday this month is not that bad. The typical computer should see roughly 1.2 GB in updates today. Let’s get started.

Microsoft released updates for Windows, .NET, Internet Explorer, Servicing Stack, and MSRT (~800 MB). This includes security updates. A reboot is required.

Adobe Flash Player 32.0.0.371 is a security update.
Win: https://12pd.com/click?flash
Win: https://12pd.com/click?flashie
Mac: https://12pd.com/click?flashmac

Don’t forget to check your mobile devices, too! Many updates will also apply to your tablet, phone, kindle or television – so check your device-appropriate App Store and install updates.

Important Notes

Everything above this section should be checked by everyone on every computer. Chances are good that close to every single computer you touch will be affected by those updates. This is not the case with the items below, though you should still check each line item below to see if it applies to software you have installed.

The release of macOS Catalina (10.15) means that macOS Sierra (10.12) and older are no longer supported. If you can not install at least macOS High Sierra (10.13) on your Mac then you should immediately remove it from the Internet and use it offline only. It will no longer receive patches or updates and can now no longer be secured.

The now-current release of the Windows 10 (1909) is a pretty small update so will install quickly. Windows 10 pushes you to get the latest Windows 10 release every 6 months. If you don’t let it finish and you’re on a slow connection, this process kill your Internet performance forever. If you don’t have the bandwidth to download the bits, I’m happy to provide loaner USB drives to our local clients, or, if you prefer to have me mail it to you please contact me for information.

Please remember that while I list many different applications within these updates, most people should ONLY install updates for a program if they already have a previous version of that program installed.

It is essential to maintain all the applications you have installed on your computer, but often you can minimize the time investment and the potential for exploitation simply by uninstalling software you do not need or use, reducing the attack surface.

Also note that using the applications own “check for updates” function, when available, will best preserve your current settings, and often avoid any crapware that might come with a fresh installer. Use this option if it’s available to you.

Finally, if you’re sick of doing this all yourself, let me! Call or email me any time, and we can set you up with subscription SaferPC updates which will be installed each month whenever necessary. Click, call or email for more details:
https://saferpc.info/updates/
209-565-12PD
shawn@12pointdesign.com

Browser Updates

One or more of these are likely to be of interest to everyone.

Brave 1.8.95 is a security update. Use Menu, Help, About to install the most current version.
https://brave.com/

Google Chrome 81.0.4044.138 is a security update. Use Menu, Help, About to install the most current version.

Microsoft Edge 81.0.416.72 is a security update. Use Menu, Help, About to install the most current version.
https://www.microsoft.com/en-us/edge/business/download

Firefox 76.0.1 follows shortly after 76.0 which is a security update. 76.0.1 resolves several compatibility issues. Use Menu, Help, About to install the most current version.

Firefox ESR 68.8.0 is a security update. Use Menu, Help, About to install the most current version.

SeaMonkey 2.53.2 is a security update.
https://www.seamonkey-project.org/releases/

Vivaldi 3.0.1874.38 is a security update. Use Menu, Help, About to install the most current version.
https://vivaldi.com/

Email Updates

One or more of these are likely to be of interest to everyone.

Thunderbird 68.8.0 is a security update. Use Menu, Help, About to install the most current version.

Internet Updates

One or more of these are likely to be of interest to everyone.

Trillian 6.3.0.4 resolves several bugs. This is not a security update.
https://www.trillian.im/

Npcap 0.9991 resolves several bugs and improves compatibility. This is not a security update.
https://nmap.org/npcap/

Zoom 5.0.24046.0510 improves local privacy. This is not a security update.
https://zoom.us/

Media Updates

These are unlikely to be of interest to most people.

Picard 2.3.2 resolves several bugs and improves compatibility. This is not a security update.
https://picard.musicbrainz.org/

Game Updates

These are unlikely to be of interest to most people.

Nintendo Switch 10.0.2 resolves a pairing bug and improves stability. This is not a security update.

