Category Archives: Security

aka infosec

Flagging software as dangerous for the wrong reasons is idiotic

There’s a disturbing trend in the world of malware detection: falsely labeling software as malware.

For example, there’s an entire category of software that’s being mislabeled as malware by an increasing number of anti-malware providers: torrent software.

Torrent software is widely used by people trying to get access to cultural material that is otherwise locked away by the gatekeepers of big media (by way of prohibitive pricing, overlapping services, poor or unavailable service, geo-locking, release windows, and other big media fuckery).

Torrent software is used all over the world to legally share media in an extremely efficient, and Internet-friendly way.

But big media doesn’t care about any of that, because torrent software is also used for piracy.

Currently, there are efforts underway by media organizations to discredit and cripple torrent software in any way possible. Apparently they are now leaning on anti-malware software and service providers.

Why would an otherwise reputable anti-malware organization erroneously flag software as malicious? There are a number of possibilities:

  • They are being fed false information
  • Industry/corporate threats
  • Financial incentives

Why is this a problem?

  • It’s an extremely annoying inconvenience for users. Unable to install the falsely-labeled software, or exclude it from malware scans, some users will resort to uninstalling their anti-malware software.
  • It’s increasingly difficult for users to distinguish between actual threats and bullshit.
  • If an actually malicious version of one of these programs comes along, there’s no way to distinguish it from other versions that are erroneously flagged as malicious.
  • A general loss of trust in anti-malware providers and their services.

Big media will keep playing this idiotic game of whac-a-mole in any way their lawyers dream up. Media piracy continues, despite these efforts, and the only people affected are innocent users.

Advice to anti-malware purveryors: stop doing this. It’s short-sighted, dangerous, and stupid.

Patch Tuesday for March 2021

It’s another Patch Tuesday, usually referred to by Microsoft as ‘Update Tuesday’. Terminology aside, what it means is a big pile of updates that will be foisted upon most Windows users over the next few days.

Those of us sticking with Windows 8.1 can still review the available updates and install them at our leisure, which can be very satisfying when an update that we defer turns out to cause problems. But Microsoft seems to reserve its major screwups to Windows 10 updates these days (incuding this month’s printing crashes, and the fix for those crashes).

If you’re running Windows 10, you can defer updates for as long as a month… unless you’re running any of the Home versions, in which case the updates are as inevitable as taxes.

This month’s updates address several extremely serious security vulnerabilities in Exchange, Microsoft’s email server software, which ordinary folks are very unlikely to be running.

But the parade also includes updates for the usual offenders: Internet Explorer, Microsoft Edge (both the Chromium-based and original versions), Office (Excel, PowerPoint, SharePoint, Visio), Visual Studio, Visual Studio Code, and of course Windows. One hundred and thirty-one vulnerabilities* are addressed in all.

Microsoft’s Security Update Guide is currently the official source for this information. The SUG has undergone some improvements lately, and it’s gradually getting easier to navigate, which is a relief.

If you’re still running Windows 7, today’s festivities are largely meaningless, though Microsoft does occasionally toss a bone in your direction, in the form of a Windows 7 update normally reserved for those deep of pocket. Microsoft will presumably continue to do this when a flaw is serious enough that witholding the fix would create a public relations problem for the company.

The release notes for today’s updates provide additional details, though they are still sadly somewhat incomplete.

* The vulnerability count varies depending on who’s looking. According to the SANS Internet Storm Center, “This month we got patches for 122 vulnerabilities. Of these, 14 are critical, 5 are being exploited and 2 were previously disclosed.” Brian Krebs says “from Microsoft today…the company released software updates to plug more than 82 security flaws in Windows and other supported software. Ten of these earned Microsoft’s “critical” rating”. Clearly Microsoft’s Security Update Guide still needs work.

