Worried about the future of your Win7 machine? Welcome to the family.
Right now, we have a promise that Microsoft will fix the “Stretch” wallpaper bug it rolled out last month, and there’s some hope that it will fix the Internet Explorer JScript engine security hole CVE-2020-0674 noted last month in Security Advisory ADV200001. We don’t know how/when the fix(es) will be distributed, or if Microsoft will soften its “no free Win7 patches after January 14” edict in some other way.
Other than that, Win7 customers are on their own — you either pay for a year of Extended Support, get your machine locked down and pray for Microsoft’s largess, or just throw the old doorstop away.
In December, Gregg Keizer wrote about the alternative — buy an Extended Security Update license from a cloud service provider. Just one little problem: CSPs aren’t set up to sell licenses by the ones and twos. It’s a manually intensive process that simply doesn’t pay for the effort.
One CSP I know has risen to the occasion, offering to get licenses for small businesses, even businesses with just one PC. Amy Babinchak, who owns Harbor Computer Services, puts it this way: “We want to make it as easy as possible for as many businesses as possible to continue receiving Windows 7 patches. It’s a manual process, so expect some delays, but we’ll try our best to get every machine with a valid Win7 Pro or Ultimate license hooked into the Extended Security Update system.”
Patch Lady Susan Bradley has been following the procedure intently and offers these tips:
You have to have a valid Windows 7 Pro or Ultimate license. No pirated keys allowed.
If you have an unused Win7 Pro key, but are still running Win7 Home, you can still use Windows Anytime Upgrade to move from Home to Pro. (Click Start, type Anytime Upgrade. When you get to the screen that asks if you have a key, enter it. Be patient .. the upgrade can take HOURS depending on the speed of the computer. Once the PC’s rebooted, activate the key in the system section.)
The free upgrade from Win7 to 10 still works. Is it legal? Probably not. But Microsoft is totally ignoring that and letting the machines activate.
Can you still buy a Win7 license if you don’t have a new one? Yes, but man it’s hard to ensure that you are buying it from a reputable place online. Everything looks a bit scammy to me. And certainly don’t buy it from an ebay vendor. There are a few on Amazon that look okay and not too scammy, but be careful. If it’s too good to be true or too cheap to be a proper license, it’s probably not one.
A healthy Win7 machine should have no problem installing the ESU key and activating it. A not so healthy one … you may have to manually install missing updates and run the Windows update troubleshooter to get it to a healthy condition.
The first Extended Security Update should arrive next Tuesday, although we don’t have an official announcement just yet. Now would be a good time to fill out the form, if you want to keep your “genuine” Win7 Pro or Ultimate machine officially patched.
Those of us not in charge of multinational networks could breathe a little easier. In spite of a stellar advertising campaign from the National Security Agency (NSA), the Chain of Fools/CurveBall CVE-2020-0601 hole hasn’t turned into an active attack. As I said at the time, it’s a long way from a third-degree polynomial to working ransomware.
Yes, you need to patch sooner or later. But, no, the sky isn’t falling. Those reports of the internet’s impending CurveBall doom were just a little bit overblown.
Still no ‘optional, non-security’ patches
I would conjecture that the January Patch Tuesday crop is relatively well-behaved because, at least apparently, they only contain security patches. Normally, Microsoft releases dozens of “optional, non-security” patches every month – bug fixes – but those annoying little gnats haven’t made an appearance since October.
I expect that will change shortly. We’ll no doubt see dozens – if not hundreds – of smaller patches out in the usual “C Week/D Week” cadence soon. Since we’ve seen no such infestation in three months, you’d be smart to avoid the “optional” patches, once they arrive, until they’ve been well vetted.
Common patching problems persist
Günter Born has put together a comprehensive list of printing problems associated with recent patches. They seem to come and go – many different printers, many different symptoms.
There are also many reports of January cumulative updates failing to install, with various error message.
None of the problems seem particularly remarkable – or even replicable – to me, but if you get stuck trying to install one of the January patches, your opinion may vary.
Upgrades to 1909 press forward, Microsoft continues to honor 1803 deferrals
Windows 10, version 1909 is available for any user on a recent version of Windows 10 who manually selects “Check for updates” via Windows Update. The recommended servicing status is Semi-Annual Channel.
In addition, Microsoft has warned that it’s starting to force Win10 version 1809 customers onto 1909:
“We are starting the next phase in our controlled approach to automatically initiate a feature update for an increased number of devices running the October 2018 Update (Windows 10, version 1809) Home and Pro editions, keeping those devices supported and receiving the monthly updates that are critical to device security and ecosystem health. Our rollout process starts several months in advance of the end of service date to provide adequate time for a smooth update process.”
