Posts Tagged


A large – but manageable – February Patch Tuesday brings critical browser updates

With 99 reported vulnerabilities and patches to both Microsoft browsers, Office and Windows, this month’s Patch Tuesday update is not as large an administrative burden as you might initially think. We’ve rated the browser updates as a “Patch Now” update due to issues with the Chakra engine, but both Office and Windows can be scheduled according to a regular patch cadence. Unfortunately, we have another Adobe Flash update to deploy, but no critical development updates for February.

You can find more information in our helpful infographic here.

Known issues

Each month, Microsoft includes a list of known issues that relate to the operating system and platforms included in this update cycle. I have referenced a few key issues that relate to the latest builds from Microsoft including:

  • Microsoft Cluster Shared Volumes (CSV) can still generate the error message,” “STATUS_BAD_IMPERSONATION_LEVEL (0xC00000A5).” Microsoft is still working on a solution. Until a fix is released, you can try the operation as an administrator or try to “own” directories in question before the operation.
  • After installing some Asian language packs you may still (see KB4493509) receive the error, “0x800f0982 – PSFX_E_MATCHING_COMPONENT_NOT_FOUND.”

Microsoft has been working on a fix for both these issues for a while now; we don’t expect a resolution any time soon.

Major revisions

This month, two CVEs have undergone a major revision increment:

  • CVE-2019-1332: CVE information revised to announce the availability of Microsoft SQL Server 2016 for x64-based Systems Service Pack 2 (CU) and Microsoft SQL Server 2016 for x64-based Systems Service Pack 2 (GDR).
  • CVE-2019-8267: Microsoft revised this to include Internet Explorer 11 installed on all supported editions of Windows 10 Version 1809, Windows Server 2019, Windows 10 Version 1903, and Windows 10 Version 1909 because they are affected by this vulnerability. This change may affect your server update cycle

Each month, we break down the update cycle into product families (as defined by Microsoft) with the following basic groupings:

  • Browsers (Microsoft IE and Edge)
  • Microsoft Windows (both desktop and server)
  • Microsoft Office (Including Web Apps and Exchange)
  • Microsoft Development platforms ( ASP.NET Core, .NET Core and Chakra Core)
  • Cloud and Devices
  • Adobe Flash Player (to be discontinued)


Microsoft has released nine updates to both browsers (Internet Explorer and Edge) this month, with five rated as critical, two as moderate and the remaining two as important. The biggest concerns are the four critical updates to the Chakra core scripting engine that could lead to remote code execution.

Microsoft advises that these four critical vulnerabilities could lead to a scenario where “An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights.”

Add this update to your “Patch Now” schedule.

Microsoft Windows

Ok, this may sound like a lot of updates: Microsoft has released 79 patches to the Windows desktop and server ecosystem. Five of these updates are rated as critical and the rest are all rated as important by Microsoft. It sounds (and feels) like a lot of patches, but other than the critical updates to the Remote Desktop (RDP) platform, the administrative burden is not that great.

This patch cycle feels more like an administrative cycle than that one that addresses critical or exploited vulnerabilities. It’s “clean-up” time for Microsoft after the Christmas break and a very light January patch cycle.

Add these updates to your standard release schedule. 

Microsoft Office

Microsoft has released six updates to Microsoft Office – all rated as important. The most serious for this month affects Microsoft Excel with a potential (but difficult-to-exploit) remote code execution scenario involving how Excel handles objects in memory. All of this month’s reported vulnerabilities require access to the target system and require users to take explicit action on vulnerable systems. There is an update this month to Microsoft SharePoint server which will require a reboot of all affected servers.

Add these Office patches to your regularly scheduled updates

Microsoft development platforms

This month, Microsoft has not released any updates to the many variations of .NET, but we do have one update to SQL Server that has been rated as important. CVE-2020-0618 is relatively difficult to exploit, as it requires access to the SQL server instance and requires specially crafted pages sent to the SQL Server Reporting services.

Add this update to your regularly scheduled patch release cadences.

Cloud and Devices

We have allocated this space to the recent cloud (Azure) and device updates from Microsoft. This month, Microsoft has not released any Azure related patches, but has published a Microsoft Surface (device level) patch (CVE-2020-0702) that has been rated as important (and difficult to exploit).

Add this device related update to your regular patch cycle.

Adobe Flash Player

I thought that we were done with critical Adobe Flash Player updates from Microsoft. I even instructed our development team to remove this section from our internal bulletins. Well, they (Flash Player) updates are back, with a vengeance.

