"> brings Archives - Engr Kabir Saleh

Posts Tagged


Today’s Patch Tuesday brings fireworks and — a magic bullet?

Over the past few years we’ve seen a few security holes that have drawn Chicken Little warnings and vast amounts of unthinking press reports. When you turn on a local news program and hear from the hometown weather reporter that you really need to get Windows patched, a bit of skepticism might be in order.

Today’s Patch Tuesday appears to be headed down the same well-worn chute.

Brian Krebs, the security guru with impeccable credentials, fired an opening salvo in his blog post yesterday:

Sources tell KrebsOnSecurity that Microsoft Corp. is slated to release a software update on Tuesday to fix an extraordinarily serious security vulnerability in a core cryptographic component present in all versions of Windows. Those sources say Microsoft has quietly shipped a patch for the bug to branches of the U.S. military and to other high-value customers/targets that manage key Internet infrastructure, and that those organizations have been asked to sign agreements preventing them from disclosing details of the flaw prior to Jan. 14, the first Patch Tuesday of 2020.

On the one side, we have Will Dorman, a highly respected analyst at the federal CERT Coordination Center, who tweeted:

I get the impression that people should perhaps pay very close attention to installing tomorrow’s Microsoft Patch Tuesday updates in a timely manner. Even more so than others. I don’t know… just call it a hunch? ¯_(ツ)_/¯

On the other hand we have Kevin Beaumont, my favorite plucky porg down in the trenches, who says, simply:

Don’t panic re this one.

A bit of histrionic history here.

Back on Monday — not Tuesday, mind you, but Monday — Sept. 23, Microsoft released a highly publicized out-of-band patch for an “exploited” Internet Explorer 0day known as CVE-2019-1367. The fix was so badly botched that Microsoft ended up releasing four separate fixes for it, over the course of three weeks, and many (millions?) of Windows customers got caught up in the bugs. The security hole itself? It never amounted to a hill of beans.

In November we got a similar treatment for  CVE-2019-1429, a scary “exploited” monster that never materialized. In December, it was  CVE-2019-1458, which has since sunk into obscurity. Back in September, we had emergency warnings about two “exploited” security holes, CVE-2019-1214 and CVE-2019-1215. A few days later, without any announcement, Microsoft removed the “exploited” designation

Then there was the DejaBlue fiasco. Beaumont, who named the security hole and followed it closely, never found a real-world working exploit (although there were several in-the-lab, proof of concept, sorta exploits).

Granted, there have been significant security holes announced with full fanfare, including their own dedicated websites and logos. The most recent real threat came in the form of BlueKeep, announced and patched in May, which actually had a working exploit that appeared in September. Even the NSA warned about it. You had four months or so to get patched. (Full disclosure: I joined the Chicken Little crowd and recommended early patching for BlueKeep, when it wasn’t necessary.)

Many patch-it-now hardliners hearken back to WannaCry, which cut a wide swath back in May, 2017. With its origins in NSA-written hacking code, WannaCry did pose a significant threat, but Microsoft had already released its WannaCry patch, MS17-010, two months before WannaCry appeared.  

I’m not saying that you need to put on rose-colored glasses and “la-la-la” your way through today’s Patch Tuesday shenanigans. But I am saying that a certain amount of restraint could go a long way — especially given Microsoft’s track record for botched Patch Tuesdays.

Join us for a ringside seat as the patches (and problems!) roll out, on AskWoody.com.

Copyright © 2020 IDG Communications, Inc.

Source link

Patch Tuesday brings a reprise of the Autopilot debacle, now quashed, and another Win7 nag

Patch Tuesday in December rarely brings anything worthwhile — everybody’s on vacation, or wants to be on vacation — and this month’s no exception. We got patches for 36 separately identified security holes and two new advisories, full of sound and fury but covering very little.

The one “exploited” security hole — CVE-2019-1458 Win32k Elevation of Privilege Vulnerability — shouldn’t cause any heartburn. Microsoft says:

To exploit this vulnerability, an attacker would first have to log on to the system. An attacker could then run a specially crafted application that could exploit the vulnerability and take control of an affected system.

Then Microsoft gives the hole an “Important” severity rating, a big step below the “Critical” that’s de rigeur. Short version: Although you need to patch sooner or later, you don’t need to worry about any of the security holes right now.

The return of Autopilot

Remember back in October when Microsoft mysteriously pushed out a patch for Autopilot, a little-known app that helps companies set up new machines? I wrote about it in “Microsoft pushes, then yanks, rogue kinda-security patch KB 4523786, ostensibly for Autopilot.” 

Looks like the cows are out of the barn again. Microsoft released KB 4532441 yesterday, the latest “Cumulative update for Autopilot in Windows 10, versions 1903 and 1909: December 10, 2019.” Once again, many folks saw that they were being offered the patch (although this time it apparently only went out to 1903 and 1909 Pro customers). Once again, the patch was offered repeatedly, even after it was installed properly. Once again, Microsoft yanked the patch, then updated the KB article to say:

This update was available through Windows Update. However, we have removed it because it was being offered incorrectly. When an organization registers or configures a device for Windows Autopilot deployment, the device setup automatically updates Windows Autopilot to the latest version.

Note There is no effect on Windows Autopilot being offered to Windows 10 devices. If you were offered this update and do not use Autopilot, installing this update will not affect you. Windows Autopilot update should not be offered to Windows 10 Home.

Those who cannot remember the past are condemned to repeat it.

Odd and sundry patches

In addition to the usual laundry list of patches, we also saw:

A new Malicious Software Removal Tool. Folks who downloaded the patches early may have missed it, because MS didn’t push it until several hours after the initial patching payload.

Updates for .Net Framework 3.5.x, 4.6.x, 4.7.x, 4.8 and more. Dozens of them. Martin Brinkmann has the full list on ghacks.net.

As well as the usual assortment of Office security patches.

There are new Servicing Stack Updates for Server 2008 and Server 2012, with manual download links as usual in ADV990001. If you don’t know about Servicing Stack Updates, don’t sweat it.

The easily dismissed Win7 End of life nag

December’s Windows 7/Server 2008 R2 Monthly Rollup brings a full-screen nag for upgrading to Windows 10, due to appear starting on January 15. Here’s what Microsoft says:

IMPORTANT Starting on January 15, 2020, a full-screen notification will appear that describes the risk of continuing to use Windows 7 Service Pack 1 after it reaches end of support on January 14, 2020. The notification will remain on the screen until you interact with it. This notification will only appear on the following editions of Windows 7 Service Pack 1:

Note The notification will not appear on domain-joined machines or machines in kiosk mode.

The Security-only patch, KB 4530692, includes the nag, which is embodied in the program EOSNotify.exe. Apparently the nag will only appear once, take up the whole screen and, once you’ve dismissed it, never return again. You’ll be forgiven if you recall similar promises during the “Get Windows 10” GWX campaign.