Tekkit Server 1.2.9i disables mod update checks resolving a crash bug. This is not a security update.
http://www.technicpack.net/modpack/tekkitmain

Office Updates

One or more of these are likely to be of interest to most people.

Adobe Reader DC 20.009.20063 is a security update. Use Help, Check for updates to install the most current version.

Adobe Acrobat 2020.009.20063, 2017.011.30171, and 2015.006.30523 are security updates. Use Help, Check for updates to install the most current version.

Atom 1.46.0 resolves several bugs. This is not a security update.
https://atom.io/

Adobe DNG Software Development Kit (SDK) 1.5.1 is a security update.
Win: https://supportdownloads.adobe.com/product.jsp?product=120&platform=Windows
Mac: https://supportdownloads.adobe.com/product.jsp?product=120&platform=Macintosh

Security Software Updates

One or more of these is likely to be of interest to most people.

RogueKiller 14.4.2 resolves a crash bug and updates service. This is not a security update.
https://www.adlice.com/download/roguekiller/

TinyWall 3.0.4 resolves several bugs. This is not a security update.
https://tinywall.pados.hu/

Capture Updates

These are unlikely to be of interest to most people.

ScreenToGif 2.24 resolves several bugs and adds two-pass FFmpeg option. This is not a security update.
https://github.com/NickeManarin/ScreenToGif/releases/latest

SnagIt 2020.1.2 resolves several crash bugs and improves compatibility. This is a security update.
https://download.techsmith.com/snagit/enu/snagit.exe

Converter Updates

These are unlikely to be of interest to most people.

MKVToolnix 46.0.0 resolves several bugs. This is not a security update.
https://www.fosshub.com/MKVToolNix.html

HandBrake 1.3.2 resolves several bugs. This is not a security update.
https://handbrake.fr/

Utility Updates

These are unlikely to be of interest to most people.

1Password for Mac 7.5 adds password sharing by link, and resolves several bugs. This is a security update.
https://1password.com/downloads/mac/

DesktopOK 7.17 adds silent install support, resolves several bugs, and updates language files. This is not a security update.
https://www.softwareok.com/?seite=Freeware/DesktopOK

Etcher 1.5.87 resolves several bugs and improves compatibility. This is not a security update.
https://www.balena.io/etcher/

GoodSync 11.1.8 improves compatibility. This is not a security update.
https://12pd.com/click?goodsync

IsMyHdOK 2.15 improves drive type detection. This is not a security update.
https://www.softwareok.com/?seite=Microsoft/IsMyHdOK

MS ISO Downloader 8.36 updates libraries and adds new disk images. This should be treated as a security update.
https://www.heidoc.net/joomla/technology-science/microsoft/67-microsoft-windows-and-office-iso-download-tool

OSFMount 3.0.1006 resolves several bugs. This is not a security update.
https://www.osforensics.com/tools/mount-disk-images.html

PointerStick 4.01 updates language files. This is not a security update.
https://www.softwareok.com/?seite=Freeware/PointerStick

PowerToys 0.17.0 adds native automatic update and updates FancyZones behavior. This is not a security update.
https://github.com/microsoft/PowerToys/releases/latest

PSAppDeploy 3.8.2 resolves several bugs. This is a security update.
https://psappdeploytoolkit.com/

WifiChannelMonitor 1.60 updates the internal MAC addresses file. This is not a security update.
https://www.nirsoft.net/utils/wifi_channel_monitor.html

WinScan2PDF 5.33 improves WIA compatibility and resolves several bugs. This is not a security update.
https://www.softwareok.com/?seite=Microsoft/WinScan2PDF

Developer Updates

These are unlikely to be of interest to most people.

Android Studio 3.6.3.0 resolves a caching bug. This is not a security update.
https://developer.android.com/studio

Node.js 14.2.0 improves error handling and monitoring with assertions, and resolves several bugs. This is a security update.
https://nodejs.org/en/

Visual Studio Code 1.45 improves accessibility, color, syntax, and semantic highlighting, performance, and GitHub integration. This is not a security update.
https://code.visualstudio.com/

Web Package Updates

These are likely to be of interest only to web developers.