This month, we see another ActiveX flaw in Flash Player (ADV20003/CVE-2020-3757) that could lead to the execution of arbitrary code on the compromised computer. According to the Adobe security bulletin, “The vulnerability exists due to a type confusion error when processing Flash content. A remote attacker can create a specially crafted .SWF file, trick the victim into playing it, trigger a type confusion error and execute arbitrary code on the target system. Successful exploitation of this vulnerability may result in complete compromise of the target system.”

Microsoft has documented a potential work-around relating to the Flash ActiveX control which includes making the following registry changes:

Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINESOFTWAREMicrosoftInternet ExplorerActiveX Compatibility{D27CDB6E-AE6D-11CF-96B8-444553540000}]

“Compatibility Flags”=dword:00000400

[HKEY_LOCAL_MACHINESOFTWAREWow6432NodeMicrosoftInternet ExplorerActiveX Compatibility{D27CDB6E-AE6D-11CF-96B8-444553540000}]

“Compatibility Flags”=dword:00000400

Add this update to your “Patch Now” release schedule.

Copyright © 2020 IDG Communications, Inc.

Source link

4 Large Senior-Friendly Keyboards and Icons for Android

Smartphones tend to be designed towards the young and trendy, which makes them a pain for the older generation. If you reach for your reading glasses every time somebody messages you, you may benefit from a big-button keyboard or larger icons on your phone.

Here’s how to make the keyboard and icons larger on Android, as well as the best phones for elderly people.

How to Make the Keyboard Bigger on Android

If you’d like to know how to change the keyboard size on Android, there are two approaches you can take. The first is to resize the default Gboard keyboard to a bigger scale, and the second involves downloading a third-party keyboard.

If your phone doesn’t have Gboard preinstalled, you’ll need to install it from the Play Store first. You may also be able to perform a similar process on your default keyboard app.

To make the Gboard bigger, you’ll first need to open the keyboard appear. You can do so by tapping on a spot where you can type, like in a messaging chatbox.

When the keyboard appears, press and hold on the comma key. You’ll see two green options pop up above the key: a cog and a box. Slide your finger that’s on the comma key over to the cog, then release it.

In the menu that pops up, tap Preferences, then select Keyboard Height. On the slider that appears, drag the dot to Extra Tall. Tap OK.

Now you’ll have an extra-large keyboard, which makes it easier to type. The keyboard will take up more of the screen, but it’s worth the sacrifice if you’re struggling to type with the default size.

Download: Gboard (Free)

How to Download a Larger Android Keyboard From the Play Store

If the default Android keyboard doesn’t fit your needs, why not try a new one? There are a handful of big-button keyboards for Android; these ones in particular stand out from the rest.

1. SwiftKey Keyboard

The first extra-large keyboard option we recommend is SwiftKey. Not only is SwiftKey a great all-around option, but it also allows you to customize how large the keyboard is. During setup, tap on Resize and adjust the keyboard to the size you like.

SwiftKey also has an excellent range of themes available. These don’t make the buttons any bigger, but they can help the letters stand out from the background. The right theme can increase accessibility by making it easier to identify what each letter is.

Download: SwiftKey Keyboard (Free)

2. Huge Keyboard

If you’d like a keyboard that’s big right from the start, why not try the aptly-named Huge Keyboard? This large keyboard for Android users has some generously-sized buttons to make typing more comfortable.

While it does take up a lot of the screen, it’s a blessing for anyone who struggles to make out the individual letters of the default keyboard.

Download: Huge Keyboard (Free, in-app purchase available)

3. 1C Big Keyboard

If you want an enormously big keyboard, try 1C Big Keyboard. It’s advertised toward people with big fingers, but the enlarged buttons make typing easier for seniors too.

The keyboard uses gigantic buttons for each letter, which bears similarities to a traditional typewriter. It achieves this by taking the QWERTY keyboard and arranging the rows in a zigzag pattern to make room for the increased button size.

A small warning: the app shows ads along the top of the keyboard. If you love the app but hate the ads, you can purchase the premium option to get rid of them.

Download: 1C Big Keyboard (Free, in-app purchases available)

4. MessagEase Keyboard

If 1C Big Keyboard is still too small, your best bet is the MessagEase keyboard. This puts up nine extra-large buttons with a letter in each button, which cover the most common letters used in English.

Each large button has a smaller letter around it, which you can type by pressing the button and swiping in the letter’s direction. It’s a bit different, but worth a look if other options didn’t work for you.

Download: MessagEase Keyboard (Free)

How to Make the Icons Bigger on Android

If the icons on your home screen look a little on the small side, you can tell Android to make your display larger. To do this, bring up the list of apps on your phone and tap on Settings. Next, select Display, then find the Advanced dropdown menu at the bottom.

