Updates 2020-08-11

Welcome back, Folks!

Today is Patch Tuesday for August 2020.

This Month in Technology

I pride myself in my sarcastic wit and infinite patience, but these days I spend so much time shaking my head in such shame for humanity that I’m afraid I’m going to get whiplash.

I’m trying to keep on the topic of technology, but it’s hard when that very technology is being used to silence, stalk, abuse, and defame so many. What’s worse is that when they’re caught they just throw money at those investigating them in order to escape culpability.

Cancel Culture was obvious to authors in the 1930s, but has been ignored over the last decade because those who speak up are themselves cancelled. Richard Stallman explains his position on digital currencies being evil, and how technological tracking will inevitably be used for cancel culture. (Heck, even Bill Maher opposes cancel culture!) Sadly, it may be too late to stop at this point, since cancel culture has now escaped planet Earth to infect the cosmos.

Canon was hacked, Avon was hacked, Intel was hackedGarmin was hacked, Walmart was hacked and is being sued under the CCPA over it, Capital One was finally punished for being hacked, Dave was hackedLedger was hacked, exposing a million accounts and emails, Tor has been hacked (the vulnerabilities have actually been known for *years*), nearly a thousand enterprise VPN servers have been hacked, 62,000 NAS devices have been hacked and infected, and Twitter was hacked (by a Florida teen who exposed Twitter’s “nonexistent” censorship tools). Is it any wonder Twitter was hacked since it took them almost two years to patch an app vulnerability?

A dozen VPN providers used an unprotected and insecure storage to harvest details of over twenty million (20,000,000) users, including payment details and traffic history.

Google is harvesting data from third parties to build rival apps, but it doesn’t stop there – they also “accidentally” enabled their Google Home smart devices to listen 24/7 and record their environments.

A TeamViewer vulnerability allows anyone running a version older than those released *yesterday* to be hacked, and of the 79 Netgear router models that have known security vulnerabilities, Netgear has announced they won’t patch 45 of them – including several AC models that are only 3 years old, and Snapdragon chip vulnerabilities put over a billion Android devices at risk. On the subject of defective hardware, BadPower can light you up!

Microsoft is flagging HOSTS files used to block unwanted telemetry as malicious. Evil extensions continue to be evil. AT&T “accidentally” tells all their customers they have to replace their brand new phones in order to continue to use cell service, Humana (Tricare) “accidentally” told 600,000 US military veterans that they were infected with COVID-19.

Advertisements are evil privacy-erasing monsters, but Ad URLs are worse.

Now for the good(?) news:

Recently, the lockdowns are responsible for more suicides and deaths by overdose than COVID-19. That’s gotta be a silver lining somehow, right?

Let’s Get Busy

Now back to our regularly scheduled program.

Patch Tuesday this month is huge. The typical computer should see roughly 2 GB in updates today. Let’s get started.

Microsoft released updates for Windows, Edge, .NET, Internet Explorer, Office, Servicing Stack, and MSRT (~1.3 GB). This includes security updates. A reboot is required.

Apple released updates for macOS Catalina 10.15.6, Security Update 2020-004 Mojave, Security Update 2020-004 High Sierra, Safari 13.1.2, Xcode 11.6, iCloud for Windows 11.3, iCloud for Windows 7.20, iTunes 12.10.8 for Windows. This includes security updates. Use Apple Software Update to install these updates. A reboot is required.

iOS 13.6 and 12.4.8, and iPadOS 13.6 are security updates. Use Settings, General, Software Update to install the most current update.

watchOS 6.2.8 and 5.3.8 are security updates. Use the Watch app on your iPhone to install the most current version.

tvOS 13.4.8 is a security update. Use System, Software Update to install the most current version.

Adobe Flash Player 32.0.0.414 is a security update.
Win: https://12pd.com/click?flash
Win: https://12pd.com/click?flashie
Mac: https://12pd.com/click?flashmac

Google Chrome OS 84.0.4147.110 is a security update. Use Menu, Help, About to install the most current version. A reboot is required.

Don’t forget to check your mobile devices, too! Many updates will also apply to your tablet, phone, kindle or television – so check your device-appropriate App Store and install updates.

Important Notes

Everything above this section should be checked by everyone on every computer. Chances are good that close to every single computer you touch will be affected by those updates. This is not the case with the items below, though you should still check each line item below to see if it applies to software you have installed.

The release of macOS Catalina (10.15) means that macOS Sierra (10.12) and older are no longer supported. If you can not install at least macOS High Sierra (10.13) on your Mac then you should immediately remove it from the Internet and use it offline only. It will no longer receive patches or updates and can now no longer be secured.

The now-current release of the Windows 10 (2004) is a huge (about 25% larger than any prior build) so will take a long time to download on slower connections. Windows 10 pushes you to get the latest Windows 10 release every 6 months. If you don’t let it finish and you’re on a slow connection, this process kill your Internet performance forever. If you don’t have the bandwidth to download the bits, I’m happy to provide loaner USB drives to our local clients, or, if you prefer to have me mail it to you please contact me for information.

Please remember that while I list many different applications within these updates, most people should ONLY install updates for a program if they already have a previous version of that program installed.

It is essential to maintain all the applications you have installed on your computer, but often you can minimize the time investment and the potential for exploitation simply by uninstalling software you do not need or use, reducing the attack surface.

Also note that using the applications own “check for updates” function, when available, will best preserve your current settings, and often avoid any crapware that might come with a fresh installer. Use this option if it’s available to you.

Finally, if you’re sick of doing this all yourself, let me! Call or email me any time, and we can set you up with subscription SaferPC updates which will be installed each month whenever necessary. Click, call or email for more details:
https://saferpc.info/updates/
209-565-12PD
shawn@12pointdesign.com

Driver Updates

If you’re using this hardware – these updates are for you.

Display Driver Uninstaller 18.0.2.8 resolves issues with NVIDIA removal. This is not a security update.
https://www.wagnardsoft.com/display-driver-uninstaller-ddu

Browser Updates

One or more of these are likely to be of interest to everyone.

Brave 1.11.104 is a security update. Use Menu, Help, About to install the most current version.
https://brave.com/

Firefox 79.0 is a security update. Use Menu, Help, About to install the most current version

Firefox ESR 68.11.0 is a security update. Use Menu, Help, About to install the most current version.

Google Chrome 84.0.4147.125 is a security update. Use Menu, Help, About to install the most current version.

Microsoft Edge 84.0.522.59 is a security update. Use Menu, Help, About to install the most current version.

Vivaldi 3.2.1967.41 is a security update. Use Menu, Help, About to install the most current version.
https://vivaldi.com/

Email Updates

One or more of these are likely to be of interest to everyone.

Thunderbird 78.1.0 is a security update. Direct updates are disabled for 78.x so you will need to download and install the update from the Thunderbird website:
https://www.thunderbird.net/en-US/

Internet Updates

One or more of these are likely to be of interest to everyone.

BrowsingHistoryView 2.41 adds support for local /cfg file. This is not a security update.
https://www.nirsoft.net/utils/browsing_history_view.html

Dropbox 103.4.383 doesn’t provide a detailed changelog, so should be treated as a security update.
https://www.dropbox.com/

FileZilla Client 3.49.1 resolves a cosmetic bug. This is not a security update.
https://filezilla-project.org/

FreeFileSync 11.0 improves Google Drive sync and backups, adds WSL symlink support, and resolves several bugs. This is not a security update.
https://www.freefilesync.org/download.php

Npcap 0.9996 resolves several bugs, including stability/crash problems. This is not a security update.
https://nmap.org/npcap/

Technitium DNS Server 5.0.2 resolves several bugs and updates libraries. This is not a security update.
https://technitium.com/dns/

WinSCP 5.17.7 is a security update.
https://winscp.net/eng/index.php

Zoom 5.2.42619.0804 resolves several bugs, improves compatibility and hardware support, and adds several new features. This is not a security update.
https://zoom.us/

Line 9.6.0 adds effects stickers. This is not a security update.
http://line.me/update

Media Updates

These are unlikely to be of interest to most people.

3tene 2.0.2 updates libraries, improves compatibility, and resolves several bugs. This is not a security update.
https://en.3tene.com/

iTunes 12.10.8 is a security update. Use Apple Software Update to install the most current version.

darktable 3.2.1 resolves almost 100 bugs, improves lighttable, CSS styles, Color Picker, preferences, and many more. This is not a security update.
https://www.darktable.org/install/

Picard 2.4.1 resolves a dozen bugs and adds support for new formats, improves functions and stability. This is not a security update.
https://picard.musicbrainz.org/

Office Updates

One or more of these are likely to be of interest to most people.

Adobe Reader DC 20.012.20041 is a security update. Use Menu, Check for updates to get the most current version.