For reference, Win10 version 1809 is supposed to hit end of service on May 12. You 1809 users are getting four months shaved off of your promised end of life. As a Service.
Everybody’s favorite whipping boy, Windows 7, got slapped with two bugs in the final round of free patches.
Anybody using Win7 who installs the January patches will find that their “stretched” desktop wallpaper comes out black, which can look disconcertingly like a Black Screen of Death. Lawrence Abrams has a full description, and a clever workaround, at BleepingComputer.
More alarmingly, Microsoft posted Security Advisory ADV200001 on Jan. 17. The Advisory details yet another security hole in Internet Explorer’s JScript engine, CVE-2020-0674. There’s a manual workaround with numerous side-effects, at least some of which have been overcome by a 0patch micropatch that you can install if you feel threatened.
Here’s the big open question: Will Microsoft fix Windows 7 later this month, in spite of the Jan. 14 end of service deadline? Or will Win7 drift into the sunset with a Black Screen bug and a known IE hole?
Seven semper fi.
Microsoft’s tone-deaf threat to hijack Google Chrome’s search engine
This isn’t a widespread problem. It only applies to those who are running Office 365 ProPlus, which is directed at (but not limited to) Enterprises with savvy admins. But it’s an astounding push nonetheless.
I fully expect someone with some sense at Microsoft will swoop down in the next week or two and rescind the decision. But until that happens, this stands as a browser hijacking threat of unprecedented proportions.
Most businesses operate via the cloud. That means now is an ideal time to consider a career keeping them secure. But that doesn’t necessarily mean that you’d have to go back to school for professional training. Instead, you can easily learn from home — and prep to earn valuable credentials that’ll help you land a job — with The Essential Cloud Security Certification Bundle, now just $49.
The cloud isn’t exactly a new thing. The technology has, in fact, been around for years. But it’s evolving at a pace that’s lightning quick, which means that the people required to keep it secure need to possess skills that are on the absolute cutting edge. And that’s precisely what you’ll walk away with when you train with The Essential Cloud Security Certification Bundle.
This package offers lifetime access to four courses that introduce students to the basics of cloud security plus it prepares them to acquire valuable, industry respected certifications. With these in hand, you’ll be equipped to gain either an entry-level position as a cloud security professional or use it as a platform for continued studies. Either way, it’s training that has the potential to pay huge dividends.
The bottom line is that cloud computing is here to stay. If you want a career that offers long-term employment, then this is an area you should be checking out. And, since The Essential Cloud Security Certification Bundle is being offered to readers at just $49 — a huge discount of over 90 percent off its $2000 valuation — now is the perfect time to get it.
The Essential Cloud Security Certification Bundle – $49
Frustration over a growing number of privacy and security failures in recent years is driving the creation of digital identities controlled only by those whose information they contain.
Known as “self-sovereign identities,” the digital IDs will be used by consumers, businesses, their workers and governments over the next few years to verify everything from credit worthiness and college diplomas to licenses and business-to-business credentials.
“We are slowly graduating from crawling to walking. It takes one to two years ’til we have reliable capabilities to spark meaningful decentralized identity adoption,” said Homan Farahmand, a senior research director at Gartner. “A major non-technical hurdle is for organizations to learn the concept and take the necessary steps to appropriately adapt their business processes to decentralized identity ecosystems.”
A growing number of organizations is looking to better understand decentralized identity technology, which is predicated on blockchain electronic ledgers. Currently, there are more proof-of-concept projects than production systems involving a small number of organizations. The pilots, being trialed in government, financial services, insurance, healthcare, energy and manufacturing, don’t yet amount to an entire ecosystem, according to Farahmand.
“While these projects help identify gaps such as governance, user experience, standardization and interoperability issues, none of them [rise to the level of] a practical decentralized ecosystem to bootstrap pervasive adoption at this point,” Farahmand said.
What is a self-sovereign identity?
Self-sovereign identity envisions consumers and businesses eventually taking control of their identifying information on electronic devices and online, enabling them to provide validation of credentials without relying on a central repository, as is done now. Self-sovereign identity technology also takes the reins away from the centralized ID repositories held by the social networks, banking institutions and government agencies.
A person’s credentials would be held in an encrypted digital wallet for documenting trusted relationships with the government, banks, employers, schools and other institutions. But it’s important to note that self-sovereign ID systems are not self-certifying. The onus on whom to trust depends on the other party. Whoever you present your digital ID to has to decide whether the credentials in it are acceptable.
“For example, If I apply for a job…, and they require me to prove I graduated from a specific school and need to see my diploma, I can present that in digital form.” said Ali. “And, most likely that credential would have to be cryptographically signed by the school that issued it. So the relying party – my place of work – would have to decide when I present the credential if the signing key is something they trust.”