Tapping Advanced will reveal new options. Find Display Size and tap on it. Then, drag the slider on this screen over to Large. Now your phone will display UI elements at a larger scale, including the icons on your home screen.

Choosing the Best Phone for an Elderly Person

If texting your mom on her mobile device means watching the “typing…” notification for minutes on end, or you’re looking for a phone yourself, there are plenty of phones specifically designed for older people.

There is no unanimous “best phone” for the elderly, as each one focuses on something different. Some phones will have larger buttons for the short-sighted, while others have a built-in emergency alarm if something terrible happens. As such, it’s best to work out what your new phone should achieve, and buy the one that ticks the most boxes for you.

If the thought of sifting through phones for hours seems daunting, don’t worry. We covered the best phones for seniors

The 8 Best Cell Phones for Senior Citizens

The 8 Best Cell Phones for Senior Citizens

If you need a senior-friendly mobile device, here are some of the best cell phones for senior citizens.
Read More

already, so be sure to check them out.

Making Senior Life Easier

Senior life has its share of problems, but your phone doesn’t have to be one of them. If using your phone is a pain, you can download one of the many big keyboards for Android and increase the icon size. Failing that, you can ditch your old phone and buy one more suited to your needs.

To make Android devices even easier to use, why not also try some simple Android launchers for grandparents

The 6 Best Simple Android Launchers for Parents and Grandparents

The 6 Best Simple Android Launchers for Parents and Grandparents

Are your parents or grandparents confused by their new Android phone? A simple Android launcher can make things easier!
Read More


Source link

Samsung’s New Chromebooks Offer Small or Large Screens, Modest Prices on Both – Review Geek


Samsung Chromebook 4+

Samsung has expanded its well-regarded Chromebook series with to include two new Google Assistant-equipped models that have been designed to resemble the style of more premium machines, despite being powered by a Celeron chip and Chrome OS.

Known as the Chromebook 4 and Chromebook 4+, the machines are meant to set the bar among competitors when it comes to portability, usability, and performance. The Chromebook 4 is on the small side with just an 11.6-inch, 1366 x 768 display, packing 4GB of RAM and 32GB of storage. The Chromebook 4+ goes to the other end of the spectrum with a much larger 15.6-inch 1080p screen and the same RAM and storage. Both can be upgraded to 6GB RAM and 64GB of storage for $50 more.

Samsung Chromebook 4

The smaller screen on the 11.6-inch model goes a ways toward conserving battery life as well, as the Chromebook 4 is listed as having a run time of 12.5 hours versus 10.5 hours for the 4+, though 10.5 hours is still probably close enough to “all day” battery for most people that they can leave their charger at home. Of note, the 4+ has two USB-C ports instead of only one on the plain Chromebook 4.

Samsung Chromebook 4

Samsung Chromebook 4+


11.6-inch 1366 x 768

15.6-inch 1920 x 1080


Intel Celeron N4000

Intel Celeron N4000





32-64GB eMMC

32-64GB eMMC


5070mAh Li-ion for 12.5 hours

5070mAh Li-ion for 10.5 hours

Mic & Webcam

Yes & 720p

Yes & 720p


One USB-C port, One USB 3.0, microSD reader, Bluetooth 4.0, Wi-Fi 5, and a headphone/mic combo jack

Two USB-C ports, One USB 3.0, micro SD reader, Bluetooth 4.0, Wi-Fi 5, and a headphone/mic combo jack


2.6 pounds

3.75 pounds


$279.99 $299.99

Both models feature a “platinum titan” metal finish and are said to have undergone extensive durability testing. This testing includes having met eight military-grade standards as well as measuring extreme temperatures, dust, and shocks to make sure these systems are ready to be tossed around during your commute.

Samsung Chromebook 4+

As mentioned above, both the Chromebook 4 and 4+ come with the Google Assistant built-in—just say “Hey, Google” to update your calendar, make a note or reply to a message. Units are available today via Samsung for both models: 11.6” the Chromebook 4 is $230 for 4GB/32GB and $280 for 6GB/64GB. The 15.6” Chromebook 4+ is $300 and $350 for the same specs, respectively.

Source: Samsung

Source link

Complex September update brings large Windows, browser and development tool patches

Back to school, back to work…and now back to Microsoft updates. I hope that you got some rest this summer, as we are seeing an ever-increasing number and variety of vulnerabilities and corresponding updates covering all Windows platforms (desktop and server), Microsoft Office and a widening array of patches to Microsoft development tools.