Adobe Lightroom 9.3 is a security update.
https://helpx.adobe.com/security/products/lightroom/apsb20-51.html

Magento 2.4.0 and 2.3.5-p2 are security updates.
https://helpx.adobe.com/security/products/magento/apsb20-47.html

Adobe Reader Mobile 20.3 is a security update.
https://helpx.adobe.com/security/products/reader-mobile/apsb20-50.html

Adobe Prelude 9.0.1 is a security update.
https://helpx.adobe.com/security/products/prelude/apsb20-46.html

Adobe Photoshop 20.0.10 and 21.2.1 are security updates.
https://helpx.adobe.com/security/products/photoshop/apsb20-45.html

Adobe Bridge 10.1.1 is a security update.
https://helpx.adobe.com/security/products/bridge/apsb20-44.html

Atom 1.50.0 resolves several bugs and updates libraries. This is not a security update.
https://atom.io/

Blender 2.83.4 resolves dozens of bugs and improves performance. This is not a security update.
https://www.blender.org/download/

LibreOffice Still 6.4.5 is a major update to the stable version of LibreOffice. This build resolves over 100 bugs and improves stability over the previous beta “Fresh” line. This is not a security update.
https://www.libreoffice.org/

LibreOffice Fresh 7.0.0 is beta software. While this is a major update to the beta version of LibreOffice, nearly 200 bugs were resolved over the last few days so you should only use this if you are comfortable using beta software that is very likely to crash. This is not a security update.
https://www.libreoffice.org/

Notepad++ 7.8.9 resolves 9 bugs that improve cosmetics after the recent updates. This is not a security update.
https://notepad-plus-plus.org/

Paint.net 4.2.13 resolves several bugs and improves low-quality exports. This is not a security update.
https://www.getpaint.net/

Security Software Updates

One or more of these is likely to be of interest to most people.

DNSQuerySniffer 1.81 adds local /cfg file support and adds Select/Deselect All to column settings. This is not a security update.
https://www.nirsoft.net/utils/dns_query_sniffer.html

Gpg4win 3.1.12 resolves several bugs and improves reliability. This is a security update.
https://www.gpg4win.org/download.html

Hashcat 6.1.1 resolves several bugs and adds support for new algorithms. This is not a security update.
https://hashcat.net/hashcat/#downloadlatest

RogueKiller 14.6.3 updates core engine and resolves several bugs. This is not a security update.
https://www.adlice.com/download/roguekiller/

uBlock Origin 1.29.0 resolves several bugs. This is not a security update.
https://github.com/gorhill/uBlock/releases/latest

Capture Updates

These are unlikely to be of interest to most people.

SnagIt 2020.1.4 improves cosmetic controls and resolves several bugs. This is not a security update.
https://download.techsmith.com/snagit/enu/snagit.exe

Converter Updates

These are unlikely to be of interest to most people.

DVDFab 11.1.0.1 adds support for new encodings, adds output configuration exports, batch reporting, and new output profiles. This is not a security update.
https://www.dvdfab.cn/download.htm

MakeMKV 1.15.2 updates muxer to the latest matroska specification, resolves several bugs and adds drive speed control and standalone sdftool. This is not a security update.
https://www.makemkv.com/download/

PDF Creator 4.1.2 resolves a COM interface error and several other bugs. This is not a security update.
https://www.pdfforge.org/pdfcreator

Utility Updates

These are unlikely to be of interest to most people.

1Password for Windows 7.6.780 resolves several bugs and improves cosmetics. This is a security update.
https://1password.com/downloads/windows/

Bitwarden 1.20.1 resolves a crash bug and adds support for Windows Hello or TouchID on macOS to unlock the vault. This is not a security update.
https://bitwarden.com/

CCleaner 5.70.7909 improves compatibility, but is still detected as a “potentially unwanted program” by Windows Defender (and with all the problems CCleaner has had in the last couple years, they could be right).
https://www.ccleaner.com/

CPU-Z Installer 1.93 adds support for newer hardware. This is not a security update.
https://www.cpuid.com/softwares/cpu-z.html

CurrPorts 2.62 adds ‘Copy Remote Address’ option. This is not a security update.
https://www.nirsoft.net/utils/cports.html

Dell Command Update 3.1.3 improves reliability, compatibility, and stability. This is not a security update.
https://www.dell.com/support/article/us/en/04/sln311129/dell-command-update?lang=en

DesktopOK 7.71 resolves several bugs and adds HTTPS updates. This is a security update.
https://www.softwareok.com/?seite=Freeware/DesktopOK

Eraser 6.2.0.2990 adds exFAT support but doesn’t have a changelog. This should be treated as a security update.
https://eraser.heidi.ie/download/

Etcher 1.5.102 updates libraries, and resolves several bugs. This is not a security update.
https://www.balena.io/etcher/

Everything 1.4.1.988 reworks some Lite behavior, ensures volumes are mounted before use, and resolves several bugs. This is not a security update.
https://www.voidtools.com/

FolderChangesView 2.32 adds local /cfg support. This is not a security update.
https://www.nirsoft.net/utils/folder_changes_view.html

GoodSync 11.2.8 resolves several bugs and improves reliability. This is not a security update.
https://www.goodsync.com/

Homedale 1.88 adds OWE encryption support. This is not a security update.
https://www.the-sz.com/products/homedale/

IsMyHdOK 2.21 vastly improves SSD support. This is not a security update.
https://www.softwareok.com/?seite=Microsoft/IsMyHdOK

NTLite 2.0.0.7596 resolves several bugs and adds new settings options. This is not a security update.
https://www.ntlite.com/download/

PointerStick 4.25 resolves several bugs. This is not a security update.
https://www.softwareok.com/?seite=Freeware/PointerStick

PowerToys 0.20.1 resolves several bugs. This is a security update.
https://github.com/microsoft/PowerToys/releases/latest

RoboForm 8.9.1 adds import from Edge and resolves several bugs. This is not a security update.
https://www.roboform.com/

Sysmon 11.11 fixes a bug that prevented USB media from being ejected. This should be treated as a security update.
https://live.sysinternals.com/

TaskSchedulerView 1.56 improves compatibility for devices where the Remote Registry service is disabled. This is not a security update.
https://www.nirsoft.net/utils/task_scheduler_view.html

TeamViewer 15.8.3 is a security update.
https://www.teamviewer.com/en/download/windows/

TraceRouteOK 1.77 resolves several bugs and improves GUI. This is not a security update.
https://www.softwareok.com/?seite=Microsoft/TraceRouteOK

USBDeview 3.00 adds several new timestamp columns that can be read when running elevated, and renames the other timestamp fields. This is not a security update.
https://www.nirsoft.net/utils/usb_devices_view.html

USB Oblivion 1.13.0.0 adds ability to clean the Partition Diagnostic journal. This is not a security update.
https://www.cherubicsoft.com/en/projects/usboblivion

WifiInfoView 2.62 improves local /cfg file behavior. This is not a security update.
https://www.nirsoft.net/utils/wifi_information_view.html

WinScan2PDF 5.88 improves compatibility with multifunction devices. This is not a security update.
https://www.softwareok.com/?seite=Microsoft/WinScan2PDF

Developer Updates

These are unlikely to be of interest to most people.

ADB 30.0.4 resolves several bugs and improves fastboot. This is not a security update.
https://developer.android.com/studio/releases/platform-tools

AutoHotkey 1.1.33.02 resolves several bugs. This is not a security update.
https://www.autohotkey.com/download/

Node.js 14.8.0 resolves dozens of bugs and updates libraries. This should be treated as a security update.
https://nodejs.org/en/

Node.js v12 12.18.3 updates libraries and resolves dozens of bugs. This should be treated as a security update.
https://nodejs.org/en/

Redemption 5.24.0.5736 adds several new methods and properties, and resolves several bugs. This is not a security update.
http://www.dimastr.com/redemption/

Web Package Updates

These are likely to be of interest only to web developers.

Dada Mail 11.11.0 adds Scheduling and validation, makes Open Discussion Lists always available, significantly improves active troubleshooting, and resolves compatibility with StopForumSpam. This is not a security update.
http://dadamailproject.com/

Docker Desktop 2.3.0.4 improves cross-platform compatibility, installation troubleshooting, and WSL 2 support. This is not a security update.
https://www.docker.com/products/docker-desktop

Drupal 9.0.3 resolves over 100 bugs. This is not a security update.
https://drupal.org/download

HumHub 1.6.2 resolves dozens of bugs. This is not a security update.
https://www.humhub.com/en/download

MailEnable 10.31 improves logging, and resolves over 30 bugs. This is not a security update.
https://www.mailenable.com/

Nextcloud Server 19.0.1 resolves dozens of bugs. This is not a security update.
https://nextcloud.com/

OpenCart 3.0.3.6 adds PayPal extensions and removes Openbay Pro. This is not a security update.
https://www.opencart.com/

OpenPetra 2020.06 adds consent storage for compatibility with legal requirements,
https://www.openpetra.org/

ScreenConnect 20.8.29574.7520 resolves several bugs. This is not a security update.
https://www.connectwise.com/software/control/download

Autoptimize 2.7.6 resolves several bugs. This is not a security update.