OpenCart 3.0.3.3 replaces all PayPal extensions with PayPal Commerce platform. This is not a security update.
https://www.opencart.com/

Adminer 4.7.7 is a security update.
https://www.adminer.org/en/

OpenPetra 2020.04 resolves several bugs, adds Sponsorship module, improves initial setup and updates libraries. This is a security update.
https://www.openpetra.org/

Autoptimize 2.7.1 resolves several bugs. This is not a security update.

Social Post Feed 2.14.1 resolves a bug in notices. This is not a security update.

Postie 1.9.51 removes functions from logon screen. This is not a security update.

Redirection 4.7.2 resolves several bugs. This is not a security update.

NextScripts Social Networks Auto-Poster 4.3.15 improves compatibility. This is not a security update.

Top Commentators Widget 1.6 removes deprecated functions. This is not a security update.

WooCommerce 4.1.0 updates dependencies, resolves several bugs. This is a security update.

WP Mail SMTP 2.0.1 improves compatibility. This is not a security update.

Show IDs 1.1.4 improves compatibility with WordPress 5.4.1.

That’s all for now folks. Keep it clean out there. 😉

Regards,

Shawn K. Hall
https://SaferPC.info/
https://12PointDesign.com/

Updates 2020-04-14

Welcome back, Folks!

Today is the real Patch Tuesday for April 2020.

The next build of Windows 10 is just around the corner. If you don’t want to be the guinea pig I strongly suggest you update to v1909 as soon as possible if you’re running an older build. This will grant you a reprieve from the new version for a couple months. Let everyone else beta test and you can upgrade when they’ve worked out the bugs.

This Month in Technology

France content publishers have won a tiny victory against Google. The French competition authority now requires Google (and presumably other news publishers) to pay for republication rights when including a snippet of content. Google simply removed the snippet and now publishes only the title and URL.

A scale 10.0 vulnerability in VMWare has placed most corporate and cloud offerings at severe risk of data compromise.

The latest build of the Switch operating system now lets you move downloaded games to an SD card and remap buttons.

Mozilla’s new privacy-first stance doesn’t apply to their own new telemetry collection.

Now for the good news:

Commissioner Carr of the FCC points out that US internet speed are up 70% since the repeal of Net Neutrality.

Let’s Get Busy

Now back to our regularly scheduled program. Thanks to the unstopping barrage of updates pushed during “weekly update quarantine”, Patch Tuesday this month is pretty light. The typical computer should see roughly 900 MB in updates today. Let’s get started.

Microsoft released updates for Windows, Internet Explorer, and MSRT (~600 MB). This includes security updates. A reboot is required.

Apple released updates for macOS Catalina 10.15.4 and watchOS 6.2.1. This includes security updates. Use Apple Software Update to install the most current versions. Be aware that the 10.15.4 update is known to brick some Apple hardware, so I recommend waiting for 10.15.5, due in about 10 days.

watchOS 6.2.1 is a security update. Use the Watch app on your iPhone to install the most current version.

Adobe Flash Player 32.0.0.363 is a security update.
Win: https://12pd.com/click?flash
Win: https://12pd.com/click?flashie
Mac: https://12pd.com/click?flashmac

Don’t forget to check your mobile devices, too! Many updates will also apply to your tablet, phone, kindle or television – so check your device-appropriate App Store and install updates.

Important Notes

Everything above this section should be checked by everyone on every computer. Chances are good that close to every single computer you touch will be affected by those updates. This is not the case with the items below, though you should still check each line item below to see if it applies to software you have installed.

The release of macOS Catalina (10.15) means that macOS Sierra (10.12) and older are no longer supported. If you can not install at least macOS High Sierra (10.13) on your Mac then you should immediately remove it from the Internet and use it offline only. It will no longer receive patches or updates and can now no longer be secured.