For those of you who can’t be bothered to dismiss the nag screen (or worry that it won’t go away as easily as Microsoft says), you can set this registry key:


To have the value “DiscontinueEOS”=dword:00000001

We’ll be covering that nag and its aftereffects extensively as details unfold. Remember that more than a quarter of all Windows users are on Win7.

Watch the bugs come out of the, uh, woodwork on AskWoody.

Copyright © 2019 IDG Communications, Inc.

Source link

Lockly Secure Pro Brings a Fingerprint Reader to Your Smart Lock – Review Geek


  • 1 – Absolute Hot Garbage
  • 2 – Sorta Lukewarm Garbage
  • 3 – Strongly Flawed Design
  • 4 – Some Pros, Lots Of Cons
  • 5 – Acceptably Imperfect
  • 6 – Good Enough to Buy On Sale
  • 7 – Great, But Not Best-In-Class
  • 8 – Fantastic, with Some Footnotes
  • 9 – Shut Up And Take My Money
  • 10 – Absolute Design Nirvana

Price: $299

A Lockly Secure Pro with keypad activated.
Josh Hendrickson

Between PIN, fingerprint reader, voice commands, an app, and a physical key, the Lockly Secure Pro smart lock has no shortage of ways to unlock your door. And while more options usually mean more convenience, it also means more complications.

Here’s What We Like

  • Fingerprint scanner is faster than a pin
  • App has all the customizations
  • Google Assistant Voice unlock commands!

And What We Don’t

  • Fingerprint scanner doesn’t always work
  • Jumbled keypad is a little frustrating to use
  • Wi-Fi versus Bluetooth connection app differences is annoying

Lockly’s Secure Pro is unlike other smart locks I’ve tried. It doesn’t have a standard keypad. Instead, it features a touch screen that randomly generates numbered circles for you to push.

It also features a fingerprint reader on the side so you can skip the PIN entirely, which is a faster way to unlock your door. For added convenience, the touchscreen serves as a lock button, just touch it anywhere and the door locks. With so many features, this should be one of the most convenient smart locks on the market. But it’s not quite there.

Installing is Fairly Easy for a Smart Lock

When I opened the Lockly box, I felt a little intimidated despite having installed many locks and multiple smart locks. The box includes a giant instruction booklet, complete with guides for measuring your door’s holes and cavities. The good news is, the book is a little bit overkill, I was able to install the lock without much trouble.

Typically the most challenging part of installing a smart lock is balancing the keypad and battery pack on either side of the door before you get them fully secured. The sheer weight of the two pieces will fight you and want to fall out of the door, leaving you trying to clamp them while driving screws awkwardly.

Lockly addressed that issue with two options. They added extra screw holes to the top of the two components so you can secure them directly to the door, which should add stability. I didn’t like that idea, so I went with option two: 3M sticky tape, which worked surprisingly well. Thanks to the tape, I installed the lock in 15 minutes, and without any feelings of frustration.

A Simplisafe, Wyze, and Lockly contact sensors lined up vertically on a door.
In order from top to bottom are Simplisafe, Wyze, and Lockly contact sensors. Lockly’s sensor is huge. Josh Hendrickson

After installing the lock, you plug in the included Wi-Fi hub and connect the largest contact sensor I’ve ever seen to your door. The sensor helps the lock track your door’s open and close state for automated locking.

The battery compartment hardware isn’t very inspiring. It’s plastic, which gives the lock a less premium feel. And the thumb turn is incredibly small, which is only emphasized by the giant plastic box it’s attached to. Every time I turn it to lock or unlock the door, I feel like I’m going to snap it off. To be clear, I highly doubt I could snap it off, but it feels like I could.

The outside hardware, on the other hand, screams smart gadget and feels a little more premium with its large black touchscreen that displays the keypad.

The Keypad is Unique and Mildly Frustrating

A closeup of the Lockly Secure Pro lock, showing four circles full of numbers.
You touch the circle that contains the next number of your PIN, not a number itself. Josh Hendrickson

One of the most unusual aspects of this smart lock is the keypad. Instead of a standard 1-9 keypad for typing codes, you get a random set of numbers on the touchscreen every time it activates. The lock groups the numbers in circles, and you touch those circles (not the number) to enter your code. The next time you use the keypad, the lock will jumble the numbers in the circles.

That means no one can peek from nearby to learn your code. Even if someone were standing directly next to you, they wouldn’t learn your PIN since your touching circles full of numbers. In theory, this works well to prevent PIN theft. In practice, it feels like overkill, especially on my relatively quiet street. I don’t have to worry about anyone trying to spy on my keypad. But I could see the potential usefulness if you installed this lock on an apartment or condo door (whether or not you’d be allowed is another matter). That’s a scenario where someone might have a legitimate reason to be standing close enough to see your type in a PIN.

It’s not very much benefit for me, and using the keypad is a pain. Every time I type my PIN, I have to spend a few moments figuring out where my numbers are now. Did you slip up and hit a wrong circle? Well, they’ll jumble again. It’s mildly annoying. That Lockly requires a six-digit key only adds to that time spent, though admittedly, a six-digit key is more secure than the standard four-digit PIN most smart locks allow.

My family is less patient than I am. When I told them I was writing this review and would soon take the lock off the door, they cheered. They’d rather have a standard keypad that’s simple to use.

A side shot of the Lockly lock, showing a round finger print reader.
When it works, this fingerprint reader is the best part of the lock. Josh Hendrickson

The fingerprint reader, on the other hand, bypasses all that frustration—usually. I try to use this every time instead of the keypad. When it works, it’s great. I put my finger on, and within a second, the door unlocks. That’s faster than a standard PIN on other smart locks.

But you’ll notice the words “when it works.” About 85 percent of the time, the fingerprint reader unlocks the door nearly instantly. But the rest of the time, it doesn’t accept my fingerprint. Sometimes I’ll get lucky if I try again. But usually, the second attempt fails, too, and I have to use the keypad. On those occasions, I’m left frustrated because now I’ve spent a lot of time trying to unlock my door.

In a lot of ways, that’s the story of Lockly Secure Pro: when it works, it’s great. But the clever add-ons lead to moments of frustrations.

When it’s time to lock the door as you’re leaving, just touch the keypad anywhere, and the door will lock. That’s handy for when you’re in a hurry to leave, and you don’t have to spend time searching for a lock button in the dark. But it also meant I occasionally “locked the door” with the door open while I was walking into the house because my hand or arm brushed the screen. So I had to stop, unlock the door, then close it.

Once again, when it works, I like it; when it doesn’t, I’m frustrated. By default, the door locks itself shortly after you unlock it. The door sensor should let the lock know when you close the door, but sometimes that didn’t work correctly, and the lock engaged while the door was open. Thankfully, you can turn that and other features off in the app.

A Competent App Held Up By Two Wireless Standards

The Lockly app, showing locking screen, code access creation, and settings.
You can change nearly any setting you want, as long as you connect to Bluetooth first.