BuddyPress 6.2.0 resolves several bugs. This is not a security update.

Contact Form 7 5.2.1 resolves several bugs. This is not a security update.

Social Post Feed 2.16 resolves a couple bugs. This is not a security update.

Register IP – Multisite 1.8.2 resolves a cosmetic bug and improves compatibility. This is not a security update.

NextScripts Social Networks Auto-Poster 4.3.16 improves compatibility and resolves two bugs. This is not a security update.

W3 Total Cache 0.14.3 resolves several bugs. This is not a security update.

WooCommerce 4.3.2 resolves several bugs. This is not a security update.

WP Add Custom CSS 1.1.6 updates code editor and improves compatibility. This is not a security update.

WordPress Zero Spam 4.9.12 is the latest in a series of fixes to the 4.0 rewrite. Over a hundred changes and many new features and controls are added. This is not a security update.

That’s all for now folks. Keep it clean out there. 😉

Regards,

Shawn K. Hall
https://SaferPC.info/
https://12PointDesign.com/

Updates 2020-07-14

Welcome back, Folks!

Today is Patch Tuesday for July 2020.

This Month in Technology

Apple has formally announced that they’ll be switching to ARM processors on their new hardware. While Apple asserts that “most apps will just work,” the truth is that if it’s not a 64-bit app or it hasn’t been updated in more than a year, chances are not only won’t work on ARM but will never work on ARM. If you were here when they switched from PowerPC to Intel you remember the issues were long and wide. You’ll likely need a VM to make many of your apps work.

Piracy doesn’t pay, except for those creating the pirated apps.

Macs are still getting infected through fake “Flash update” malware, even on Catalina. From the comments, “Which is worse, a real Flash installer or a fake one? It’s a toss-up.”

Microsoft was caught breaching user trust, again, by hijacking your data from other browsers and importing into their forced update to their new Edge browser without your permission.

Mozilla switched to a 4-week cadence for major updates in March. This has resulted in even less time for beta testing and the expected release+1 security updates.

Google Chrome is planning to hide everything in a URL other than the domain name. Google, the most popular purveyor of information and also the self-appointed gatekeeper to what is true and false, believes that having the complete URL is bad for you.

Google resolved a major email spoofing vulnerability through customer services, shortly before allowing a core domain name for their Blogger service to expire.

Slack vulnerability allowed hackers to distribute malware to victims devices.

What is it going to take before you stop copying passwords on your phone?

Everyone knows Facebook is always listening. Now the courts have finally considered their web widgets “Wiretaps.” Others are, too. They’re also designing systems to be able to trigger recording of all background noise from external queues. In states like California, Facebook is already violating the all-party consent requirements by recording audio 24/7. Maybe they’ll eventually acknowledge that it’s bad and stop? Ouch. Sorry, I hurt myself laughing there. Oh, and the Facebook Messenger app allowed you to be infected with persistent malware. If you have a website with Facebook integration, you need to take action now to comply with the CCPA.

Airlines are perfectly happy to violate the Americans with Disabilities Act – and treat you like a terrorist – if you have medical conditions.

Bitdefender Antivirus allowed any website you visited to run code on your device. Apache’s Guacamole remote support client allows attackers to take over the entire enterprise. Backdoors in operating systems, why not backdoors in encryption software?

Surprise: phishing still works. Even by text. …and launching a service that relays content to third-parties will ensure it is abused. Honeypots (systems designed to be opened for abuse to see how attacks take place) demonstrate four previously unknown zero-day vulnerabilities.

Nintendo, Plex, Honda, Samsung, Oxford University, University Of Pittsburgh Medical Center, UCSF, anyone banking with various Chinese banks, Night Lion Security, 79 different Netgear router models, hundreds of online retailers, and it won’t be long before IoT vulnerabilities can be used to provide big game hunting for rare species.

June Patch Tuesday updates from Microsoft broke Outlook and other apps for some users.

Selective enforcement means you’re a publisher, says AG Barr of Section 230 of the CDA. There’s no better way to prevent the abuse of Section 230 to censor voices you disagree with.

Now for the good news:

Starlink is coming. LEO internet access could provide up to 1 Gbps Internet access from space. Testing will begin in the next weeks and will gradually move south as satellites take place.

For now, you can cut your internet bill by taking advantage of the free Xfinity Wi-Fi hotspots through the end of the year.

Let’s Get Busy

Now back to our regularly scheduled program.

Patch Tuesday this month is huge. The typical computer should see roughly 1.5 GB in updates today. Let’s get started.

Microsoft released updates for Windows, Edge, .NET, Internet Explorer, DNS Server, Office, Servicing Stack, and MSRT (~900 MB). This includes security updates. A reboot is required.

Adobe Flash Player 32.0.0.403 is a security update.
Win: https://12pd.com/click?flash
Win: https://12pd.com/click?flashie
Mac: https://12pd.com/click?flashmac

Google Chrome OS 83.0.4103.119 is a security update. Use Menu, Help, About to install the most current version. A reboot is required.

Don’t forget to check your mobile devices, too! Many updates will also apply to your tablet, phone, kindle or television – so check your device-appropriate App Store and install updates.

Important Notes

Everything above this section should be checked by everyone on every computer. Chances are good that close to every single computer you touch will be affected by those updates. This is not the case with the items below, though you should still check each line item below to see if it applies to software you have installed.

The release of macOS Catalina (10.15) means that macOS Sierra (10.12) and older are no longer supported. If you can not install at least macOS High Sierra (10.13) on your Mac then you should immediately remove it from the Internet and use it offline only. It will no longer receive patches or updates and can now no longer be secured.

The now-current release of the Windows 10 (2004) is a huge (about 25% larger than any prior build) so will take a long time to download on slower connections. Windows 10 pushes you to get the latest Windows 10 release every 6 months. If you don’t let it finish and you’re on a slow connection, this process kill your Internet performance forever. If you don’t have the bandwidth to download the bits, I’m happy to provide loaner USB drives to our local clients, or, if you prefer to have me mail it to you please contact me for information.

Please remember that while I list many different applications within these updates, most people should ONLY install updates for a program if they already have a previous version of that program installed.

It is essential to maintain all the applications you have installed on your computer, but often you can minimize the time investment and the potential for exploitation simply by uninstalling software you do not need or use, reducing the attack surface.

Also note that using the applications own “check for updates” function, when available, will best preserve your current settings, and often avoid any crapware that might come with a fresh installer. Use this option if it’s available to you.

Finally, if you’re sick of doing this all yourself, let me! Call or email me any time, and we can set you up with subscription SaferPC updates which will be installed each month whenever necessary. Click, call or email for more details:
https://saferpc.info/updates/
209-565-12PD
shawn@12pointdesign.com

Driver Updates

If you’re using this hardware – these updates are for you.

Crucial Storage Executive 6.04 doesn’t provide a changelog so should be treated as a security update.
https://www.crucial.com/support/storage-executive

Daemon Tools Lite 10.13.0 improves activation and creation and use of bootable disk images. This is not a security update.
https://www.daemon-tools.cc/products/dtLite

Intel Driver and Support Assistant 20.7.26 adds support for new hardware and improves application detection. This is not a security update.
https://www.intel.com/p/en_US/support/detect

nVidia 451.67 resolves several bugs and improves compatibility. This is a security update.
https://www.nvidia.com/Download/index.aspx?lang=en-us

Browser Updates

One or more of these are likely to be of interest to everyone.

Brave 1.10.97 is a security update. Use Menu, Help, About to install the most current version.
https://brave.com/

Google Chrome 84.0.4147.89 is a security update. Use Menu, Help, About to install the most current version.

Microsoft Edge 83.0.478.64 is a security update. Use Menu, Help, About to install the most current version.
https://www.microsoft.com/en-us/edge/business/download

Firefox 78.0.2 is a security update. Use Menu, Help, About to install the most current version.

Firefox ESR 68.10.0 is a security update. Use Menu, Help, About to install the most current version.

SeaMonkey 2.53.3 is a security update. Use Menu, Help, About to install the most current version.
https://www.seamonkey-project.org/

Vivaldi 3.1.1929.45 is a security update. Use Menu, Help, About to install the most current version.
https://vivaldi.com/

Email Updates

One or more of these are likely to be of interest to everyone.