Patch Tuesday for February 2021

We’re gradually moving into a world where the software we use every day is maintained remotely, because it runs on or from a remote server, or because it automatically updates itself. This is widely viewed as progress, since the responsibility of protecting everyone from vulnerable software moves away from software users, to software producers. Responsible software producers no longer simply create and sell software, developing and making available updates when necessary; they are taking on the task of deploying those updates to user platforms.

There are drawbacks to this approach. Many people — including myself — are reluctant to cede control of the software we use to faceless corporate drones. We are wary of allowing corporate interests control what we see on our computers. With Windows 10, everything is in place to allow Microsoft to sell advertising space on your computer screen. We shudder to think of the nightmare scenarios resulting from bad (and unavoidable) updates.

For those of us who are resistant to these changes, there are options. Most software that automatically updates itself includes settings to disable auto-updates in favour of manual updates. Notable exceptions are Windows 10, and almost all Google and Adobe software.

There are other problems. Once, every update came with release notes and change logs. Increasingly, the details of changes in updates are not published, and users must simply trust that software producers only ever intend to make things better for us. Sadly, that is not always the case. The Windows desktop client for Spotify is a good example: it’s buggy, unstable, crash-prone, and although it is updated frequently, new versions are not documented in any way. Installing Spotify updates is a game of Russian Roulette, and it’s not optional.

Where do we go from here?

Updates should always be optional. Sure, install them by default, but provide settings to allow users to fully control whether and when updates are installed. At the very least, this would make updates much less stressful for business and educational IT staff. How about providing a free version that automatically updates itself and allows advertising, and a reasonably-priced version that allows control over updates and advertising? I’d be willing to pay a few bucks extra to have that kind of control.

Meanwhile, back to reality

Here in the real world, we’ve got more updates from Microsoft and Adobe, many of which are not optional. Some of these updates are not available for free, and are instead prohibitively expensive (e.g. all updates for Windows 7).

First up it’s Microsoft, with software updates addressing fifty-six vulnerabilities in .NET, Edge, Office, Sharepoint, Visual Studio, VS Code, Windows, and Defender.

If you try to count the number of distinct updates, your numbers will vary, depending on what you’re counting. As such, I will no longer be attempting update counts.

You can wade through the details yourself, using the new, ‘improved’ Security Update Guide. You can also find a summary on the official release notes page for this Patch Tuesday.

Several of this month’s updates address critical vulnerabilities that are being actively exploited. Which of course drives home the point that people really need to update, as soon as possible. Which in turn is a strong argument for forcing those updates. Welcome to the new update hell reality.


Adobe logoAdobe has been installing automatic update mechanisms on your computer for a few years now. As with Google software, this is accomplished using a variety of techniques that are also used by malware: to make sure they are always enabled, to reinstall themselves when removed, and to remain hidden as much as possible. While it is possible to remove or disable these update mechanisms, doing so is an exercise in frustration, because they will return, sometimes in a form that’s even more difficult to remove. The only real solution is to avoid using such software.

If you’ve ever opened a PDF file on your computer, there’s a good chance that it opened in Adobe’s free Acrobat Reader. In which case that software is updating itself automatically, using a system service called Adobe Acrobat Update Service.

Adobe released a new version of Reader on February 9: 2021.001.20135. This new version addresses at least twenty-three security vulnerabilities in earlier versions. Since it’s difficult to know exactly when automatic updates will occur, it’s a good idea to check. On Reader’s menu, navigate to Help > About Adobe Acrobat Reader DC. If your version is out of date, select Help > Check for Updates on Reader’s menu to install the new version.

Java 8 Update 281

Oracle’s Critical Patch Update Advisory for January 2021 includes an entry for Java. There’s a single security vulnerability in Java 8 Update 271 and, presumably, in earlier versions as well.

The risk of using an unpatched version of Java depends on how you use it. If it’s only used to run specific, business-related software, the risk is low. By far the biggest risk is Java code that arrives on your computer by way of compromised web sites, or in email.