You can’t ask for more controls and options in a smart lock app. The Lockly app (available for iOS and Android) lets you change just about any setting you want. You don’t like that touching the keypad locks the door? You can turn that off. Do you find all the beeps the locks makes when using the app annoying? You can turn that off. Want the keypad to jumble the numbers after every circle push? You can make it do that if you really want to. The only thing you can’t turn off that I would have liked is the keypad scramble feature. You’re stuck with that for better or worse.

You even get the usual smart lock features: remote lock and unlock, ability to generate PINs, and in this case, the ability to create fingerprint scans.

Another thing I like is code generation: You can choose between trusted users, guests, and one-time access PINs. Trusted users keep their codes until you revoke them. You can set guest users to expire automatically and to work just during the times you allow. And one-time access PINs expire immediately after the first use. Lockly lets you generate codes that only by downloading the app, or “offline codes” that are just standard six-digit PINs you tell or text to the person. It’s a lot choice, and the app does good of letting which options does exactly what.

Altogether it’s a well put together app, barring one exception: you can either connect to the lock via Bluetooth or Wi-Fi. Wi-Fi is great for remote access when you’re away from your door. But for some reason, Wi-Fi can’t do everything that Bluetooth can. If the app notifies you of a firmware update, for instance, you’ll need to switch back to Bluetooth to install it. The Bluetooth connection has a very short range, though, so I often need to use the Wi-Fi connection. I never know which connection I need to be in to make changes, and that’s frustrating.

I’d be remiss if I didn’t mention Alexa and Google Assistant integrations. When it comes to Alexa, you get what you’d expect out of it. You can lock by voice and unlock by voice with a PIN. By default, unlocking by voice is off.

Google Assistant integration, on the other hand, is something special. Google doesn’t provide much in the way of APIs for locks, and usually, the best you can do is check on the status of the lock and maybe lock the door by voice. It’s up to the company to implement anything more.

And Lockly went above and beyond here; the company added an unlock by voice feature, using a PIN. It’s fast, reliable, and works well. And that makes it the only lock I’ve tested yet with unlocking capabilities for Google Assistant. That’s a massive win if you’re in a Google Home.

The Lockly Secure Pro is Mostly Good

The inside components to the Lockly smart lock, with a quarter just over the thumb turn, showing a relatively similar size.
This thumb turn is just so small. Josh Hendrickson

Overall the Lockly Secure Pro isn’t a perfect lock. I’m not in love with the plastic hardware or the jumbling PN scheme. But I do love the fingerprint scanner—when it works. It falls short of being a great lock for me, in part because I don’t benefit from some of its most unique features.

But if you do worry about someone watching you type in a PIN, you might like this lock a lot. It does a great job of obfuscating your passcode even as you type it. If you think a Wi-Fi lock is another avenue of access for the bad guys, you can leave the Wi-Fi hub unplugged. And if you don’t like any of the default settings, there’s a decent chance you can change its behavior in the app.

Just keep in mind, you’re paying a premium for those extra security features. At $300, this smart lock costs $50 or more than other great smart lock options like the Schlage Encode, the Kwikset Kevo, or the Yale Assure lock. And the Schlage Encode includes a built-in Wi-Fi hub, which is one more reason it’s nearly perfect.

If a customizable smart lock with PIN protection and fingerprint reader sounds like your idea of a smart lock, then you should undoubtedly consider the Lockly Secure Pro. That goes double if you want the most voice control possible with Google Assistant. But if you want something with more simplicity, you should look elsewhere. You might even save money in the process.

Rating: 7.5/10

Price: $299

Here’s What We Like

  • Fingerprint scanner is faster than a pin
  • App has all the customizations
  • Google Assistant Voice unlock commands!

And What We Don’t

  • Fingerprint scanner doesn’t always work
  • Jumbled keypad is a little frustrating to use
  • Wi-Fi versus Bluetooth connection app differences is annoying

Source link

Defender 4K CCTV System Brings Crystal Clear Home Security at a Budget Price

Our verdict of the Defender 4K:
Crystal-clear 4K footage in daytime, but the field of view is small and night mode suffers. You can’t beat the price, but the software could do with some usability tweaks.

Security cameras are useless if you can’t actually see what’s going on, so it’s surprising to see most companies still pushing grainy HD or worse quality footage. Defender USA is here to change that: the Defender 4K is a complete DIY CCTV system with four wired cameras, each recording at a crystal clear 4K resolution. It includes a massive 1TB drive to record all the footage, and you can plug in your 4K monitor or TV directly to the recorder to live view in full resolution. The whole bundle is currently available for less than $400.

Read on as we take a closer look, check out the video for some sample footage, and at the end of this review, we have a full kit for one lucky reader to win.

What’s in The Box?

Inside the plain packaging you’ll find a value-packed bundle consisting of:

  • A Digital Video Recorder with 1TB hard drive pre-installed.
  • 4 x Defender 4K wired analog cameras.
  • 4 x 60ft/18.2m BNC+DC cables.
  • An HDMI and Ethernet cable.
  • A USB mouse for operating the DVR
  • Power adaptors, mounting templates, quick start guide, and screws.

The only thing missing from the package is a monitor or TV. Up to 4K resolution is naturally supported (over HDMI), but even if you connect something that runs at a lower resolution, the footage will continue to be recorded at 4K.

defender 4k cams

Around the back of the recorder you’ll find a selection of ports:

  • Four BNC analog video connections (for the cameras).
  • HDMI and VGA (HDMI must be used if you want 4K output though).
  • Ethernet port.
  • DC power input.

There’s no room for expansion, so you can’t upgrade by purchasing additional cameras later. Four should be plenty for most people of course, but Defender also offers identical 8 and 16 camera bundles.

defender 4k ports


Take some time to plan your layout, and measure the cabling you’ll require. Although 60ft sounds like enough, you may need to route it up and down walls, or through roof soffits, which can quickly add up. Defender sells 60ft extension cables for $25, but you can find cheaper options elsewhere.

While Defender can’t guarantee any third party cables you purchase will work at full resolution (or even at all), I had some success with a 50m/164ft RG59-rated cable I bought from Amazon UK for £25. This cable resulted in a pink bank along the left side, though this is probably from interference somewhere over such a long run.

intereference on longer cctv cable
The pink band wasn’t present on the original cabling but is likely from interference.

Obviously, a wired system takes a lot longer to physically install than a wireless one. The upside of having wired analog cameras is that none of your precious network bandwidth will be used to transmit video (unless you’re live viewing over the mobile app). You don’t even need to connect it to the network if you don’t want to use the app.

mounting defender 4k
Mounting the Defender 4K next to a much larger (and more expensive!) PoE camera.