OutlookAttachView 3.41 adds an option to copy the preview content and resolves a bug in the cfg switch. This is not a security update.
https://www.nirsoft.net/utils/outlook_attachment.html

Thunderbird 68.10.0 is a security update. Use Menu, Help, About to install the most current version.
https://www.thunderbird.net/en-US/

Internet Updates

One or more of these are likely to be of interest to everyone.

Trillian 6.3.0.6 resolves dozens of bugs, including 2FA and stability issues. This is a security update.
https://www.trillian.im/

Trillian Mac 6.3.0.6 resolves several stability bugs. This is not a security update.
https://www.trillian.im/

curl 7.71.1 resolves several sanitation issues. This should be treated as a security update.
https://curl.haxx.se/windows/

Dropbox 101.4.434 doesn’t provide a useful changelog so should be treated as a security update.
https://www.dropbox.com/

FileZilla Client 3.49.0 resolves a several bugs. This is not a security update.
https://filezilla-project.org/

FreeFileSync 10.25 adds support for Google Drive Shared Drives and Shortcuts, resolves several bugs, and improves user interface. This is not a security update.
https://www.freefilesync.org/download.php

Npcap 0.9995 resolves several bugs. This is not a security update.
https://nmap.org/npcap/

PuTTY 0.74 is a security update.
https://www.chiark.greenend.org.uk/~sgtatham/putty/download.html

Technitium DNS Server 5.0.1 is a major update that refactors how blocklists are stored and resolves several bugs. This is not a security update.
https://technitium.com/dns/

Zoom 5.1.28656.0709 is a security update.
https://zoom.us/

Game Updates

These are unlikely to be of interest to most people.

Steam 2020.07.09 resolves several bugs and improves compatibility. This is not a security update.

Office Updates

One or more of these are likely to be of interest to most people.

Adobe Camera Raw and DNG Converter 12.3 adds support for new hardware. This is not a security update.
Mac: https://supportdownloads.adobe.com/detail.jsp?ftpID=6955
Win: https://supportdownloads.adobe.com/detail.jsp?ftpID=6957

Adobe Download Manager 2.0.0.529 is a security update.
https://helpx.adobe.com/security/products/adm/apsb20-49.html

Adobe ColdFusion 2016.16 and 2018.10 are security updates.
https://helpx.adobe.com/security/products/coldfusion/apsb20-43.html

Adobe FrameMaker 2019.0.6 doesn’t provide a changelog so should be treated as a security update.
Win32: https://supportdownloads.adobe.com/detail.jsp?ftpID=6963
Win64: https://supportdownloads.adobe.com/detail.jsp?ftpID=6965

Adobe Genuine Service 7.1 is a security update. (Point this one out the next time someone says pirating Adobe software can reduce the security of your computer.)
https://helpx.adobe.com/security/products/integrity_service/apsb20-42.html

Adobe Media Encoder 14.3 is a security update.
https://helpx.adobe.com/security/products/media-encoder/apsb20-36.html

Adobe Creative Cloud Desktop Application 5.2 is a security update.
https://helpx.adobe.com/security/products/creative-cloud/apsb20-33.html

Magento SUPEE-11346 (for Magento v1) is a security update.
https://www.magentocommerce.com/products/downloads/magento/

Adobe Audition 13.0.7 is a security update.
https://helpx.adobe.com/security/products/audition/apsb20-40.html

Adobe Premiere Rush 1.5.16 is a security update.
https://helpx.adobe.com/security/products/premiere_rush/apsb20-39.html

Adobe Premiere Pro 14.3 is a security update.
https://helpx.adobe.com/security/products/premiere_pro/apsb20-38.html

Adobe Illustrator 2020 24.2 is a security update.
https://helpx.adobe.com/security/products/illustrator/apsb20-37.html

Adobe After Effects 17.1.1 is a security update.
https://helpx.adobe.com/security/products/after_effects/apsb20-35.html

Adobe Campaign Classic 20.2 is a security update.
https://helpx.adobe.com/security/products/campaign/apsb20-34.html

Artweaver 7.0.6 resolves several bugs. This is not a security update.
https://www.artweaver.de/

Atom 1.49.0 resolves several bugs. This is not a security update.
https://atom.io/

Blender 2.83.2 resolves over 1250 bugs, adds improves performance and stability across several features and adds viewport denoiser. This is not a security update.
https://www.blender.org/download/

Krita 4.3.0 adds several new watercolor effects with brush presets and gradient map and palettizer filters. This is not a security update.
https://krita.org/en/download/krita-desktop/

LibreOffice Fresh 6.4.5 resolves over 100 bugs. This is beta software so should be avoided in favor of the “Still” version (LibreOffice stable). This is not a security update.
https://www.libreoffice.org/

Nextcloud Desktop 2.6.5 resolves several bugs. This is not a security update.
https://nextcloud.com/

Notepad++ 7.8.8 resolves several bugs. This is not a security update.
https://notepad-plus-plus.org/

Adobe Reader DC 20.009.20074 resolves several bugs. This is not a security update.
https://get.adobe.com/reader

Security Software Updates

One or more of these is likely to be of interest to most people.

Bitmessage 0.6.3.2 is a security update.
https://github.com/Bitmessage/PyBitmessage/releases/latest

DrWeb CureIt! 14.07.2020 should be treated as a security update.
https://www.freedrweb.com/download+cureit+free/?lng=en

Hashcat 6.0.0 adds 51 new algorithms, CUDA support, GPU emulation, improved auto-tuning and more. This should be treated as a security update.
http://hashcat.net/hashcat/#downloadlatest

RogueKiller 14.6.1 resolves several bugs. This is a security update.
https://www.adlice.com/download/roguekiller/

TinyWall 3.0.7 adds support for WSL, whitelisting from network shares, improves detection of short-lived processes, and resolves several bugs. This is not a security update.
https://tinywall.pados.hu/

uBlock Origin 1.28.2 improves syntax highlighting in My Filters and asset viewer, resolves several bugs, and replaces the default filterlists with a new composite list.
https://github.com/gorhill/uBlock/releases/latest

VT-CLI 0.8.0 doesn’t provide a changelog so should be treated as a security update.
https://github.com/VirusTotal/vt-cli/releases/latest

Wireless Network Watcher 2.22 updates the internal MAC database and improves the CFG switch. This is not a security update.
https://www.nirsoft.net/utils/wireless_network_watcher.html

Capture Updates

These are unlikely to be of interest to most people.

ScreenToGif 2.26.1 resolves several bugs. This is not a security update.
https://github.com/NickeManarin/ScreenToGif/releases/latest

SnagIt 2020.1.3 adds support for direct publication through TechSmith Knowmia, adds transparency support for color replacement, and resolves several bugs. This is not a security update.
https://download.techsmith.com/snagit/enu/snagit.exe

Converter Updates

These are unlikely to be of interest to most people.

DVDFab 11.0.9.7 adds support for new encodings, adds several new conversion tools, presets, and bug fixes. This is not a security update.
https://www.dvdfab.cn/download.htm

FFmpeg 4.3.1 updates libraries. This should be treated as a security update.
https://ffmpeg.org/ffmpeg.html

HandBrake 1.3.3 resolves several bugs. This is not a security update.
https://handbrake.fr/

IsoBuster 4.6 adds a bunch of new features and format supports. This is not a security update.
https://www.isobuster.com/download.php

PDF Creator 4.1 resolves several bugs and improves watermark support. This is not a security update.
https://www.pdfforge.org/pdfcreator

Utility Updates

These are unlikely to be of interest to most people.

1Password for Mac 7.6 is a security update.
https://1password.com/downloads/mac/

1Password for Windows 7.6.778 resolves dozens of bugs and improves reliability, adds notifications of website compromise, and improves accessibility. This is a security update.
https://1password.com/downloads/windows/

8GadgetPack 33.0 resolves several bugs, improves high-DPI support, removes defunct widgets. This is not a security update.
https://8gadgetpack.net/

AS SSD Benchmark 2.0.7316.34247 resolves a device access bug. This is not a security update.
https://www.alex-is.de/PHP/fusion/downloads.php?cat_id=4

Autoruns 13.98 now shows the Windows Defender binary as a signed binary. This is not a security update.
https://docs.microsoft.com/en-us/sysinternals/downloads/autoruns

Beyond Compare 4.3.5.24893 improves integration and compatibility, and resolves several bugs. This is not a security update.
https://www.scootersoftware.com/download.php?zz=dl4

Bitwarden 1.19.0 improves password concealment, adds soft delete and vault timeouts. This is not a security update.
https://bitwarden.com/

Cygwin 3.1.6 adds support for new socket options, resolves several bugs. This is a security update.
https://cygwin.com/

DesktopOK 7.48 adds SSL to automatic update capability. This is not a security update.
https://www.softwareok.com/?seite=Freeware/DesktopOK