The now-current release of the Windows 10 (1909) is a pretty small update so will install quickly. Windows 10 pushes you to get the latest Windows 10 release every 6 months. If you don’t let it finish and you’re on a slow connection, this process kill your Internet performance forever. If you don’t have the bandwidth to download the bits, I’m happy to provide loaner USB drives to our local clients, or, if you prefer to have me mail it to you please contact me for information.

Please remember that while I list many different applications within these updates, most people should ONLY install updates for a program if they already have a previous version of that program installed.

It is essential to maintain all the applications you have installed on your computer, but often you can minimize the time investment and the potential for exploitation simply by uninstalling software you do not need or use, reducing the attack surface.

Also note that using the applications own “check for updates” function, when available, will best preserve your current settings, and often avoid any crapware that might come with a fresh installer. Use this option if it’s available to you.

Finally, if you’re sick of doing this all yourself, let me! Call or email me any time, and we can set you up with subscription SaferPC updates which will be installed each month whenever necessary. Click, call or email for more details:
https://saferpc.info/updates/
209-565-12PD
shawn@12pointdesign.com

Browser Updates

One or more of these are likely to be of interest to everyone.

Microsoft Edge 81.0.416.53 is a security update. Use Menu, Help, About to install the most current version.
https://www.microsoft.com/en-us/edge/business/download

Brave 1.7.92 is a security update.
https://brave.com/

Email Updates

One or more of these are likely to be of interest to everyone.

Thunderbird 68.7.0 is a security update. Use Menu, Help, About to install the most current version.

Internet Updates

One or more of these are likely to be of interest to everyone.

Zoom 4.6.20559.0413 is a security update. Click the user icon, Check for updates to install the most current version.
https://zoom.us/

Media Updates

These are unlikely to be of interest to most people.

Unreal Media Server 14.0 adds support for live HEVC (h265) video, output to UMS and MPEG2-TS players, streaming HTML5 video elements, and resolves several bugs. This is not a security update.
http://www.umediaserver.net/umediaserver/download.html

Office Updates

One or more of these are likely to be of interest to most people.

Artweaver 7.0.5 improves hardware compatibility, and resolves several bugs. This is not a security update.
https://www.artweaver.de/

IcoFX 3.4 improves hostory and semitransparent export, and resolves several bugs. This is not a security update.
https://icofx.ro/

Adobe ColdFusion 2016.15 and 2018.9 are security updates.
https://helpx.adobe.com/coldfusion/kb/coldfusion-2016-update-15.html
https://helpx.adobe.com/coldfusion/kb/coldfusion-2018-update-9.html

Adobe After Effects 17.0.6 is a security update. Use Creative Cloud Desktop to install the most current version.

Adobe Digital Editions 4.5.11.187303 is a security update.
https://www.adobe.com/solutions/ebook/digital-editions/download.html

Adobe Camera Raw 12.2.1 doesn’t provide a changelog and download links don’t work. It could be a security update, but doesn’t look like it’s actually available yet.

Adobe DNG Converter 12.2.1 adds support for newer hardware. This is not a security update.
https://supportdownloads.adobe.com/detail.jsp?ftpID=6913
https://supportdownloads.adobe.com/detail.jsp?ftpID=6915

Security Software Updates

One or more of these is likely to be of interest to most people.

IISCrypto 3.2 adds a Protocols Enabled control. This is not a security update.
https://www.nartac.com/Products/IISCrypto/Default.aspx

Capture Updates

These are unlikely to be of interest to most people.

ScreenToGif 2.23.1 resolves a relative path bug. This is not a security update.
https://github.com/NickeManarin/ScreenToGif/releases/latest

Converter Updates

These are unlikely to be of interest to most people.

DVDFab 11.0.8.4 adds support for new encodings, performance improvements, and improved scaling with newer hardware. This is not a security update.
https://www.dvdfab.cn/download.htm

Utility Updates

These are unlikely to be of interest to most people.

