Windows 10, version 1809 Features removed or planned for replacement

Here is a Blog from Microsoft about changes to Windows 10 1809.

Features we removed in this release

We’re removing the following features and functionalities from the
installed product image in Windows 10, version 1809. Applications or
code that depend on these features won’t function in this release unless
you use an alternate method.

Feature Instead you can use…
Business Scanning, also called Distributed Scan Management (DSM) We’re removing this secure scanning and scanner management capability – there are no devices that support this feature.
FontSmoothing setting in unattend.xml The FontSmoothing setting let you specify the font antialiasing
strategy to use across the system. We’ve changed Windows 10 to use ClearType
by default, so we’re removing this setting as it is no longer
necessary. If you include this setting in the unattend.xml file, it’ll
be ignored.
Hologram app We’ve replaced the Hologram app with the Mixed Reality Viewer.
If you would like to create 3D word art, you can still do that in Paint
3D and view your art in VR or Hololens with the Mixed Reality Viewer.
limpet.exe We’re releasing the limpet.exe tool, used to access TPM for Azure connectivity, as open source.
Phone Companion When you update to Windows 10, version 1809, the Phone Companion app will be removed from your PC. Use the Phone page in the Settings app to sync your mobile phone with your PC. It includes all the Phone Companion features.
Future updates through Windows Embedded Developer Update for Windows Embedded Standard 8 and Windows Embedded 8 Standard We’re no longer publishing new updates to the WEDU server. Instead, you may secure any new updates from the Microsoft Update Catalog.

Features we’re no longer developing

We’re no longer actively developing these features and may remove
them from a future update. Some features have been replaced with other
features or functionality, while others are now available from different
sources.

If you have feedback about the proposed replacement of any of these features, you can use the Feedback Hub app.

Feature Instead you can use…
Companion device dynamic lock APIS The companion device framework (CDF) APIs enable wearables and other
devices to unlock a PC. In Windows 10, version 1709, we introduced Dynamic Lock,
including an inbox method using Bluetooth to detect whether a user is
present and lock or unlock the PC. Because of this, and because third
party partners didn’t adopt the CDF method, we’re no longer developing
CDF Dynamic Lock APIs.
OneSync service The OneSync service synchronizes data for the Mail, Calendar, and
People apps. We’ve added a sync engine to the Outlook app that provides
the same synchronization.
Snipping Tool The Snipping Tool is an application included in Windows 10 that is
used to capture screenshots, either the full screen or a smaller, custom
“snip” of the screen. In Windows 10, version 1809, we’re introducing a new universal app, Snip & Sketch,
that provides the same screen snipping abilities, as well as additional
features. You can launch Snip & Sketch directly and start a snip
from there, or just press WIN + Shift + S. Snip & Sketch can also be
launched from the “Screen snip” button in the Action Center. We’re no
longer developing the Snipping Tool as a separate app but are instead
consolidating its functionality into Snip & Sketch.

macOS 10.12 Draft NIST Security Configuration Checklist

NIST invites
comments on Draft Special Publication (SP) 800-179 Revision 1, Guide to Securing macOS 10.12 Systems
for IT Professionals: A NIST Security Configuration Checklist. This
publication assists IT professionals in securing macOS 10.12 desktop and laptop
systems within various environments. It provides detailed information about the
security features of macOS 10.12 and security configuration guidelines. The
publication recommends and explains tested, secure settings with the objective
of simplifying the administrative burden of improving the security of macOS
10.12 systems in three types of environments: standalone, managed, and
specialized security-limited functionality.

A public comment period for this document is open until November 16, 2018.
We strongly encourage you to use the comment template for submitting your
comments.