Etcher 1.5.101 resolves several bugs, improves UI, and updates libraries. This should be treated as a security update.
https://www.balena.io/etcher/

GoodSync 11.2.5 resolves several bugs and changes licensing…again. This is not a security update.
https://www.goodsync.com/

MS ISO Downloader 8.38 adds support for new images. This is not a security update.
https://www.heidoc.net/joomla/technology-science/microsoft/67-microsoft-windows-and-office-iso-download-tool

NTLite 1.9.0.7539 adds controls for Target release, Store pinning, Fast Startup, Fast User Switching, Hardware-accelerated GPU scheduling, Shutdown menu, Variable refresh rate, and resolves several bugs. This is not a security update.
https://www.ntlite.com/download/

PowerToys 0.19.1 resolves dozens of bugs and stability issues. This is not a security update.
https://github.com/microsoft/PowerToys/releases/latest

Rufus 3.11 improves compatibility and adds several keyboard shortcuts to toggle behaviors. This should be treated as a security update.
https://rufus.ie/en_IE.html

Sysmon 11.10 now captures ADS content into logs, introduces an is-any filter condition, and fixes several bugs. This is not a security update.
https://live.sysinternals.com/

Sigcheck 2.80 adds an option for specifying a trust GUID for signature verification and now shows certificate signing chains. This is not a security update.
https://live.sysinternals.com/

SimpleWMIView 1.41 adds cell-copying and case-sensitivity filtering. This is not a security update.
https://www.nirsoft.net/utils/simple_wmi_view.html

TeamViewer 15.7.7 resolves several bugs. This is not a security update.
https://www.teamviewer.com/en/download/windows/

WifiInfoView 2.61 updates the internal MAC addresses list. This is not a security update.
https://www.nirsoft.net/utils/wifi_information_view.html

WinScan2PDF 5.81 resolves several bugs and improves rotation support. This is not a security update.
https://www.softwareok.com/?seite=Microsoft/WinScan2PDF

Developer Updates

These are unlikely to be of interest to most people.

ADB 30.0.3 resolves several bugs. This is not a security update.
https://developer.android.com/studio/releases/platform-tools

Android Studio 4.0.1.0 resolves over a dozen bugs. This is not a security update.
https://developer.android.com/studio

AutoHotkey 1.1.33.01 resolves several bugs and adds encoding, warnings, and version requirement options. This is not a security update.
https://www.autohotkey.com/download/

Godot 3.2.2 makes over 800 changes, adding C# support for iOS, 2D batching for GLES2, re-architecture of the Android plugin system, DRLS support and ENet integration, and better handling of Variants. This is not a security update.
https://godotengine.org/

Java 8u261 is a security update.
https://www.java.com/en/download/manual.jsp

Node.js 14.5.0 resolves dozens of bugs and updates libraries. This is not a security update.
https://nodejs.org/en/

Node.js v12 12.18.2 resolves several bugs and updates libraries. This is not a security update.
https://nodejs.org/en/

SQLite 3.32.3 resolves several bugs. This is not a security update.
https://www.sqlite.org/download.html

DB Browser for SQLite 3.12.0 improves table editing, conditional formatting, and multi-threading, as well as dozens of other improvements and bug fixes. This is not a security update.
https://sqlitebrowser.org/

Visual Studio Code 1.47.1 is a security update.
https://code.visualstudio.com/

Virtual Machine Updates

These are unlikely to be of interest to most people.

VirtualBox 6.1.12-139181 resolves over a dozen bugs and improves hardware compatibility. This is not a security update.
https://www.virtualbox.org/wiki/Downloads

PPSSPP 1.10.3 resolves several bugs. This is not a security update.
https://ppsspp.org/downloads.html

Web Package Updates

These are likely to be of interest only to web developers.

Apache Tomcat 10.0.0-M7, 9.0.37, and 8.5.57 are security updates.
https://tomcat.apache.org/

Coppermine Gallery 1.6.08 improves installation and compatibility. This is not a security update.
https://coppermine-gallery.net/

Dada Mail 11.10.3 improves AWS signature v4 support. This is not a security update.
https://dadamailproject.com/

Drupal 8.8.8 and 8.9.2 are security updates.
https://drupal.org/download

Drupal 9.0.2 resolves dozens of bugs. This is not a security update.
https://drupal.org/download

Joomla 3.9.20 is a security update.
https://www.joomla.org/

phpList 3.5.5 is a security update.
https://www.phplist.org/

ScreenConnect 20.7.29305.7496 resolves several bugs and improves compatibility. This is not a security update.
https://www.connectwise.com/software/control/download

WordPress 5.4.2 is a security update.
https://wordpress.org/

Autoptimize 2.7.3 resolves several bugs. This is not a security update.

BuddyPress 6.1.0 resolves several bugs. This is not a security update.

Contact Form 7 5.2 improves compatibility and resolves several bugs. This is not a security update.

Email Log 2.4.2 resolves several bugs. This is not a security update.

myStickymenu 2.4.3 resolves several bugs. This is not a security update.

Raw HTML 1.6.3 resolves a warning. This is not a security update.

Theme My Login 7.1.1 resolves several bugs. This is not a security update.

W3 Total Cache 0.14.2 resolves several bugs. This is not a security update.

WooCommerce 4.3.0 adds template caching, PHP warnings, improves accessibility, and resolves dozens of bugs. This is not a security update.

WP Mail SMTP 2.2.1 resolves several bugs and improves compatibility. This is not a security update.

That’s all for now folks. Keep it clean out there. 😉

Regards,

Shawn K. Hall
https://SaferPC.info/
https://12PointDesign.com/

Updates 2020-02-28

Hi, Folks!

It’s not Patch Tuesday, but security updates from Google, nVidia, TeamViewer and others have triggered an out-of-cycle update.

This Month Week in Technology (Again)

Microsoft is fixing Windows Search again today, and soon scaling back Cortana features in order to better focus the CPU-intensive AI.

Storing your passwords in Notes in your iPhone and iPad is something almost every iOS user does, but shouldn’t. Any app or widget can read the clipboard contents any time. Apple’s Safari browser will soon prevent you from accessing websites secured by SSL/TLS certificates with duration’s beyond 13 months. Their stated goal is to improve validity and reliability of certificates by increasing automation and thus reducing the likelihood of human error. This might be more trustworthy if the systems that automate the processes could be better trusted. I’m old enough to remember when large certificate providers (including Verisign) issued half a million certificates to almost anyone that asked, whether they had any relationship to the site or not. Surely this should have hurt Verisign pretty bad, right? Nah, they are still the Domain Registry for all .com, .net, .gov and .edu TLDs, and they’re currently attempting to discredit everyone that dared to comment on their contract renewal that grants them the ability to raise .com rates in 4 out of 6 years.

ISPs believe they own your data if you dare use their service to get online, but for what it’s worth, they don’t have nearly the scope of data access that a flaw in over a billion wireless devices (including Apple iPhone, iPad, Amazon Echo, Kindle, Samsung Galaxy, and Google Nexus devices) does. If you haven’t patched all your mobile devices recently, do it now.

Speaking of data access, reliance on cloud backups and local backups with permanently tethered drives won’t help you when you’re hit with ransomware, and reliance on cloud-based services allows patent claims to remotely disable your property, and, in a possible first, ransomware may have actually been responsible for keeping criminals out of prison.

Wells Fargo has been fined $3b over creating millions of fraudulent accounts based on real people, but none of it will go to their victims. Over 50,000 people hit by the Click4Support scamware will be getting about 5-10% of their losses back. It ain’t much, but it’s better than nothing.

In yet another example of sky-is-falling ignorance from “Tech Commentators” that don’t actually understand the technology they’re talking about, Gordon Kelly claims that information that never leaves your computer can be spied on by several unrelated third-parties. Sigh. More importantly, Google has released 7 security updates for Chrome in the last month. Yes, really. If you followed Gordon Kelly’s advice to block updates you’d be at actual risk from several real and serious vulnerabilities instead of just thinking you know so much stuff that isn’t true.

Professor Norman Sadeh, of Carnegie Mellon’s Institute for Software Research,
the same group that helped the FBI break TOR “on a budget” (paid $1m from the FBI, they spent $3k to break TOR), have released an app, IOTA, to help you identify the Internet-of-Things devices that exist around you, and they might not even abuse the information you share with them to gain a foothold into your networks.

While we’re on the topic of abuse, a facial recognition company was breached and their entire client list was stolen. It’s easy to blame the contractor for making this kind of mistake, but the US Defense Information Systems Agency (DISA) hasn’t done any better, even exposing White House data.

Finally, a US Federal Appeals court ruled that online censorship is okay, ensuring that the 2020 election will be tainted by Silicon Valley’s very own form of social engineering via censorship. Oh, well.