There’s no Wi-Fi capability in the Defender 4K, so you may also need to think about your router location. If you’re installing this in your office and only have a single Ethernet line available (used by your PC), you can split it using a network switch

Everything You Need to Know About Home Networking

Everything You Need to Know About Home Networking

Setting up a home network is not as hard as you think it is.
Read More


Initial Setup

Setting up the software side of things is relatively simple, but it’s during the initial set up that you’ll notice some of the quirks of the generic CCTV operating system that Defender uses. Keep the quick start guide to hand.

On the first screen, you’re required to create an IP camera authorization code. As the quick start guides notes, this isn’t actually used on this system, as you can only connect the included wired analog cameras. But you still need to create a code, and it needs to follow certain rules of minimum length and alphanumeric characters. I spent a good minute or so trying to enter a code that would be accepted (but would never be used).

After set up, you’ll notice an Analytics icon on the main menu, complete with a shiny “New” tag, encouraging you to click on it. Don’t bother: Analytics is only available for IP cameras. Which aren’t compatible with this device.

If you’re coming from a previous Defender model, or any professional CCTV system, you’ll feel right at home. For the rest of us, a myriad of complex menus and options awaits. Even for a geek like myself, setting up motion alerts to my phone, for instance, felt overly complex. There’s a lot to delve into, but people who like to tweak settings will have a field day.

24/7 or Motion-Only Recording

During set up, you’ll need to choose whether to record only when motion is detected, or record all the time. Since these cameras aren’t using up network bandwidth, and there’s a large internal drive to store everything on, I opted for 24/7 recording. I’d rather have peace of mind than worry about whether or not the motion was detected. That’s not to say the motion detection was unreliable–it’s really just down to preference.

exporting footage from the defender 4k was easy

With four cameras, this means you’ll get about 12 days of constant recording. As the drive fills up, older footage will be automatically overwritten, but this seems like an acceptable buffer.

Live Viewing on a Monitor

The easiest way to view the CCTV footage is to simply connect a monitor or TV to the HDMI output at the rear of the DVR.

When viewing a single camera feed, you can see the raw 4K stream. When viewing four-up, each stream will be at a maximum of 1080p; but rest assured it’s still recording at 4K in the background.

defender 4k viewing on monitor 4-up

With motion alerts enabled, you can give full-screen focus automatically to any motion activity, for a configurable amount of time. You can also set cameras to auto-cycle. Everything you’d expect or want from a professional CCTV system is in here.

Searching for footage from a particular time or viewing motion-activated recordings is easy, as is the export process. Hit export, insert a thumb drive, and wait. You can even export a suitable video player for Windows at the same time. VLC works fine too, but it’s definitely an obscure video format that I had issues importing into Final Cut for the review.

Defender 24/7 App

The app for the Defender 4K system is called “Defender 24/7” in the store. You may come across Defender HD while searching; this is only for the last generation model and isn’t compatible with this device.

The Defender 24/7 app is best described as bare-bones, with a simple interface to view the camera feeds or scan through recorded events–and not much else. This isn’t necessarily a bad thing, and I found it was responsive, with no app crashes or DVR login failures. That’s always good.

It does feel like a no-frills afterthought though. You can’t access any further configuration options of the DVR from the app, so while it works as a basic remote monitoring tool, it isn’t a replacement for connecting a monitor. If the app is going to be your primary interaction with the system, there are perhaps better options out there for you.

Motion Alerts

Setting up notifications to my phone took a while to figure out. For anyone else struggling, here are the steps required:

  1. Enable Notifications for the Defender 24/7 app.
  2. Also from the app, open the DVR->Settings, and enable the Alarm. Adjust the schedule if needed.
  3. From the DVR menu, open the Camera settings->Motion, and check the box to enable Motion Detection. Adjust the active areas if required.
  4. Open the setting, select the Linkage tab, and tick the box for Notify Surveillance Center (which refers to the app, apparently).
  5. Repeat steps 3 and 4 for each camera you want notifications from.

Yes, that isn’t in the slightest bit simple, and nor is it obvious from the online manuals. Our Defender rep promised some additional tutorial videos were on the way for how to do common tasks like motion alerts, but even so, it would be better if they weren’t needed.

Video Quality and Field of View

4K resolution is the highest I’ve seen in a home security system yet, and it really shows. You can zoom in and still have a good quality picture. Images are crystal clear, with good colors and contrast out of the box (and you can tweak that anyway if needed).

Defender 4K CCTV System Brings Crystal Clear Home Security at a Budget Price defender 4k zoomed
Zoomed in to the extreme. Just look at this dodgy guy, clearly up to no good.

This is really the most important for a CCTV system: it’s no good capturing a grainy image of someone. The footage is limited to 8 frames per second when recording at the full 4K, but this shouldn’t be a problem.

defender 4k sample video frame
View the sample footage in the review video.

At night however, the image quality suffers. With only a single IR LED to light the scene, the sensor really struggles and the ISO is pushed up, resulting in grainy footage. It’s passable, but not nearly on par with the 4K daytime footage. I’ve seen better quality night time recordings from lower resolution cameras that have more IR LEDs.

Defender 4K CCTV System Brings Crystal Clear Home Security at a Budget Price defender 4k night

The other consideration with these cameras is that they’re not wide-angle, so the field of view is quite small. The screenshot below shows a comparison between a Reolink RLC511

Reolink RLC-511: The Best Looking Security Camera Yet

Reolink RLC-511: The Best Looking Security Camera Yet

The Reolink RLC-511 offers fantastic image quality, ease of installation, and rock solid desktop software that can grow into an extensive security system, at an affordable price.
Read More

(5MP resolution), and the Defender 4K (8MP) camera, positioned next to each other.

Defender 4K CCTV System Brings Crystal Clear Home Security at a Budget Price defender 4k fov comparison
Note: The resolution difference is difficult to discern on our embedded image sizes, but the in-laid Defender 4K video cap is 8MP, while the larger view is just 5MP. On a pixels-per-degree of view basis, the Defender 4K is significantly higher, allowing you to zoom in much closer.

This just means you’ll need to be more careful when positioning the cameras. Looking toward entrances and gates at least 5m-10m away would be an ideal use case. Using them directly above your front door may not. In the example above, there are significant blind spots to either side.

Should You Buy The Defender 4K?

The Defender 4K is aimed at the competent home DIYer or small business owner that wants a professional all-in-one CCTV system at a budget price. But it isn’t a package I’d recommend to my elderly parents. Both the wiring installation and software setup aren’t as user-friendly as other options on the market, and you don’t get features like audio or talkback. You can expect to pay twice as much or more if you want those too.

The daytime image quality and resolution are absolutely the best you’ll find at this price point, but the small field-of-view means you’ll need to take extra care when positioning them. If you want to cover a broader area from a single camera, look for something with a wider angle lens. The night recordings also suffer and aren’t nearly as good as daytime, but they’re sufficient.

At less than $400, we really can’t argue with the price. This is a fantastic value package for a four-camera 4K system with 1TB DVR. Just add a TV or monitor, and you’re all set.