DesktopOK 6.93 improves Tools. This is not a security update.
https://www.softwareok.com/?seite=Freeware/DesktopOK

GoodSync 10.11.5 resolves several bugs. This is not a security update.
https://12pd.com/click?goodsync

TeamViewer 15.4.8332 doesn’t have a published changelog so should be treated as a security update.
https://www.teamviewer.com/en/download/windows/

Developer Updates

These are unlikely to be of interest to most people.

Visual Studio Code 1.44 improves accessibility, adds preserved undo/redo beyond application closure, remote checkout into containers, timeline view, settings sync and more. This is not a security update.
https://code.visualstudio.com/

Java 8u251 is a security update. If you are not 110% sure you require Java, it’s best to remove it. Java and JavaScript are not the same thing and few desktop applications actually require Java.
https://www.java.com/en/download/manual.jsp

Web Package Updates

These are likely to be of interest only to web developers.

myStickymenu 2.3.9 fixes a bug in the notification bar. This is not a security update.

Postie 1.9.46 resolves a notification bug. This is not a security update.

That’s all for now folks. Keep it clean out there. 😉

Regards,

Shawn K. Hall
https://SaferPC.info/
https://12PointDesign.com/

Updates 2020-04-08

Doesn’t it still feel like April Fools’ Day, Folks?

It’s not Patch Tuesday, but updates from Apple, Google, Mozilla, Zoom, and others have triggered an out-of-cycle update.

This Month/Week in Technology

What do you do when you’re locked in a box? You look for ways to get out, even if it’s only virtually. Zoom has become the de facto video-chat client over the last couple months, and its sudden rise to success has brought some peril as well. Several security vulnerabilities, massive privacy issues, and more.

While these are serious issues, it’s not just Zoom that’s having problems keeping their systems secure.

Apple’s macOS and iOS are both vulnerable to rather simple security bypasses with misspellings dyslexics wouldn’t fall for, and their default-allow behavior for all Apple-provided apps means that a malicious website could enable the camera or microphone on any Safari users device, which accounts for about half of all mobile devices and the vast majority of browsing from macOS.

HP Support Assistant, like Dell SupportAssist, is vulnerable to several remote-code execution attacks.

Windows is currently suffering from a font-parsing bug that enables a malicious font to hijack your computer. Since any website can push its own fonts, this is a big deal.

Tests by Cisco’s Talos with fingerprint authentication demonstrate that fingerprint sensors can be quickly bypassed about 80% of the time with the right planning and hardware.

Even video games are being used to mine cryptocurrency on your hardware.

Slow adoption to fix weaknesses in the design of BGP means anyone can still hijack access to very popular sites with almost no effort.

Like improperly secured AWS ElasticSearch databases, Docker clusters are now suffering from passwordless entry to control instances.

There’s no such thing as perfect security. In everything, you will always depend on things you can not control.

So if someone contacts you about a security issue, you should take them seriously.

And you’d be a fool to make claims that your security is unbreakable. Especially while screwdrivers exist.

Still trust government? Secret courts, investigators not even following the minimal requirements of their position. What could go wrong? The FBI broke FISA rules in every single case the Inspector General studied.

The quarantine has forced even NASA to be closed off from the rest of the world. In doing so NASA reports that they’re seeing an “exponential” jump in malware attacks. Either the staff at NASA isn’t as technically competent as one would expect, or that their CIO just can’t math.

Now for the good news:

A huge unusual hole has opened over the Arctic! This may not sound like good news, but hopefully they’ll perform some research to identify the cause is the recent release of 5G and nip it in the bud, and in so doing finally put an end to this plandemic as well.

Let’s Get Busy

iOS 13.4.1 is a security update. Use Settings, General, Software Update to install the most current version.

Google Chrome OS 80.0.3987.162 is a security update. Use Menu, Help, About to install the most current version. A reboot is required.

Don’t forget, next week is the real Patch Tuesday, so expect security updates from Microsoft, Apple, Oracle, and much much more in less than a week.

Important Notes

Everything above this section should be checked by everyone on every computer. Chances are good that close to every single computer you touch will be affected by those updates. This is not the case with the items below, though you should still check each line item below to see if it applies to software you have installed.