Let’s Get Busy

The typical computer should see approximately 400 MB of updates today. Let’s get started.

Microsoft has released another update to fix the search bugs in Windows 10 v1903 and newer and a security update for the new Edge browser. Use Windows Update to get the updates.

Don’t forget to check your mobile devices, too! Many updates will also apply to your tablet, phone, kindle or television – so check your device-appropriate App Store and install updates.

Important Notes

Everything above this section should be checked by everyone on every computer. Chances are good that close to every single computer you touch will be affected by those updates. This is not the case with the items below, though you should still check each line item below to see if it applies to software you have installed.

Please remember that while I list many different applications within these updates, most people should ONLY install updates for a program if they already have a previous version of that program installed.

It is essential to maintain all the applications you have installed on your computer, but often you can minimize the time investment and the potential for exploitation simply by uninstalling software you do not need.

Also note that using the applications own “check for updates” function, when available, will best preserve your current settings, and often avoid any crapware that might come with a fresh installer. Use this option if it’s available to you.

Finally, if you’re sick of doing this all yourself, let me! Call or email me any time, and we can set you up with subscription SaferPC updates which will be installed each month whenever necessary. Click, call or email for more details:
https://saferpc.info/updates/
209-565-12PD
shawn@12pointdesign.com

Driver Updates

If you’re using this hardware – these updates are for you.

Zebra Driver 2020.1 doesn’t provide a changelog, so should be treated as a security update.
https://www.seagullscientific.com/support/downloads/drivers/zebra

nVidia 442.50 is a security update.
https://www.nvidia.com/Download/index.aspx?lang=en-us

Browser Updates

One or more of these are likely to be of interest to everyone.

Google Chrome 80.0.3987.122 is a security update. Use Menu, Help, About to install the most current version.

Vivaldi 2.11.1811.44 is a security update. Use Menu, Help, About to install the most current version.

Brave 1.4.95 is a security update. Use Menu, Help, About to install the most current version.

Iridium 2020.01.79 is a security update. Use Menu, Help, About to install the most current version.

Email Updates

One or more of these are likely to be of interest to everyone.

Mailspring 1.7.4 adds Google contact management, plaintext mail (yay!), and resolves several bugs. This is not a security update.
https://getmailspring.com/

Internet Updates

One or more of these are likely to be of interest to everyone.

FileZilla Client 3.47.1 resolves a bug loading advanced site parameters. This is not a security update.
https://filezilla-project.org/

WinSCP 5.17.1 resolves several bugs. This is not a security update.
https://winscp.net/eng/index.php

Media Updates

These are unlikely to be of interest to most people.

Picard 2.3.1 resolves several bugs. This is not a security update.
https://picard.musicbrainz.org/

Office Updates

One or more of these are likely to be of interest to most people.

LibreOffice Fresh 6.4.1 resolves 80 bugs, including several crash bugs. This is not a security update. Please note that LibreOffice Fresh is their beta product. Most users should use LibreOffice Still.
https://www.libreoffice.org/

Security Software Updates

One or more of these is likely to be of interest to most people.

RogueKiller 14.2.1 updates libraries and resolves a signature update bug. This is a security update.
https://www.adlice.com/download/roguekiller/

uBlock Origin 1.25.0 adds DNS resolution to Firefox and resolves several bugs. This is not a security update.
https://github.com/gorhill/uBlock/releases/latest

Capture Updates

These are unlikely to be of interest to most people.

ScreenToGif 2.21.2 resolves several bugs. This is not a security update.
https://github.com/NickeManarin/ScreenToGif/releases/latest

Converter Updates

These are unlikely to be of interest to most people.

DVDFab 11.0.7.5 adds support for new encodings and improved upscaling. This is not a security update.
https://www.dvdfab.cn/download.htm

Utility Updates

These are unlikely to be of interest to most people.

1Password for Mac 7.4.3 resolves several bugs. This is not a security update.
https://1password.com/downloads/mac/

Dell Command Update 3.1.1 improves reliability and stability. This is not a security update.
https://www.dell.com/support/article/us/en/04/sln311129/dell-command-update?lang=en

Etcher 1.5.79 resolves two minor bugs. This is not a security update.
https://www.balena.io/etcher/

GoodSync 10.10.25 resolves several bugs. This is not a security update.
https://12pd.com/click?goodsync

MS ISO Downloader 8.32 adds images for new Dell models and preview versions of Win10 v2004. This is not a security update.
https://www.heidoc.net/joomla/technology-science/microsoft/67-microsoft-windows-and-office-iso-download-tool

NTLite 1.9.0.7330 resolves several bugs and improves compatibility. This is not a security update.
https://www.ntlite.com/download/

SetDefaultBrowser 1.5 adds support for side-by-side Edge installations. This is not a security update.
https://kolbi.cz/blog/2017/11/10/setdefaultbrowser-set-the-default-browser-per-user-on-windows-10-and-server-2016-build-1607/

TeamViewer 15.3.2682 adds the ability to remove a chat participant, and resolves several bugs, including the ability for mouse actions to be processed when disabled. This is a secuirty update.
https://www.teamviewer.com/en/download/windows/

Developer Updates

These are unlikely to be of interest to most people.

Android Studio 3.6.0.21 resolves the Git bug and disables the Multi Preview feature. This is not a security update.
https://developer.android.com/studio/index.html

WinMerge 2.16.6 resolves several bugs, improves tab behavior, and adds support for more file formats. This is not a security update.
https://winmerge.org/

Web Package Updates

These are likely to be of interest only to web developers.

HumHub 1.4.2 resolves several bugs. This is not a security update.
https://www.humhub.com/en/download

Autoptimize 2.6.2 adds eager-loading support, improves compatibility, and resolves a couple bugs. This is not a security update.

WordPress Importer 0.7 improves compatibility and resovles several bugs. This is not a security update.

That’s all for now folks. Keep it clean out there. 😉

Regards,

Shawn K. Hall
https://SaferPC.info/
https://12PointDesign.com/

Updates 2019-09-10

Hi, Folks!

Today is Patch Tuesday for September 2019 and it’s another big one.

The next build of Windows 10, version 1909, is scheduled to be released later this month. This version will be minor compared to other Windows 10 upgrades and should be nearly indistinguishable from 1903. Well, hopefully local search will work when Cortana Web Search is disabled, but indistinguishable otherwise.

Windows 7 will fall completely out of support in only 4 months. Don’t run out the clock. If you are running a licensed version of Windows 7 you can still upgrade to Windows 10 and have a supported version of Windows for the foreseeable future. Get it done before it’s too late. Don’t want to do it yourself? Call me!

Borderlands 3 will be released on Friday! If you haven’t pre-ordered yet, you can still get a hefty discount. It’ll available for preinstallation starting this evening.

This month we’ve had another series of security lessons.

The Jordan Peterson “deepfake” platform was just the tiniest recent example of how such technology would inevitably be abused. Even though it was removed, it was followed shortly by a custom deepfake that cost one company $243,000. Oops.

The most popular email server and web management platforms both had critical security issues allowing malicious third parties to take over the entire server.

Don’t trust your mobile. Apple iOS and Google Android vulnerabilities disclosed and abused this month can be used to take over your device. Patches are not yet available to resolve these recent exploits for either platform, though both have released patches for unrelelated security vulnerabilities. Google finally acknowledged a security issue in Google Calendar that has been exploited for at least 3 years and the Google Play Store has been publishing malicious apps.

Your “automated assistant” (Siri, Alexa, Cortana, and Hello Google) defaults to calling unrelated third parties since the numbers are pulled from search results, which are easily abused. Heck, the “vast majority” of new domain registrations and websites exist only for malicious purposes. Even if you don’t visit unknown websites, your information is exposed to others whenever you use automated assistants and sometimes even if you don’t intend to. The best solution is to use a privacy respecting browser, such as Vivaldi or Brave and disable any automation and voice controls.

You should always assume all hardware and software will eventually be hacked and maintain them religiously. From Ring to lightbulbs, it will happen. This month shows how entire platforms are being exploited remotely through their networking features.

When even Jack gets hacked you should assume that your information is out there somewhere. This is demonstrated with the latest in a too-frequent series of Facebook data leaks, this time including phone numbers for over 419 million users.

Finally, a friendly reminder that even if your data is “backed up” by a third party you should always back it up again yourself. Between unreliable third party services to the potential damage from ransomware and trojans, there’s no good reason not to pick up a cheap USB thumb drive and toss your important data on it, then toss it into your fireproof safe.

Now back to our regularly scheduled program. The typical computer should see roughly 2 GB in updates today. Let’s get started.

Microsoft released updates for Windows, .NET, Edge, Internet Explorer, Flash, and MSRT (~1.1 GB). This includes security updates. A reboot is required.