Java’s newer, built-in security features make it less of a risk than in years past, but risk remains. As a rule, it’s best to keep Java up to date.

If Java is installed on your Windows computer, you’ll see an entry for it in the list of installed software in the Control Panel or Settings. You should also see an applet in the Control Panel for Java, which you can use to both check which version is installed, and update it if necessary.

To get to the Control Panel in Windows 10, click the Start button, then start typing “control panel”. You should see it in the search results as you type. Click the search result to get there.

Patch Tuesday for January 2021

There’s no stopping the juggernaut of monthly updates coming from our pals in Redmond.

This month’s load of updates, based on analysis of the new, ‘improved’ Security Update Guide, shows that we have updates for Edge, Office (2010, 2013, 2016, and 2019), Sharepoint, SQL Server, Visual Studio, Windows (7, 8.1, and 10), and Windows Server (2008, 2012, 2016, and 2019), addressing eighty-three security vulnerabilities in all.

There’s a summary of this month’s updates linked from the SUG, but as usual, it’s bafflingly incomplete.

Windows 8.1 computers can get this month’s updates via Windows Update in the Control Panel. Windows 10 computers will get the updates over the next few days, unless they’ve been configured to delay updates temporarily. Windows 7 users are still basically out of luck.

Flash is DEAD

Adobe’s kill switch for Flash went into effect as scheduled yesterday. Any Flash media you try to view from now on will show a placeholder image, which links to the End Of Life announcement for Flash.

That includes any Flash media you have lying around on your computer. For example, I found the Flash test animation on my main computer and uploaded it to my web server, where until January 12, it worked perfectly. That same Flash animation used to show on the main Flash help page, but of course that page now shows the placeholder as well.

And so ends the long, exasperating, security nightmare that was Flash. Good riddance.

Adobe Reader update, Flash ‘kill switch’

Adobe logoEarlier this week, Adobe released new versions of its Acrobat/Reader product line, to address a lone security vulnerability in earlier versions.

The new version of Acrobat Reader DC, which is the free — and widely used — version of Acrobat, is 2020.013.20074.

Recent versions of Acrobat and Reader usually manage to update themselves, but if you use either of them for viewing PDF files from untrusted sources, you should make sure you’re running the latest version. In Acrobat Reader DC, navigate its menu to Help > Check for Updates... If a newer version is available, you’ll see an option to install it.

Flash ‘Kill Switch’

We expected Adobe to show warnings in Flash after its development and support end in January 2021. Now comes news that Adobe is taking the rather drastic step of preventing Flash content from playing at all after January 12.

It’s not clear whether it will be possible to override this behaviour, so anyone who still relies on being able to play Flash content after January 12 should be looking into alternatives.

Patch Tuesday for December 2020

Microsoft recently overhauled its Security Update Guide, the web-based resource meant to be the definitive guide to Microsoft software updates. I don’t know what they had in mind, but from the standpoint of usability, there’s little improvement.

I still recommend using the SUG’s handy Download link to save the data in spreadsheet form, which you can then open in an Excel-compatible program, and use filtering and sorting functions to extract the information you need.

The official release notes for this month’s crop of updates is somewhat useful, although it contains neither a complete list of updates nor a complete list of vulnerabilities. It does at least provide a list of the software affected by the updates: Microsoft Windows, Microsoft Edge (EdgeHTML-based), Microsoft Edge for Android, ChakraCore, Microsoft Office and Microsoft Office Services and Web Apps, Microsoft Exchange Server, Azure DevOps, Microsoft Dynamics, Visual Studio, Azure SDK, and Azure Sphere.

The Vulnerabilities tab of the SUG lists fifty-nine vulnerabilities that are addressed by the December updates. That matches the total I obtained in my analysis of the data. As for the number of actual updates, that’s increasingly difficult to determine. There are references to forty-seven help articles and twenty-one sets of release notes in the SUG data.