Note: the current sale price of $360 won’t last long–the price goes back up to $450 on the 29th September! Hurry if you want to grab a real bargain.


Enter the Competition!

Defender 4K CCTV System

Source link

Complex September update brings large Windows, browser and development tool patches

Back to school, back to work…and now back to Microsoft updates. I hope that you got some rest this summer, as we are seeing an ever-increasing number and variety of vulnerabilities and corresponding updates covering all Windows platforms (desktop and server), Microsoft Office and a widening array of patches to Microsoft development tools.

This September update cycle brings two zero-days and three publicly reported vulnerabilities in the Windows platform. These two zero-days ( (CVE-2019-2014 and CVE-2019-1215) have credibly reported exploits which could lead to arbitrary code execution on the target machine. Both browser and Windows updates require immediate attention and your development team will need to spend some time with the latest patches to .NET and .NET Core.

The only good news here is that with each later release of Windows, Microsoft does seem to be experiencing fewer major security issues. There is now a good case to keep up with a rapid update cycle and stay with Microsoft on the later versions, with older releases an increasing security (and change control) risk. We have included an enhanced infographic detailing the Microsoft Patch Tuesday “threatscape” for this September, found here.

Known issues

With each update that Microsoft releases, there are generally a few issues that have been raised in testing. For this September release, and specifically Windows 10 1803 (and earlier)  builds, the following issues have been raised:

  • 4516058: Windows 10, version 1803, Windows Server version 1803 – Microsoft states in their latest release notes that, “Certain operations, such as rename, that you perform on files or folders that are on a Cluster Shared Volume (CSV) may fail with the error, “STATUS_BAD_IMPERSONATION_LEVEL (0xC00000A5)”. This issue appears to be happening to a large number of clients, and it appears that Microsoft is taking the issue seriously and investigating. Expect an out of bound update on this issue if there is a reported vulnerability paired to this issue.
  • 4516065 : Windows 7 Service Pack 1, Windows Server 2008 R2 Service Pack 1 (Monthly Rollup) VBScript in Internet Explorer 11 should be disabled by default after installing KB4507437 (Preview of Monthly Rollup) or KB4511872 (Internet Explorer Cumulative Update) and later. However, in some circumstances, VBScript may not be disabled as intended. This is a follow-up from last month’s (July) Patch Tuesday Security update. I think the key issue here is to ensure that VBScript really is disabled for IE11. Now that Adobe Flash is gone, we can start working to remove VBScript from our systems
  • Windows 10 1903 Release Information : Updates may fail to install, and you may receive Error 0x80073701. Installation of updates may fail, and you may receive the error message, “Updates Failed, there were problems installing some updates, but we’ll try again later” or “Error 0x80073701” on the Windows Update dialog or within Update history. Microsoft has reported that these issues are expected to be resolved in either the next release or possibly at the end of the month.

Major revisions

There were a number of late published revisions to this month’s September Patch Tuesday update cycle including:

  • CVE-2018-15664: Docker Elevation of Privilege Vulnerability. Microsoft has released an updated version of the AKS code which can be now found here.
  • CVE-2018-8269 : OData Library Vulnerability. Microsoft has updated this issue including NET Core 2.1 and 2.1 to the affected products list.
  • CVE-2019-1183: Windows VBScript Engine Remote Code Execution Vulnerability. Microsoft has released information detailing that this vulnerability has been fully mitigated now with other related updates to the VBScript engine. In this rare example, no further action is required, and this change/update is no longer required. You may find that the provided link no longer works, depending on your region.


Microsoft is working to address eight critical updates that could lead to a remote code execution scenario. A pattern is emerging with a recurring set of security issues raised against the following browser functionality clusters:

  • Chakra Scripting Engine
  • VBScript
  • Microsoft Scripting Engine

All of these issues affect the most recent versions of Windows 10 (both 32-bit and 64-bit) and apply to both Edge and Internet Explorer (IE). The VBScript issues (CVE-2019-1208) and CVE-2019-1236)  are particularly nasty as a visit to a website may lead to the inadvertent install of a malicious ActiveX control which then effectively cedes control to an attacker.  We suggest that all enterprise customers:

Given these concerns, please add this browser update to your “Patch Now” schedule.


Microsoft has attempted to address five critical vulnerabilities and a further 44 security issues that have been rated as important by Microsoft. The “elephant in the room” is the two zero-day publicly exploited vulnerabilities:

  • CVE-2019-1215: This is a remote execution vulnerability in the core Winsock networking component (ws2ifsl.sys) that could lead to an attacker running arbitrary code, once locally authenticated.
  • CVE-2019-1214: This is another critical vulnerability Windows Common Log File System (CLFS) that threatens older system with an arbitrary code execution upon local authentication.

Regardless of what else is happening with Windows updates this month, these two issues are pretty serious and will require immediate attention. In addition to the two September zero-days, Microsoft has released a number of other updates including:

  • 4515384: Windows 10, version 1903, Windows Server version 1903 – This bulletin refers to five vulnerabilities relating to Micro-architectural Data Sampling where the micro-processor attempts to guess what instructions may come next. Microsoft recommends disabling Hyper-Threading. Please see the Microsoft Knowledge Base Article 4073757  for guidance on protecting Windows platforms. To address the following vulnerabilities in, you may need a firmware upgrade:
    • CVE-2018-12126 – Microarchitectural Store Buffer Data Sampling (MSBDS)
    • CVE-2018-12130 – Microarchitectural Fill Buffer Data Sampling (MFBDS)
    • CVE-2018-12127 – Microarchitectural Load Port Data Sampling (MLPDS)
    • CVE-2019-11091 – Microarchitectural Data Sampling Uncacheable Memory (MDSUM)
  • Windows Update Improvements: Microsoft has released an update directly to the Windows Update client to improve reliability. Any device running Windows 10 configured to receive updates automatically from Windows Update, including Enterprise and Pro editions.
  • CVE-2019-1267: Microsoft Compatibility Appraiser Elevation of Privilege Vulnerability. This is an update to the Microsoft compatibility engine. This may start to raise further and more controversial issues for enterprise customers very soon. I wanted to have a little “dig” here at Microsoft as their application compatibility assessment tool was breaking applications. I chose not to.

As mentioned previously, this is a big update, with credible reports of publicly exploited vulnerabilities on the Windows platform. Add this update to your “Patch Now” release schedule.

Microsoft Office

This month Microsoft addresses three critical and eight important vulnerabilities in the Microsoft Office productivity suite covering the following areas:

  • Lync 2013 Information Disclosure Vulnerability
  • Microsoft SharePoint Remote Code/Spoofing/XSS Vulnerability
  • Microsoft Excel Remote Code Execution Vulnerability
  • Jet Database Engine Remote Code Execution Vulnerability
  • Microsoft Excel Information Disclosure Vulnerability
  • Microsoft Office Security Feature Bypass Vulnerability

Lync 2013 may not be your top priority this month, but the JET and SharePoint issues are serious and will require a response. The Microsoft JET database issues are the cause of most concern, even though Microsoft has rated them important, as they are key dependencies across a broad platform. Microsoft JET has always been difficult to debug and now it seems to be causing security issues every month for the past year. It’s time to move away from JET… just like everyone has moved from Flash and ActiveX, right?