Apple released updates for macOS Mojave 10.14.6 Supplemental Update, iOS 12.4.1, tvOS 12.4.1, and watchOS 5.3.1. These are security updates. Use Apple Software Update to install the most current versions.

iOS 12.4.1 is a security update. Use Settings, General, Software Update to install the most current update.

watchOS 5.3.1 is a security update. Use the Watch app on your iPhone to install the most current version.

tvOS 12.4.1 is a security update. Use System, Software Update to install the most current version.

Adobe Flash Player 32.0.0.255 is a security update.
Win: https://12pd.com/click?flash
Win: https://12pd.com/click?flashie
Mac: https://12pd.com/click?flashmac

Don’t forget to check your mobile devices, too! Many updates will also apply to your tablet, phone, kindle or television – so check your device-appropriate App Store and install updates.

Important Notes

Everything above this section should be checked by everyone on every computer. Chances are good that close to every single computer you touch will be affected by those updates. This is not the case with the items below, though you should still check each line item below to see if it applies to software you have installed.

The now-current release of Windows 10 (1903) will cause your computer to feel unusually slow until it is installed. This is a side-effect of the Windows 10 upgrade cycle, which pushes out 3-6 GB through Windows update to get you to the latest Windows 10 release every 6 months. If you don’t let it finish and you’re on a slow connection, it will kill your Internet performance forever. If you don’t have the bandwidth to download the bits, I’m happy to provide loaner USB drives to our local clients, or, if you prefer to have me mail it to you please contact me for information.

Please remember that while I list many different applications within these updates, most people should ONLY install updates for a program if they already have a previous version of that program installed.

It is essential to maintain all the applications you have installed on your computer, but often you can minimize the time investment and the potential for exploitation simply by uninstalling software you do not need or use, reducing the attack surface.

Also note that using the applications own “check for updates” function, when available, will best preserve your current settings, and often avoid any crapware that might come with a fresh installer. Use this option if it’s available to you.

Finally, if you’re sick of doing this all yourself, let me! Call or email me any time, and we can set you up with subscription SaferPC updates which will be installed each month whenever necessary. Click, call or email for more details:
https://saferpc.info/updates/
209-565-12PD
shawn@12pointdesign.com

Driver Updates

If you’re using this hardware – these updates are for you.

Intel Driver and Support Assistant 19.8.34 adds OEM links and improved hardware detection and installation. This is not a security update.
https://www.intel.com/p/en_US/support/detect

nVidia 436.30 resolves several bugs. This is not s security update.
https://www.nvidia.com/Download/index.aspx?lang=en-us

Display Driver Uninstaller 18.0.1.8 improves removal for Nvidia devices. This is not a security update. Be aware that DDU is now wallpapered in advertisements for crapware, so you should avoid it unless you know what you’re doing.
https://www.wagnardsoft.com/display-driver-uninstaller-ddu

Browser Updates

One or more of these are likely to be of interest to everyone.

Google Chrome 77.0.3865.75 is a security update. Use Menu, Help, About to install the most current version.

Firefox 69.0 is a security update. Use Menu, Help, About to install the most current version.

Firefox ESR 60.9.0 is a security update. Use Menu, Help, About to install the most current version.

Vivaldi 2.7.1628.33 is a security update. Use Menu, Help, About to install the most current version.
https://vivaldi.com/

Email Updates

One or more of these are likely to be of interest to everyone.

OutlookAttachView 3.26 resolves a bug when closed prematurely. This is not a security update.
https://www.nirsoft.net/utils/outlook_attachment.html

Internet Updates

One or more of these are likely to be of interest to everyone.

Trillian Mac 6.2.0.19 resolves several bugs. This is not a security update.
https://www.trillian.im/

FileZilla Client 3.44.2 resolves several bugs. This is not a security update.
https://filezilla-project.org/

MaxMind GeoIP 201909 is a data refresh.
https://dev.maxmind.com/geoip/

Npcap 0.9983 improves hardware detection, improves Loopback detection and support, and resolves several bugs. This is not a security update.
https://nmap.org/npcap/

ZeroNet 0.7.1 is a security update.
https://zeronet.io/

Media Updates

These are unlikely to be of interest to most people.

VLC Media Player 3.0.8 is a security update.
https://www.videolan.org/vlc/

FastStone Viewer 7.4 improves Clone and Heal, Pencil, Google Maps integration, and resolves several bugs. This is not a security update.
http://www.faststone.org/FSViewerDetail.htm

Game Updates

These are unlikely to be of interest to most people.

Steam 2019.08.26 is a security update.
https://www.steampowered.com/platform/update_history/index.php?skin=0&id=0

PlayStation PS3 4.85 improves performance. This is not a security update.
https://www.playstation.com/en-us/support/system-updates/ps3/

Office Updates

One or more of these are likely to be of interest to most people.

Atom 1.40.1 resolves a package integration update. This is not a security update.
https://atom.io/

Artweaver 7.0.1 resolves several bugs. This is not a security update.
http://www.artweaver.de/

Krita 4.2.6 resolves several bugs. This is not a security update.
https://krita.org/en/download/krita-desktop/

LibreOffice Fresh 6.3.1 is a security update.
https://www.libreoffice.org/

LibreOffice Still 6.2.7 is a security update.
https://www.libreoffice.org/

Adobe Reader DC Patch 19.012.20040 resolves a font-embedding bug. This is not a security update. Use Help, Check for updates to install the most current version.

Adobe Application Manager 2019.0 is a security update. AAM will be EOL very soon, so if you do not require it, you should remove it instead of updating to the latest version.
https://supportdownloads.adobe.com/detail.jsp?ftpID=4773

Adobe FrameMaker 2019.0.4 doesn’t provide a changelog so should be treated as a security update.
64-bit: https://supportdownloads.adobe.com/detail.jsp?ftpID=6739
32-bit: https://supportdownloads.adobe.com/detail.jsp?ftpID=6737

Security Software Updates

One or more of these is likely to be of interest to most people.

PureOS 9.0 is a major update to PureOS and signals that the Librem 5 release is likely just around the corner.
https://pureos.net/download/

Looking for a secure phone? Check out the Librem 5:
https://puri.sm/products/librem-5/

MSRT 5.76 updates detections. This is a security update.

RogueKiller 13.4.3 resolves several bugs and updates options. This is a security update.
https://www.adlice.com/softwares/roguekiller/

TinyWall 2.1.12 resolves a bug. This is not a security update.
http://tinywall.pados.hu/

Converter Updates

These are unlikely to be of interest to most people.

MakeMKV 1.14.5 resolves several bugs. This is not a security update.
https://12pd.com/click?makemkv

MKVToolnix 37.0.0 resolves several bugs. This is not a security update.
https://www.fosshub.com/MKVToolNix.html

DVDFab 11.0.4.8 adds support for new encodings, improves Meta Info detection, and resolves several bugs. This is not a security update.
https://www.dvdfab.cn/download.htm

FFmpeg 4.2.1 resolves several bugs. This is not a security update.
https://ffmpeg.org/ffmpeg.html

Utility Updates

These are unlikely to be of interest to most people.

Windows 10 Upgrade v1903 updates the installation package for the Windows 10 v1903 build in preparation for v1909.
https://www.microsoft.com/en-us/software-download/windows10

ControlMyMonitor 1.20 improves refresh and default monitor behavior. This is not a security update.
https://www.nirsoft.net/utils/control_my_monitor.html

CPU-Z Installer 1.90 adds support for newer hardware. This is not a security update.
http://www.cpuid.com/softwares/cpu-z.html

DesktopOK 6.56 improves portability, adds options for reporting and export analysis, window positions, and resolves several bugs. This is not a security update.
https://www.softwareok.com/?seite=Freeware/DesktopOK

DMDE 3.6.0 adds support for new filesystems, resolves several bugs. This is a security update.
https://dmde.com/

FolderChangesView 2.28 resolves a notification bug. This is not a security update.
https://www.nirsoft.net/utils/folder_changes_view.html

GoodSync 10.10.7 removes support for Amazon Cloud Drive, resolves several bugs. This is not a security update.
https://12pd.com/click?goodsync

HWMonitor 1.41 adds support for newer hardware. This is not a security update.
http://www.cpuid.com/softwares/hwmonitor.html

IsMyHdOK 1.84 improves compatibility. This is not a security update.
https://www.softwareok.com/?seite=Microsoft/IsMyHdOK

NTLite 1.8.0.7115 adds support for Windows 10 v1909, resolves several bugs. This is not a security update.
https://www.ntlite.com/download/

OSForensics 7.0.1003 resolves several bugs. This is not a security update.
http://www.osforensics.com/download.html

PointerStick 3.68 improves multi-monitor operation. This is not a security update.
https://www.softwareok.com/?seite=Freeware/PointerStick