CSRC Update:
https://csrc.nist.gov/news/2018/nist-releases-draft-sp-800-179-rev-1-for-comment

Publication Details:
https://csrc.nist.gov/publications/details/sp/800-179/rev-1/draft

SSH ISSUE

For the past four years, thousands of servers may have been subject to an  extremely simple authentication bypass vulnerability. CVE-2018-10933 affects libssh versions since 0.6.0, an implementation library for Secure Shell (SSH) that was released in 2014. It is limited only to certain implementations of SSH and does not affect the widely-used OpenSSH. 
Still, all the attacker has to do is send the server the message SSH2_MSG_USERAUTH_SUCCESS” instead of “SSH2_MSG_USERAUTH_REQUEST” and they have full access. Experts are saying that the overall impact is small, given that OpenSSH is not impacted and a libssh patch has already been released. So how many systems are actually at risk? A quick Shodan search by one researcher returned 6,351 servers just by looking for “libssh”. Another researcher added port 22 to the search, bringing the number down to 3,004. But this doesn’t tell us how many systems are running vulnerable versions of of libssh. And really, pinning down an accurate number is not easy. Shodan doesn’t cover everything that’s out there and what’s out on the internet can change in the blink of an eye. 


Figure 1. Shodan Search for libssh 0.6.0 Source: https://shodan.io

We ran our search anyway and excluded the two patch versions that fix CVE-2018-10933, 0.7.6 and 0.8.4. Our total, 2,973, was only reduced by three for a total of 2,970 systems. Searching only for the first impacted version, 0.6.0, returned 1,259 systems. It’s not a large number, but that’s still over a thousand systems that have not been properly patched in four years. These systems can also easily be found in a matter of minutes.
 

Figure 2. Shodan Search Result Details https://shodan.io
If that isn’t enough, take a second look at the figure above. Most of the identified systems are based in the United States and belong to major communications companies. Sure, the footprint of this vulnerability is pretty small, but it’s exactly the type of low-hanging fruit attackers look for – made all the more enticing by the organizations that appear to be most affected. 
Sources:
 
Thanks to Peraton for this information

APT Group TeleBots Linked to Three Major Cyber Attacks

Advanced Persistent Threats (APT) are being recognized as one of the biggest cyber threats in the industry today. There are many groups globally behind the numerous attacks of this type in recent history. Three major cyber incidents that garnered global attention were the BlackEnergy power grid attack, the Industroyer power grid attack, and the NotPetya malware outbreak. However, what if the same APT group was behind all three of these attacks?
The BlackEnergy attack caused blackouts in the Ukranian power grid in December 2015. Industroyer, also known as CrashOverride, also attacked the Ukranian power grid in December 2016 and is the first case of malware designed to specifically target a power grid. After the BlackEnergy attack, the group behind it (also called BlackEnergy) became known as TeleBots and carried out attacks against the Ukranian financial sector, eventually culminating in the outbreak of the NotPetya malware. There was speculation in the cybersecurity community that the BlackEnergy and Industroyer attacks were both perpetrated by the TeleBots group but no evidence to support these claims. However, the discovery of another TeleBots malware, Exramel, by the ESET security group in April 2018 provided the missing link.
Exramel uses a backdoor that appears to be an upgraded version of the backdoor used by Industroyer. There are many similarities in the code, especially the list of available commands it can receive from its Command and Control (C&C) servers and the way each handles reporting and redirecting output streams. Each backdoor also disguises itself as an antivirus service for detection avoidance and groups targets based on their security solutions being used. The similarity between the two led the ESET researchers to conclude that it is unlikely to be a case of coincidental code sharing between threat actors.
Linking TeleBots to Industroyer shows just how much of a threat the group can pose, being the single entity behind three of the most groundbreaking and devastating cyberattacks in history. In addition, the recent claims from multiple governments that Russian military intelligence groups are behind TeleBots throws even more intrigue into the mix and leaves a daunting question: what could TeleBots be up to next?
Sources:

 https://threatpost.com/notpetya-linked-to-industroyer-attack-on-ukraineenergy-grid/138287/
 https://www.zdnet.com/article/security-researchers-find-solid-evidencelinking-industroyer-to-notpetya/
https://www.welivesecurity.com/2018/10/11/new-telebots-backdoorlinking-industroyer-notpetya/ 

KB4462928 – Critical Update for WS2016 Storage Spaces Direct Deployments

The 10C update for Windows Server 2016 has just been published,
it includes critical updates for Storage Spaces Direct deployments and we
recommend all customers aggressively adopt.  This update addresses all top
known supportability issues.