Add this update to your standard patch schedule, and make sure that all of your legacy database applications have been tested before a full roll-out.

Development tools

This section gets a little bigger with each Patch Tuesday. Microsoft is addressing six critical updates and a further six updates rated as important covering the following development areas:

  • Chakra Scripting Engine
  • Rome SDK (in case you didn’t know, its Microsoft’s in-house Graph tool)
  • Diagnostics Hub Standard Collector Service
  • .NET Framework.  Core and NET Core
  • Azure DevOps and Team Foundation Server

Critical updates to Chakra Core and Microsoft Team Foundation server will require immediate attention while the remaining patches should be included in the developer update release schedule. With upcoming  major releases to .NET Core this November, we will continue to see large updates in this area. As always, we suggest some thorough testing and a staged release cadence for your development updates.


Adobe is back on form with a critical update included in this month’s regular patch cycle. Adobe’s update (APSB19-46) addresses two memory related issues which could lead to arbitrary code execution on the target platform. Both security issues (CVE-2019-8070 and CVE-2019-8069) have a combined base CVSS score of 8.2,and so we suggest that you add this critical update to your Patch Tuesday release schedule.

This article is published as part of the IDG Contributor Network. Want to Join?

Copyright © 2019 IDG Communications, Inc.

Source link

Blu’s New G9 Pro Brings High-End Features with a Bargain Bin Price – Review Geek


  • 1 – Absolute Hot Garbage
  • 2 – Sorta Lukewarm Garbage
  • 3 – Strongly Flawed Design
  • 4 – Some Pros, Lots Of Cons
  • 5 – Acceptably Imperfect
  • 6 – Good Enough to Buy On Sale
  • 7 – Great, But Not Best-In-Class
  • 8 – Fantastic, with Some Footnotes
  • 9 – Shut Up And Take My Money
  • 10 – Absolute Design Nirvana

Price: $249/$199

Blu G9 Pro
Cameron Summerson

Back at the end of May, Blu Products released the G9—an affordable phone with decently high-end features. Today, it’s launching the G9 Pro, an upgraded G9 with some features that are often reserved for much more expensive devices.

Here’s What We Like

  • High end features for a budget price
  • Wireless charging
  • Good fit and finish
  • Absolutely stellar price to performance ratio

And What We Don’t

  • The screen may be cooler than some users like
  • Portrait mode on the front camera is still laughably bad

At just $250 retail ($199 launch price), the G9 Pro offers a lot of bang for the buck—maybe more than any other phone I’ve seen even at double the price. Here’s what you get:

  • Display: 6.3-inch 19.5:9 FHD+ Infinity Display (1080×2340/409PPI) w/ teardrop notch
  • Processor: 2.0 GHz Octa-Core MediaTek Helio P60
  • RAM: 4GB
  • Storage: 128 GB, microSD card slot
  • Cameras: 16 MP main shooter, 5 MP depth sensor, 20 MP night mode camera; 24 MP front camera
  • Ports: USB-C, 2.5 mm headphone jack
  • Headphone Jack: Yessir
  • Battery: 4,000 mAh w/ Quick Charge and Wireless Charging
  • Fingerprint Sensor: Rear-mounted
  • Connectivity: Wi-Fi 2.4/5 GHz (a/b/g/n), 3G 850/900/1700/1900/2100, 4G LTE 1/2/3/4/5/7/8/12/13/17/28, dual-SIM
  • US Carrier compatibility: T-Mobile, AT&T, Metro, Cricket, Straight Talk
  • Android version: Android 9; June 2019 Security Patch (Promised updates to Android 10 and two years of security patches)
  • Price: $249 (Launch price of $199 “for a limited time)

Nicer Hardware Than You’d Expect for the Price

Okay, so there’s a lot to cover here, but I want to start with the most surprising feature: it has wireless charging. This is generally reserved for the highest of high-end gadgets, so I was pleasantly surprised to see it on the G9 Pro. I’m not sure I’ve ever seen a $250 phone with wireless charging, so it’s super cool to see Blu incorporate it here. It’s also 10-watt wireless charging, which is among the fastest wireless charging rate currently available. Impressive.

The back of the Blu G9 Pro
Cameron Summerson

I’ve used a lot of different Blu phones over the years, and one thing has become clear to me: the phones keep getting nicer while the price points stay relatively the same. The G9 Pro is an exemplary device in this regard because it’s probably the classiest looking (and feeling!) Blu handset I’ve ever used. It’s a striking device—the “Nightfall” chameleon finish is hot.

The overall fit and finish of the phone is nothing to scoff at either. It feels decidedly more premium than the G9 (as it should), but also comes off has higher-end than the more costly Pixel 3a. It looks and feels better than Google’s affordable phone, with performance that is at least on par with that of the 3a, as well. All in all, it’s a great little package. Oh, and it has a headphone jack. A headphone jack!

The headphone jack and USB-C port on the Blu G9 Pro
Cameron Summerson

My biggest complaint about the standard G9 was the display, which has been noticeably upgraded on the G9 Pro. The panel in the Pro features the same 6.3-inch size, but a much more reasonable 1080×2340 resolution (409 PPI), making everything much crisper and defined. That said, it is a very cool display, which may be jarring for anyone coming from an OLED panel. Still, much like everything else on this handset, it’s great for the money. The biggest complaint I have about this phone is the haptic engine—it just feels sluggish and cheap.

The triple camera array on the back is also a nice touch, with sensors specifically for depth (5 MP) and night mode (20 MP) alongside the 16 MP primary camera. The 24 MP front camera is another decent addition for the selfie-loving crowd, though the phone’s software-based portrait mode is laughable at best when using the front camera. The rear shooter does a much better job with portrait photos since it has a separate depth sensor and doesn’t rely on software tricks to adjust the depth of field. But either way, keep your expectations in check for the camera—it takes very good photos for a $250 phone, but it won’t compete with the current crop of flagship smartphones.

examples from the G9 Pro's front facing camera
Left: Portrait mode; Upper-right: Beauty mode; Bottom right: no filter Cameron Summerson

Here are a few more examples:

And one of the rear camera’s portrait mode feature, whch is much better than what the front offers:

The Blu G9 Pro's portrait mode
Cameron Summerson

Clean Software Makes for a Snappy Experience

If you read my review of the G9, then you already know what to expect here—the software is literally identical on the G9 Pro. It’s a slightly modified version of Android 9, with the most notable changes in the Quick Settings panel and Settings menu—they’re both very white. I still wish it had dark mode.