This September update cycle brings two zero-days and three publicly reported vulnerabilities in the Windows platform. These two zero-days ( (CVE-2019-2014 and CVE-2019-1215) have credibly reported exploits which could lead to arbitrary code execution on the target machine. Both browser and Windows updates require immediate attention and your development team will need to spend some time with the latest patches to .NET and .NET Core.

The only good news here is that with each later release of Windows, Microsoft does seem to be experiencing fewer major security issues. There is now a good case to keep up with a rapid update cycle and stay with Microsoft on the later versions, with older releases an increasing security (and change control) risk. We have included an enhanced infographic detailing the Microsoft Patch Tuesday “threatscape” for this September, found here.

Known issues

With each update that Microsoft releases, there are generally a few issues that have been raised in testing. For this September release, and specifically Windows 10 1803 (and earlier)  builds, the following issues have been raised:

  • 4516058: Windows 10, version 1803, Windows Server version 1803 – Microsoft states in their latest release notes that, “Certain operations, such as rename, that you perform on files or folders that are on a Cluster Shared Volume (CSV) may fail with the error, “STATUS_BAD_IMPERSONATION_LEVEL (0xC00000A5)”. This issue appears to be happening to a large number of clients, and it appears that Microsoft is taking the issue seriously and investigating. Expect an out of bound update on this issue if there is a reported vulnerability paired to this issue.
  • 4516065 : Windows 7 Service Pack 1, Windows Server 2008 R2 Service Pack 1 (Monthly Rollup) VBScript in Internet Explorer 11 should be disabled by default after installing KB4507437 (Preview of Monthly Rollup) or KB4511872 (Internet Explorer Cumulative Update) and later. However, in some circumstances, VBScript may not be disabled as intended. This is a follow-up from last month’s (July) Patch Tuesday Security update. I think the key issue here is to ensure that VBScript really is disabled for IE11. Now that Adobe Flash is gone, we can start working to remove VBScript from our systems
  • Windows 10 1903 Release Information : Updates may fail to install, and you may receive Error 0x80073701. Installation of updates may fail, and you may receive the error message, “Updates Failed, there were problems installing some updates, but we’ll try again later” or “Error 0x80073701” on the Windows Update dialog or within Update history. Microsoft has reported that these issues are expected to be resolved in either the next release or possibly at the end of the month.

Major revisions

There were a number of late published revisions to this month’s September Patch Tuesday update cycle including:

  • CVE-2018-15664: Docker Elevation of Privilege Vulnerability. Microsoft has released an updated version of the AKS code which can be now found here.
  • CVE-2018-8269 : OData Library Vulnerability. Microsoft has updated this issue including NET Core 2.1 and 2.1 to the affected products list.
  • CVE-2019-1183: Windows VBScript Engine Remote Code Execution Vulnerability. Microsoft has released information detailing that this vulnerability has been fully mitigated now with other related updates to the VBScript engine. In this rare example, no further action is required, and this change/update is no longer required. You may find that the provided link no longer works, depending on your region.


Microsoft is working to address eight critical updates that could lead to a remote code execution scenario. A pattern is emerging with a recurring set of security issues raised against the following browser functionality clusters:

  • Chakra Scripting Engine
  • VBScript
  • Microsoft Scripting Engine

All of these issues affect the most recent versions of Windows 10 (both 32-bit and 64-bit) and apply to both Edge and Internet Explorer (IE). The VBScript issues (CVE-2019-1208) and CVE-2019-1236)  are particularly nasty as a visit to a website may lead to the inadvertent install of a malicious ActiveX control which then effectively cedes control to an attacker.  We suggest that all enterprise customers:

Given these concerns, please add this browser update to your “Patch Now” schedule.


Microsoft has attempted to address five critical vulnerabilities and a further 44 security issues that have been rated as important by Microsoft. The “elephant in the room” is the two zero-day publicly exploited vulnerabilities:

  • CVE-2019-1215: This is a remote execution vulnerability in the core Winsock networking component (ws2ifsl.sys) that could lead to an attacker running arbitrary code, once locally authenticated.
  • CVE-2019-1214: This is another critical vulnerability Windows Common Log File System (CLFS) that threatens older system with an arbitrary code execution upon local authentication.