 

October 18, 2018—KB4462928 (OS
Build 14393.2580)

 

 

Important Updates

Specifically, this update includes fixes for the following
issues:

 

“Event 5120” with
STATUS_IO_TIMEOUT c00000b5 after an S2D node restart on Windows Server 2016 May
2018 update or later

 

Virtual Disks resources are in No
Redundancy or Detached status in a Storage Spaces Direct cluster

2018 NY Metro Joint Cyber Security WEBINAR

The 2018 NY Metro Joint Cyber Security WEBINAR will take place on Thursday October 18th.
NYMJCSC is now in its fifth year; featuring keynotes, panels and
sessions aimed at various aspects of information security and
technology.

This year will feature a webinar format allowing NYMJCSC to reach and educate a broader audience.

To register please go here

Conference
Agenda

Time
Slot		 Topic Speaker
2:00
– 2:40		 Behavior-based Internal Controls that Prevent Ransomware, Employee Theft, and Denial of Service attacks Jeffrey Wagar
Past President,
ISACA New Orleans Chapter
2:45
– 3:25		 Cyber Risk: It’s All About People Alan Brill
CISSP, CFE, CIPP/US, FAAFS
Senior Managing Director,
Cyber Risk, North America,
Kroll (a division of Duff & Phelps)
3:30
– 4:10		 Cyber Dogfighting: Hacker Decision-Making and the Korean Air War Mathew J. Heath Van Horn
Assistant Professor,
SUNY Delhi School of Business
4:15
– 4:55		 Assessing Legal and Contractual Risk and Uncertainty with Bug Bounty Programs, Vulnerability Disclosures and Information Sharing Mark H. Francis
Partner – Tech & Data,
Holland & Knight
4:50
– 5:30		 “Not If but When?” – Leveraging AI to Jettison Mantras of the Past: How AI will Liberate Security of the Future John McClurg
VP & Ambassador-At-Large,
Cylance
 

Free NYC Secure app

This new app from NYC

  • Alerts you to unsecure Wi-Fi networks, unsafe apps in Android, system tampering & mor
  • Helps you protect your phone and your privacy
  • $0 to download, $0 to use, no in-app purchases, no ads

How does the app help protect me?

The app detects potential threats in real time to your device, to Wi-Fi networks you may connect to, and for Android users, it detects whether any app you’ve downloaded might 
be unsafe. When the app detects a threat, it will send you an alert in real time and offer a recommendation on how to address the threat, such as suggesting you disconnect from a particular Wi-Fi network. These alerts include:
  • Device alerts—These alerts warn you about settings or activity that could potentially put your device at risk.
  • Network alerts—These alerts warn you about potentially compromised networks you are connected to
  • .App alerts (Android only)—These alerts warn you when issues arise on apps you have installed that could compromise your device’s security.
Go here to learn more https://secure.nyc/

Free Credit Protection Information


f you haven’t frozen your credit reports yet, this could be your moment.

Under the Economic Growth, Regulatory Relief, and Consumer Protection Act, freezing your credit at all three major credit bureaus — Equifax(1-800-525-6285),

Experian (1-800-397-3742)  and TransUnion (
1-800-680-7289). Now is for free, previously, states set prices for credit freezes, which typically cost
about $10.
Other links of importance

•       
Federal Trade Commission www.ftc.gov

•       
Identity Theft Hotline 1-877-438-4338

•       
Social Security 1-800-269-0271

•       
In the United States, you can report tech
support scams with the Internet Crime
Complaint Center (IC3) or use the FTC Complaint Assistant form.