The Settings menu is also slightly rearranged compared to the layout that you’ll commonly find on other Android phones, with a focus on simplicity here. Everything is still easy enough to find for anyone familiar with Android’s “normal” organization (if such a thing even exists), but it does take a bit of getting used to.

The Blu G9 Pro's screen
Cameron Summerson

The other big addition on the G9 Pro is a FaceID-like feature called…Face ID. In practice, it’s quite fast. But keep in mind that without all the additional hardware needed for 3D depth mapping (like the iPhone has) this is still a pretty insecure way of protecting a phone. In other words, it’s a neat little novelty, but I recommend against using it as any form of real security on your phone. The good news is that there’s also a rear-mounted fingerprint scanner, which is a real form of security.

Finally, let’s talk about performance. This is where the G9 Pro gets a significant upgrade over the G9—it’s a lot faster and more fluid. The MediaTek Helio P60 in the Pro model performs significantly better than the P22 found in the non-pro G9 despite being the same clock speed (2.0 GHz) and number of cores. It’s just a better chip. If you like benchmarks, I did a few of those. Here’s the G9 Pro compared to the G9 and Pixel 3a. You’ll find that the G9 Pro is right there with the 3a…but at around half the price.

Conclusion: This is the Best Phone Blu Has Ever Released

Overall, the Blu G9 Pro is a very impressive phone and the best Blu phone I’ve ever used. It looks and feels great, has the performance of phones that cost twice as much, packs a very usable triple camera array, and is guaranteed to get updated to Android 10 (plus two years of security updates). For $250, you simply won’t find a better smartphone out there. And the launch price is just $199 for a limited time, making it even more of a bargain.

Rating: 9/10

Price: $249/$199

Here’s What We Like

  • High end features for a budget price
  • Wireless charging
  • Good fit and finish
  • Absolutely stellar price to performance ratio

And What We Don’t

  • The screen may be cooler than some users like
  • Portrait mode on the front camera is still laughably bad

Source link

The YubiKey 5Ci Brings USB 2FA to Your iPhone…Kind Of – Review Geek


  • 1 – Absolute Hot Garbage
  • 2 – Sorta Lukewarm Garbage
  • 3 – Strongly Flawed Design
  • 4 – Some Pros, Lots Of Cons
  • 5 – Acceptably Imperfect
  • 6 – Good Enough to Buy On Sale
  • 7 – Great, But Not Best-In-Class
  • 8 – Fantastic, with Some Footnotes
  • 9 – Shut Up And Take My Money
  • 10 – Absolute Design Nirvana

Price: $70

The YubiKey 5Ci on the red iPhone XR.
Cameron Summerson

Yubico launches its new 5Ci YubiKey today, which features an iOS Lightning plug on one side (a first for any security key) and a USB-C on the other. This brings the extra protection of a USB security key to almost any device.

Here’s What We Like

  • First USB security key with a Lightning connector
  • USB-C increases usefulness dramatically

And What We Don’t

  • iOS app support is very limited right now
  • The USB-C port doesn’t work on iPad Pros (yet)
  • USB keys, in general, are still cumbersome

The key is an interesting and versatile option for anyone who wants to increase security on their most important accounts—and especially those who want a USB security option on iOS. Just don’t expect it to work on all apps across the board, yet.

Currently, only the following list of apps support the 5Ci on iOS:

The Brave browser also supports the 5Ci for certain websites, like Twitter, Github, Login.gov, Bitbucket.org, and 1Password.com. Yubico is working with other iOS developers and online service providers to bring additional 5Ci support, as well.

The YubiKey 5Ci connected to the iPhone XR.
Cameron Summerson

The USB-C side of the key, however, works with any browser or service on any OS that supports USB security keys. That means you can plug it directly into Windows, macOS, Chrome OS, Android, or any other device that has a USB-C port. It should also work flawlessly with any Works with YubiKey service. As USB-C is offered on more devices, the 5Ci will also become your only USB security key, across all devices.

Of course, it’s worth noting this isn’t the first USB security key to work with iOS—the YubiKey 5 NFC has worked on all NFC-equipped iOS devices since the iPhone 7. Considering that key also has a USB-A plug, it’s an equally versatile option when it comes to compatibility. There is, of course, the need for dongles on devices that don’t support USB-A inputs or NFC, which makes the 5Ci a better choice for people with multiple types of devices. If it only had NFC, it might be the perfect security key. Maybe in the next iteration.

The YubiKey 5Ci.
Cameron Summerson

While we’re talking about caveats, there’s another big one that must be mentioned: the USB-C plug does not currently work with iPad Pro devices. The reason for this is unclear, but hopefully, it’s something Pro users can expect in the future.

When it comes to using the YubiKey 5Ci, well, it’s as simple as using a security key. You have to add it to your specific accounts on another device, like a computer (with USB-C, of course). But after that, you can use it to log in to accounts on iOS. I tested it with Twitter on Brave, and it worked instantly and without any fuss.

Right now, the 5Ci is a bit ahead of its time, but it’s the sort of push necessary to get broader support for USB security keys on iOS. It’s up to developers to incorporate support for this feature into their apps and services, and hopefully, the 5Ci will encourage that. Support within Chrome and Safari would also be highly useful, especially as more sites enable support for security keys on iOS.

Here’s What We Like

  • First USB security key with a Lightning connector
  • USB-C increases usefulness dramatically

And What We Don’t

  • iOS app support is very limited right now
  • The USB-C port doesn’t work on iPad Pros (yet)
  • USB keys, in general, are still cumbersome

Source link

WWDC: iOS 13 brings iPad productivity, Watch independence and more

With just weeks to go until WWDC 2019, initial claims concerning Apple’s iOS upgrade plans are becoming a torrent: faster, with more apps and key enhancements appear to be the order of the day.

What to expect from iOS 13

Apple intends releasing a bundle of its own new apps at the show and plans to sweeten the pill of it becoming a competitor for some developers with all new APIs developers can use with which to build fresh apps, a Bloomberg report claims.

The WWDC June 3 keynote should see Apple reveal new operating systems and new iPhone-independent apps for Apple Watch, including an iPhone-independent App Store. Apple will offer its own apps, including a Calculator and audio books app through this store, the report claims.

Apple Watch will also gain its own Voice Memos app and a bunch of new watch faces.

Productivity enhancements

iOS 13 (“Yukon”) will provide performance and stability enhancements. The user interface will be cleaned up a little and you’ll get some form of Dark Mode. The report also claims you’ll be able to use your iPad as an external Mac monitor, including Apple Pencil support – this being one of numerous iPad enhancements.

Bloomberg suggests Safari Downloads made on iOS may end up being stored in one place as they are on the Mac – I see this as hinting at a Downloads folder in the Files app, but we’ll see. 

Some other highlights from the wide range of claims include:

  • Improvements to Reminders, Messages, Find My Friends/iPhone combined.
  • Home (app) improvements.
  • Maps gains support for favorite places.
  • Enhanced health tracking tools, including audial health and menstrual tracking.
  • Apps for Apple’s services, such as TV and Music.
  • Parental controls will let parents define when and who children can contact at defined times.
  • Improvements in the Accessibility settings.