As usual, Windows 10 computers will get the relevant updates installed when Microsoft feels like it. Windows 8.1 computers are best updated via the Windows Update applet in the Control Panel. Users of Windows 7 and earlier versions are still pretty much out of luck, though it’s worth checking Windows Update anyway.

Adobe Reader update

Adobe logoLast week Adobe released new versions of its Acrobat and Reader products, to address fourteen security vulnerabilities in earlier versions.

In the Adobe product lineup, Acrobat is the commercial PDF builder, while Reader is the free PDF viewer. At one time you pretty much needed to have Reader installed to view PDF files, but these days PDF viewer functionality is increasingly built into operating systems and web browsers.

The new version of Reader — officially referred to as Acrobat Reader DC — is 2020.013.20064. Details are available in the related Adobe Security Bulletin.

All of Adobe’s Acrobat/Reader products update themselves by default, and there’s apparently no simple way to disable that feature. Still, if you have Reader installed, and you use it to view PDF files obtained from email or the web, it’s a good idea to make sure it’s up to date.

To check for updates, start Reader and navigate its menu to Help > Check for Updates... If there’s a newer version available, you’ll be prompted to install it.

Patch Tuesday for November 2020

This month’s pile-o-patches from Microsoft includes updates for Flash in Microsoft browsers, .NET, Exchange Server, Office (2010, 2013, 2016, and 2019), Sharepoint, Windows (7, 8.1, and 10), Windows Server (2008, 2012, 2016, and 2019), Visual Studio, Visual Studio Code, Internet Explorer 11, Edge, and Teams.

Analysis of the new (but not improved) Security Update Guide for November shows that there are at least 102 bulletins (but as many as 118, depending on what’s counted), each with an associated set of updates. As many as one hundred and eighty-five security vulnerabilities are addressed.

Dammit, Microsoft

Microsoft has once again changed the way security bulletins and updates are documented. As a result, it’s now even more difficult to find certain details about individual updates, and more difficult to ascertain just how many updates were made available for a given Patch Tuesday. It seems like Microsoft wants us to give up trying to get a handle on these things, and just install all available updates. Some people have turned to non-Microsoft resources for update information, such as the Patch Tuesday Dashboard, which is useful, but the numbers there don’t match mine, so who knows.

Getting the updates

Most Windows 10 users will get the relevant updates installed automatically over the next couple of days, although more recent versions of Windows 10 do allow updates to be delayed.

Windows 8.1 computers that have automatic updates enabled will also get those updates soon. Otherwise, you’ll need to head to the Windows Control Panel to run Windows Update.

Windows 7 users are still pretty much out of luck.

Java Version 8 Update 271

Oracle’s quarterly Critical Patch Update Advisory for October 2020, published on October 20, includes a list of eight vulnerabilities affecting Java 8u261, 7u271, and older versions.

Security risks arising from the use of older versions of Java are not as scary as they once were, since most current web browsers no longer support Java. The notable exception is Internet Explorer 11, which still supports the Java NPAPI plugin. Still, it’s best to keep Java up to date if it’s installed.

The easiest way to both check whether you have Java installed and see which version you’re running is to go to the Windows Control Panel. On Windows 7 and earlier, the Control Panel is accessible via the Start menu. On Windows 8.1 and 10, Microsoft annoyingly hid the Control Panel, but you can find it by clicking the start button and entering the text “control”. In the list of search results, you should see “Control Panel”. Click that to get to the Control Panel.

If Java is installed, you’ll see its Control Panel entry: Java (32-bit). Once you’ve clicked that, you’ll see the multi-tab Java applet. To see which version is installed, go to the Java tab and click View... The Product column shows the version. If it shows as “1.8.0_271“, that means you’re running Java 8 Update 271. Click Cancel to close that dialog.

To update Java, go to the Update tab and click the Update Now button. Follow the prompts to download and install the latest applicable version.

Alternatively, you can visit the main Java download page and install Java from there.