Sysmon 10.4 adds nested rule support, improved conditions, and resolves several bugs. This is not a security update.
https://live.sysinternals.com/

Process Explorer 16.30 adds Shared Commit, and resolves several bugs. This is not a security update.
https://live.sysinternals.com/

Rufus 3.7 adds persistent partition support for Debian and Ubuntu flavored ISOs, reports SuperSpeed+ devices, resolves several bugs. This is not a security update.
https://rufus.ie/en_IE.html

SimpleWMIView 1.40 adds Case Sensitive option to Quick Filters. This is not a security update.
https://www.nirsoft.net/utils/simple_wmi_view.html

Synergy 1.10.3 resolves several bugs and updates the VC++ dependency to 2019. If you’re having problems with the update, install the VC++ 2019 runtime, reboot, then reinstall.
https://members.symless.com/synergy/downloads/list/s1

TaskSchedulerView 1.52 adds Case Sensitive option to Quick Filters. This is not a security update.
https://www.nirsoft.net/utils/task_scheduler_view.html

TraceRouteOK 1.51 updates language files and improves compatibility with Windows 10 v1909. This is not a security update.
https://www.softwareok.com/?seite=Microsoft/TraceRouteOK

WinScan2PDF 4.94 adds page selection and improved compatibility with Windows 10 v1909. This is not a security update.
https://www.softwareok.com/?seite=Microsoft/WinScan2PDF

Developer Updates

These are unlikely to be of interest to most people.

Android Studio 3.5.0.21 integrates several automated improvements, performance optimizations, diagnostics, and resolves several bugs. This is not a security update.
https://developer.android.com/studio/index.html

Node.js 12.10.0 resolves many bugs, improves documentation, and updates dependencies. This is not a security update.
https://nodejs.org/en/

Visual Studio Code 1.38 improves search and replace, resolves several bugs, and adds new features. This is not a security update.
https://code.visualstudio.com/

Virtual Machine Updates

These are unlikely to be of interest to most people.

VirtualBox 6.0.12-133076 resolves several bugs. This is not a security update.
https://www.virtualbox.org/wiki/Downloads

Web Package Updates

These are likely to be of interest only to web developers.

Adminer 4.7.3 improves performance and stability, resolves several bugs. This is not a security update.
https://www.adminer.org/en/

Drupal 8.7.7 resolves several bugs. This is not a security update.
https://drupal.org/download

Nextcloud Server 16.0.4 updates libraries and resolves several bugs. This should be treated as a security update.
https://nextcloud.com/

ScreenConnect 19.3.25270.7185 resolves bugs. This is not a security update.
https://www.connectwise.com/software/control/download

WordPress 5.2.3 is a security update.
https://wordpress.org/

myStickymenu 2.2.2 resolves a cosmetic bug. This is not a security update.

NextScripts Social Networks Auto-Poster 4.3.9 resolves several bugs, improves integration with Blogger, Reddit, Pinterest, and WordPress.com. This is not a security update.

Theme My Login 7.0.15 resolves update bug, adds two new filters. This is not a security update.

W3 Total Cache 0.10.0 resolves several bugs, adds support for new S3 regions, webp caching, and other improvements. This is not a security update.

WP Mail SMTP 1.6.2 improves reliability and resolves several bugs. This is not a security update.

Show IDs 1.1.3 improves compatibility. This is not a security update.

That’s all for now folks. Keep it clean out there. 😉

Regards,

Shawn K. Hall
https://SaferPC.info/
https://12PointDesign.com/

Catphishing on the Rise

In the last week I’ve had three separate Facebook friends re-friend me using new accounts. A few months ago I even had a cousin re-friend me “after Facebook sent him a million dollars and he could finally afford to create a new account!” His words, not mine. He was, of course, not actually my cousin but an impostor trying to get me to click through a third party link to infect my computer. It was kinda cute. 🙂

Clients have reported that online friends they’ve known for years are now re-friending them and asking for money to bail them out of strange situations — everything from jail to “beta testing” to solar investment loans. In all cases, contacting the person directly with their (previously known) offline contact methods (phone, text, IRL) results in first surprise, then horror, as the person realizes what has been done in their name.

And that’s the real issue here. It’s not like you’re witnessing your friends falling for a scam from an anonymous Nigerian Prince. No, they’re friending you and you (in their mind) are responsible for anything that happens to them. From that moment forward, even long after they learn it was not really you, they’ll always associate you with this event. Some won’t talk to you anymore out of embarrassment. Some will blame you as though there were some way you could have prevented their folly. In any case, you’re both harmed by a total stranger using your name.

This phenomena is called catphishing: The process of creating a fake online persona based on someone else and using it to take advantage of the target’s friends. Impersonation through, quite literally, duplicity.

Here’s the problem

She was astonished to see how her grandmother looked.

She was astonished to see how her grandmother looked.

Online service providers, such as Facebook, Google, Yahoo, Microsoft and so on, don’t exactly perform DNA testing to ensure that the guy claiming to be your neighbor really is your neighbor. If they did, nobody would use their services. Since they don’t, it’s up to you to be able to identify whether it really is your neighbor.

They don’t make it easy.

These intelligent scammers will use just about any means possible to replicate the identity of the person they’re posing as. They’ll re-use the same or similar image as their personal photo. They might crop it differently than the original that they’ve harvested from the real person’s page, but it’ll be “real”. They’ll also migrate some content, mostly copied directly from the original account, onto the new catphishing page. They’ll also copy personal details, such as dates, employment or social history, possibly even replicating the victim’s relationships with additional accounts. All it really takes, when the information is already available only a click away, is the time to copy and paste.

These types of phishing accounts are usually short-lived. Within only a few days they’ll be identified by the targets friends as a phish, though in that time dozens or even hundreds of people may be victimized. This means the attacker will have to act fast. Once they’ve created the account they’ll quickly send out many friend requests to the targets existing friends. They’ll then add or contact many, and the few that answer quickly will then be social engineered.

First a little small talk, then mentioning some great event – like being mailed a million dollars by Mark Zuckerberg, or how they just saved a bunch of money by doing something different like taking advantage of a government program or loan gimmick. They won’t waste much time getting to the pitch, though they might not be able to respond to everyone all at once so it might be a day or two before they push. When you feign interest they’ll have a link at the ready to help you “research” their pitch. It might even be a personal page on a popular site or a typo-squatted version of a popular domain. They’ll seed the idea then send you a link to infect yourself or enable you to self-hijack by posting your account information at an untrustworthy site.

While you’re giving up your information, your real friend is completely oblivious to what is happening.

So how do you protect yourself?

First and foremost, don’t just friend everyone that asks. A very effective means of security (in most things) is to let other people be the guinea pig. This means you don’t respond to friend requests or new contacts immediately. Just wait. At least a couple days, but a week or more is ideal. By this time, there’s a good chance other people would have suffered at their hands if it’s a phish, and thus the account may have either been locked or shut down by the time you are prepared to accept the friend request. Patience really is it’s own reward.

Of course, if you suspect an account isn’t legitimate, report it. Most popular websites have tools to report various contacts and requests, and these are the tools you should be using. This allows the website owner (such as Facebook) to aggregate information about these attacks to block specific types of attacks or shut down entire networks of attackers all at once, and possibly prevent some of them in the future. It’s up to you to report it properly and fully, however. Simply blocking a user will not have any effect other than eliminating their unwelcome messages to you. If you want to stop it you have to be specific in how you report it.

On Facebook you can go to the fake user account page, click the account action button (…), select Report, Report this profile, then select “They’re pretending to be me or someone I know.” Then follow the prompts.

fb-report fb-report-profilefp-report-catphish

Don’t forget to tell the person they’re claiming to be, preferably through a previously known offline contact method.

What if they’re posing as me?!

Same thing. Report them quickly and warn your friends that may have succumbed to your fake friendship.

But wait, there’s more! In most states there are laws against phishing. Here in California the law is really written only to protect businesses, but you, as a victim, can sue an impostor for a half million dollars if they pose as your business.

It doesn’t hurt to regularly search social media for your own name, too. Not your account, mind you, just your name. This will return other accounts that are using your name so you can investigate them. Even a few minutes of effort once a month can save you and your friends from a lot of hurt down the road.

Another trick is to add a Google Alert to your name for social media. This bypasses your own social account (if configured correctly) and emails you whenever your name appears on a site. First go to Google Advanced Search and fill out the form to use a search phrase such as this:

“john t example” site:facebook.com -“johntexample”

This searches for his exact name, on Facebook, but excludes his Facebook slug/username. Now go to the Google Alerts page and search for the formula you composed above. “Show options” then set the alert to contact you once per day. It’s not a perfect solution, but it might catch a phish.

Good luck, and keep it clean out there,

Shawn K. Hall
https://SaferPC.info/
https://12PointDesign.com/