What has been claimed before?

Many of these latest speculations echo previously reported suggestions.

March reports suggested tweaks in the Home screen, Files app and multitasking enhancements, alongside significant improvements in Safari and Mail.

Just last month in April we saw more reports that focused on iPad productivity, Mail and sundry usability improvements. That so many of these claims now appear to have been amplified by Bloomberg them with a little more credibility.

Questions and answers

There are some questions.

After all, if Mail is improved on iOS will Apple choose to use Marzipan to port the app to the Mac? There’s good reason to do so given the current Mail application on Macs is deeply processor intensive and could really use enhancement.

What about the growing independence of Apple Watch? At what point will Apple make it possible to truly use this device without ownership of an iPhone? How would it approach this, and is it possible an increasingly independent smartwatch may also become more compatible with other operating systems and devices?

Of course, most eyes will be on Apple’s Marzipan and iPad productivity improvements. Given recent claims the latter may include support for a USB-C mouse on iPads, at what point will the apps available to iPads and the user interface elements required to make use of those apps actually become significantly easier than the Mac equivalents? What then? And, following along these lines, when might professional apps support, such as for Xcode, make it to iPad Pro?

WWDC 2019 runs June 3-7. I’ll be watching events closely to bring you the news that matters from the show.

[Also read: What to expect at WWDC 2019]

Please follow me on Twitter, or join me in the AppleHolic’s bar & grill and Apple Discussions groups on MeWe.

Source link

April brings massive updates to Windows and critical updates to both browsers and Adobe Flash

They say that “April is the cruelest month.” Well, when it comes to Microsoft patching, there is some truth to this. With 74 reported vulnerabilities and significant updates to all Microsoft’s major platforms (Windows, browsers, development platforms, Office and Exchange and, of course, Adobe Flash), getting these updates deployed in a timely fashion will be hard work.

One bright note to all this is that we can finally remove Adobe Shockwave. You can find some good patch prioritization advice from Chris Goettl’s April Patch Tuesday posting and you can find more technical patch details on the Readiness Patch posting for April found here.

Known issues

  • 4487563: Exchange services may remain in a disabled state after you install this security update. This condition does not indicate that the update is not installed correctly. This condition may occur if the service control scripts experience a problem when they try to return Exchange services to its usual state. To fix this issue, use Services Manager to restore the startup type to
  • 4493509: After installing this update, Custom URI Schemes for Application Protocol handlers may not start the corresponding application for local intranet and trusted sites on Internet Explorer.

Each month, I try to break down the update cycle into product families (as defined by Microsoft) with the following basic groupings.

  • Browsers (Microsoft IE and Edge)
  • Microsoft Windows (both desktop and server)
  • Microsoft Office (Including Web Apps and Exchange)
  • MicrosoftNET Core, .NET Core and Chakra Core
  • Adobe Flash Player


Microsoft has attempted to resolve 13 reported vulnerabilities (non publicly reported or exploited) that have been rated as critical. These vulnerabilities (or CVE’s) are grouped across the following areas:

  • Microsoft Browsers Tampering Vulnerability
  • Chakra Scripting Engine Memory Corruption Vulnerability
  • Microsoft Edge Information Disclosure Vulnerability
  • Microsoft Scripting Engine Information Disclosure Vulnerability

Given that these issues cover most memory areas and scripting across both Microsoft browsers, add this update to your “Patch Now” schedule.


This is a massive update this month for the Microsoft Windows platform. With this April Patch Tuesday, Microsoft has attempted to resolve nine critical vulnerabilities and 30 (count’ em) vulnerabilities rated as important. In addition, it appears that reported issues (CVE-2019-0803 and CVE-2019-0859) have been exploited. It also appears that both these issues related to a Win32K driver issue – which is always bad news. Bad news for future problems and difficult to troubleshoot scenarios.

In addition to these severe reported vulnerabilities there have been significant updates to the following Windows components:

  • Security updates to Windows Datacenter Networking, Windows Server, the Microsoft JET Database Engine, Windows Kernel, Windows Input and Composition, Microsoft Scripting Engine, Windows App Platform and Frameworks, Windows Storage and File systems, Microsoft Graphics Component, Windows Virtualization, Windows MSXML, Windows SQL components, and Microsoft Edge

This is a massive update and needs to be heavily tested and then deployed as quickly as possible. Sorry – add this one to your Patch Now list.

Microsoft Office and Exchange

This month both Microsoft Office and Exchange are reported to have 12 vulnerabilities rated as important by Microsoft. These security issues cover the following basic areas:

  • Microsoft Graphics Components Remote Code Execution Vulnerability
  • Microsoft Office Access Connectivity Engine Remote Code Execution Vulnerability
  • Microsoft Office SharePoint XSS Vulnerability
  • Microsoft Exchange Spoofing Vulnerability

The most serious of these issues could lead to a remote code execution scenario. However given that all of the exploits require specially crafted files on targeted systems with logged on users with admin rights, this patch can be added to your scheduled patch deployment effort.

Development tools (Chakra Core)

The story for updating Microsoft development tools is a little more nuanced than usual. Microsoft has attempted to resolve seven critical vulnerabilities in the Chakra Core system and 11 important updates to the Microsoft Team Foundation Server. See if you can get the Chakra updates out as quick as possible and schedule the Team Foundation changes with your normal patch process.


The big news for Adobe fans (and reluctant users) is that Shockwave has reached end of support. Just remove Shockwave from ALL of your systems. Do this as soon as you can, as I am sure next month we will be advising on massive zero-days for the belated platform. In addition, Adobe has attempted to resolve two vulnerabilities in Adobe Flash Player (CVE-2019-7096, CVE-2019-7108) both rated as critical. Add the Adobe update to your Patch Now list.

This article is published as part of the IDG Contributor Network. Want to Join?

Source link

What Microsoft’s ‘full-Chromium’ Edge browser brings to the table

Nearly three months ago, Microsoft waved the browser white flag, saying it would scrap Edge’s original rendering engine and replace it with Blink, the engine that also powers Google’s Chrome.

By going “full-Chromium,” Microsoft has upended its browser strategy in a way not seen since a disastrous decision in 2014 that forced users to upgrade to newer versions of Internet Explorer (IE). In reality, there was little downside to the radical move toward Chromium: IE is on legacy life support and if Edge slipped any lower in user share it would simply vanish.

Microsoft has yet to officially launch a preview of full-Chromium Edge, but with the recent leak of a functional early version, the time is right to start asking the important questions about the browser.

We’ve answered those we thought most significant for now and will regularly revisit that list with additions and rewrites as Microsoft releases, tests, re-releases and re-tests its built-on-Chromium browser.

Why is Microsoft going full-Chromium on Edge?

Good question. There are multiple answers.

Source link