Another tool you might want to look at is  Lock & Alert 

Equifax offers a Lock & Alert service allows you to lock and
unlock your Equifax credit report for free, online or with the Equifax Lock
& Alert app. By locking your credit report, you can restrict access to it by third
parties, with certain exceptions. These exceptions, for instance, may include
lenders and creditors where you have existing accounts. Federal, state and
local government agencies are also exceptions.
Locking your Equifax credit file will prevent access to it by certain
third parties. Locking your Equifax credit file will not prevent access to your
credit file at any other credit reporting agency. Entities that may still have
access to your Equifax credit file include: companies like Equifax Global
Consumer Solutions which provide you with access to your credit report or
credit score, or monitor your credit file; federal, state, and local government
agencies; companies reviewing your application for employment; companies that
have a current account or relationship with you, and collection agencies acting
on behalf of those whom you owe; for fraud detection purposes; and companies
that wish to make pre-approved offers of credit or insurance to you. To opt out
of such pre-approved offers, visit www.optoutprescreen.com.

Draft of NIST’s Transport Layer Security (TLS) Guidance Now Available for Comment:(SP) 800-52 Rev. 2

NIST has released a second draft of
NIST Special Publication (SP) 800-52 Revision 2,Guidelines for the Selection, Configuration, and Use of
Transport Layer Security (TLS) Implementations. It provides
guidance for selecting and configuring TLS protocol implementations that
utilize NIST-recommended cryptographic algorithms and Federal Information
Processing Standards (FIPS). The document requires that government TLS servers
and clients support TLS 1.2 configured with FIPS-based cipher suites, and
recommends that agencies develop migration plans to support TLS 1.3 by January
1, 2024.

 

A public comment period for this document is
open until November 16, 2018.

 

CSRC Update:

Publication Details:

 

Disaster Relief: Don’t be a victim of fraud

As a public Service announcement I am copy and posting this on my blog. The original content comes form CENTER FOR CYBER SAFETY AND EDUCATION,

We have all seen the devastation and trail of destruction that
events such as hurricanes, tornadoes, and earthquakes can cause. But
before you take out your credit card, make sure your donations are
really going to the victims and those that are helping provide them with
the materials to survive and start their lives over again. While our
hearts ache with helplessness, others’ fill with greed and see this as
the perfect opportunity to exploit your sympathies and deceive you into
sending money.

If you want to help by donating, make sure you know who you
are really donating to before you give out your credit card number or
write a check.

Any time you give to a charity, you want to do your homework, but in a
crisis like this, we are often inspired by social media or by what we
see on television and rush to make a donation. It is in times like these
that we recommend you stick with the bigger, established organizations
with proven track records. These organizations have the resources and
structures to maximize your donation with minimal overhead, meaning more
of your money will go to help victims.  You can find a great list of
them at https://www.nvoad.org/voad-members/national-members/.
Some unknown “charities”, GoFundMe-style requests, and social media
outreaches you come across may be legitimate, but many are not. Even if
they are really trying to help, it is not uncommon for organizations
like these to have high overhead and administrative cost that will
result in only a small amount of your donation actually making its way
to help the victims.


TIPS WHEN GIVING DURING A CRISIS:

  • Don’t give over the phone or click on links found in emails or
    social media. Go directly to the official website for a charity that you
    are familiar with and donate on their page. Don’t give to any third
    party solicitations.
  • Be skeptical of cash requests in front of your local grocery store
    or other establishments. Who are these people? Don’t be fooled by what
    they say or how they are dressed. Ask questions, or better yet, go back
    home, research them and then donate online.
  • Don’t be fooled by celebrity names being attached to a campaign. The
    organization could be using someone’s name without their permission, or
    that celebrity could also have been duped and is unwittingly lending
    their name to what they think is a good cause.
  • Don’t fall for all the sad stories you are going to see and read
    about where they ask you to give to help a specific victim. There will
    be hundreds of thousands of such stories. You can best help by
    supporting legitimate charities, not by sending them money directly.
  • Give directly to your charity of choice and designate that you want
    the money to go to their Hurricane Michael Relief efforts. This will
    restrict them from using the money to fund their other ongoing programs.

Now is not the time to take a chance or fall for a phone or email
scam. People really do need help, and it is best to support the experts
who are trained and prepared to help those in need.

Your help and support of others is greatly appreciated. Just make sure you don’t get scammed and become a victim yourself.