Please remember that while I list many different applications within these updates, most people should ONLY install updates for a program if they already have a previous version of that program installed.

It is essential to maintain all the applications you have installed on your computer, but often you can minimize the time investment and the potential for exploitation simply by uninstalling software you do not need.

Also note that using the applications own “check for updates” function, when available, will best preserve your current settings, and often avoid any crapware that might come with a fresh installer. Use this option if it’s available to you.

Finally, if you’re sick of doing this all yourself, let me! Call or email me any time, and we can set you up with subscription SaferPC updates which will be installed each month whenever necessary. Click, call or email for more details:
https://saferpc.info/updates/
209-565-12PD
shawn@12pointdesign.com

Browser Updates

One or more of these are likely to be of interest to everyone.

Brave 1.5.123 is a security update. Use Menu, Help, About to install the most current version.
https://brave.com/

Google Chrome 81.0.4044.92 is a security update. Use Menu, Help, About to install the most current version.

Firefox 75.0 is a security update. Use Menu, Help, About to install the most current version.

Firefox ESR 68.7.0 is a security update. Use Menu, Help, About to install the most current version.

Vivaldi 2.11.1811.52 is a security update. Use Menu, Help, About to install the most current version.
https://vivaldi.com/

Internet Updates

One or more of these are likely to be of interest to everyone.

Zoom 4.6.20033.0407 is a security update.
https://zoom.us/

Npcap 0.9990 resolves several bugs. This is not a security update.
https://nmap.org/npcap/

Media Updates

These are unlikely to be of interest to most people.

Flickr Downloadr 3.3.1.1 resolves several bugs and update packaging process. This is not a security update.
https://flickrdownloadr.com/downloads/

Security Software Updates

One or more of these is likely to be of interest to most people.

uBlock Origin 1.26.0 resolves several bugs, improved DNS controls and defusers, and adds remove-class scriptlet. This is not a security update.

Capture Updates

These are unlikely to be of interest to most people.

ScreenToGif 2.23 resolves several bugs. This is not a security update.
https://github.com/NickeManarin/ScreenToGif/releases/latest

Converter Updates

These are unlikely to be of interest to most people.

MKVToolnix 45.0.0 resolves several bugs, improves multiplexer and error handling. This is not a security update.
https://www.fosshub.com/MKVToolNix.html

Utility Updates

These are unlikely to be of interest to most people.

1Password for Windows 7.4.763 improves install/uninstall, and resolves several bugs, including a master password storage bug. This is not a security update.
https://1password.com/downloads/windows/

BulkFileChanger 1.71 resolves a type detection bug. This is not a security update.
https://www.nirsoft.net/utils/bulk_file_changer.html

NTLite 1.9.0.7407 adds new settings controls, improves compatibility, and resolves several bugs. This is not a security update.
https://www.ntlite.com/download/

Homedale 1.87 improves channel detection. This is not a security update.
https://www.the-sz.com/products/homedale/

Easy2Boot 2.01 adds isowin support, and now uses the more accurate *bibyte (MiB, GiB) syntax for partition sizes. This is not a security update.
https://www.fosshub.com/Easy2Boot.html

MPI Tool Kit 0.098 updates SWITCH_E2B and grub4dos. This is not a security update.
https://www.fosshub.com/Easy2Boot.html

Web Package Updates

These are likely to be of interest only to web developers.

Drupal 8.7.13 resolves several bugs that prevented successful updates from 8.6 and earlier. This is not a security update.
https://drupal.org/download

NextScripts Social Networks Auto-Poster 4.3.14 adds WordPress 5.4 support and improves compatibility with LinkedIn and Mailchimp. This is not a security update.

W3 Total Cache 0.13.2 resolves two minor bugs. This is not a security update.

That’s all for now folks. Keep it clean out there. 😉

Regards,

Shawn K. Hall
https://SaferPC.info/
https://12PointDesign.com/