Regardless of what else is happening with Windows updates this month, these two issues are pretty serious and will require immediate attention. In addition to the two September zero-days, Microsoft has released a number of other updates including:

  • 4515384: Windows 10, version 1903, Windows Server version 1903 – This bulletin refers to five vulnerabilities relating to Micro-architectural Data Sampling where the micro-processor attempts to guess what instructions may come next. Microsoft recommends disabling Hyper-Threading. Please see the Microsoft Knowledge Base Article 4073757  for guidance on protecting Windows platforms. To address the following vulnerabilities in, you may need a firmware upgrade:
    • CVE-2018-12126 – Microarchitectural Store Buffer Data Sampling (MSBDS)
    • CVE-2018-12130 – Microarchitectural Fill Buffer Data Sampling (MFBDS)
    • CVE-2018-12127 – Microarchitectural Load Port Data Sampling (MLPDS)
    • CVE-2019-11091 – Microarchitectural Data Sampling Uncacheable Memory (MDSUM)
  • Windows Update Improvements: Microsoft has released an update directly to the Windows Update client to improve reliability. Any device running Windows 10 configured to receive updates automatically from Windows Update, including Enterprise and Pro editions.
  • CVE-2019-1267: Microsoft Compatibility Appraiser Elevation of Privilege Vulnerability. This is an update to the Microsoft compatibility engine. This may start to raise further and more controversial issues for enterprise customers very soon. I wanted to have a little “dig” here at Microsoft as their application compatibility assessment tool was breaking applications. I chose not to.

As mentioned previously, this is a big update, with credible reports of publicly exploited vulnerabilities on the Windows platform. Add this update to your “Patch Now” release schedule.

Microsoft Office

This month Microsoft addresses three critical and eight important vulnerabilities in the Microsoft Office productivity suite covering the following areas:

  • Lync 2013 Information Disclosure Vulnerability
  • Microsoft SharePoint Remote Code/Spoofing/XSS Vulnerability
  • Microsoft Excel Remote Code Execution Vulnerability
  • Jet Database Engine Remote Code Execution Vulnerability
  • Microsoft Excel Information Disclosure Vulnerability
  • Microsoft Office Security Feature Bypass Vulnerability

Lync 2013 may not be your top priority this month, but the JET and SharePoint issues are serious and will require a response. The Microsoft JET database issues are the cause of most concern, even though Microsoft has rated them important, as they are key dependencies across a broad platform. Microsoft JET has always been difficult to debug and now it seems to be causing security issues every month for the past year. It’s time to move away from JET… just like everyone has moved from Flash and ActiveX, right?

Add this update to your standard patch schedule, and make sure that all of your legacy database applications have been tested before a full roll-out.

Development tools

This section gets a little bigger with each Patch Tuesday. Microsoft is addressing six critical updates and a further six updates rated as important covering the following development areas:

  • Chakra Scripting Engine
  • Rome SDK (in case you didn’t know, its Microsoft’s in-house Graph tool)
  • Diagnostics Hub Standard Collector Service
  • .NET Framework.  Core and NET Core
  • Azure DevOps and Team Foundation Server

Critical updates to Chakra Core and Microsoft Team Foundation server will require immediate attention while the remaining patches should be included in the developer update release schedule. With upcoming  major releases to .NET Core this November, we will continue to see large updates in this area. As always, we suggest some thorough testing and a staged release cadence for your development updates.


Adobe is back on form with a critical update included in this month’s regular patch cycle. Adobe’s update (APSB19-46) addresses two memory related issues which could lead to arbitrary code execution on the target platform. Both security issues (CVE-2019-8070 and CVE-2019-8069) have a combined base CVSS score of 8.2,and so we suggest that you add this critical update to your Patch Tuesday release schedule.

This article is published as part of the IDG Contributor Network. Want to Join?

Copyright © 2019 IDG Communications, Inc.

Source link

How to Make Windows Desktop Icons Extra Large or Extra Small

Extra large icons on a Windows desktop

Windows lets you choose large, medium, or small desktop icons. But did you know many other size options are available? You can fine-tune the size of your desktop icons with a quick shortcut that involves your mouse wheel.

The standard desktop icon sizes are available in the desktop’s context menu—right-click the desktop, point to view, and select “Large icons,” “Medium icons,” or “Small icons.”

Choosing Windows desktop icon size from the desktop's context menu.

For extra size options, position your mouse cursor over the desktop, hold down the Ctrl key on your keyboard, and scroll the mouse wheel up or down. Stop scrolling and release the Ctrl key when you’ve found your preferred size.

This shortcut lets you select a wider range of desktop icon sizes than the typical desktop context menu does—we counted a range of 28 sizes, from extra tiny to surprisingly huge. The mouse wheel shortcut will give you extra control over resizing your icons, shrinking or enlarging them much more than you otherwise could.

Extra small desktop icons on Windows 10

This trick works in File Explorer or Windows Explorer, too. You can quickly resize file and folder icons by holding Ctrl and rotating your mouse’s scroll wheel.

Source link