For example, a place of employment could issue an electronic confirmation or “credential” that could be stored in that employee’s digital wallet saying you work for the XYZ Company. Even something as simple as a health club membership verification could be added to a user’s wallet and presented through a mobile app.
For consumers who are mindful of their online information – credit card numbers, date of birth, annual income, etc. – a blockchain-based network means the user controls who can see their data or get purchasing approval without releasing details such as their annual income or their age and address.
For businesses such as banks, rules such as know-your-customer (KYC) regulations make blockchain-based digital identities attractive.
How a self-sovereign ID works
Self-sovereign identities can work like this: the user has a bank confirm a credit limit or an employer confirm annual income; that confirmation information is encrypted, but available, on a public blockchain ledger to which the consumer holds the private and public cryptographic keys.
A consumer who wants a car loan from an auto dealership, for example, can give the dealer permission through a public key to confirm that he or she has enough credit or annual income to buy a vehicle – without revealing an exact dollar amount. So, for example, if the dealer wants to ensure a consumer earns more than $50,000 a year, that’s all the blockchain ledger will confirm (not that the person actually earns, say, $72,587 or some other exact figure).
The confidentiality technique is known as zero-knowledge proof (ZKP), a cryptography technology that allows a user to prove that funds, assets or identifying information exist without revealing the details behind it.
Who’s leading the charge?
Self-sovereign identities extend to businesses or other organizations that want to be able to verify – or be verified – for transactions with other businesses or government agencies. For example, Ernst & Young has created a public blockchain that lets companies use ZKPs to complete business transactions confidentially without exposing sensitive business data.
In another example, CULedger, a cooperative owned by dozens of credit unions for the purpose of providing back-office services, worked with blockchain company R3 to create CUPay, a secure electronic funds transfer (EFT) payment network that is built on R3’s Corda blockchain platform. CUPay acts as an settlement rail for cross-border customer payments.
The blockchain-based settlement system also acts as a distributed identity platform, enabling users to be verified by their credit union and then take their digital ID with them for use in cross-border payments, no matter what country they’re in or what financial institutions are involved.
CUPay utilizes R3’s Corda for organizational identity and CULedger’s MyCUID, a personal digital ID technology created through a partnership with the Sovrin Foundation and digital ID company Evernym. The solution provides integrated KYC and AML services and can be integrated into multiple networks, eliminating the need for manual entry of recipient details and providing built-in compliance management for credit unions.
“So, the PoC they developed was built to use the SWIFT payment rail, but they can use whatever rail they want, and it can even use a cryptocurrency to settle [a financial transaction] if they need it to,” said Abbas Ali, R3’s head of identity management.
R3, created five years ago by a consortium of leading financial services firms, heads up a group of more than 300 companies working to build distributed applications on top of Corda, their blockchain platform. Third parties can develop dApps (known as CorDapps), for use on the Corda platform in any number of industries, including financial services, insurance and healthcare.
“In simple terms, you can think of the [blockchain] platform kind of like the operating system. It provides all parts of identity on the network; it provides a protocol for participants to communicate with each other, but that’s as far as it goes. Any specific use case or business application on top of that would be based in the form of a CorDapp,” Ali said.
“At the application level, we have a lot of partners developing identity access management solutions using what’s called decentralized identity [DiD],” he added.
Credit unions are in the thick of it
CULedger’s CUPay eliminates the need for user names and passwords and relieves credit union call centers from the obligation of resetting them when a customer loses them. The digital identity, which is encrypted using a public key infrastructure (PKI), is controlled solely by the credit union customer.
CUPay differs from modern payment rail systems in that a user’s identity is attached to every transaction they make. Current systems, such as SWIFT’s settlement rail, don’t send the user’s identity with a wire transfer; it remains separate from the wire instructions, meaning only the bank sending the money knows who is sending it.
“The advantage is for the receiving party,” Ali said. “For them, this is just one example of the use case they developed this PoC for, but they have a bigger vision. They want people to have flexibility to move between different providers. You have an identity on your phone or, let’s say your credit union-issued application…. [If] you decide to transfer to a new state or country or change credit union provider, you can take that identity with you. That’s the bigger use case there.”
The financial services industry as a whole is focused on developing decentralized identity systems that would eliminate today’s method of identifying users by keeping their information in siloes controlled by one company or a federation of partner companies, Ali said.
Key to a DID is that no one entity or person verifies a business’s or person’s identity. The onus for identification verification is on the relying party.
“Whoever you present your digital identity to has to decide if the proofs you’re presenting through the wallet are acceptable,” Ali said. “What’s most important isn’t what you say about yourself but what a trusted organization says about you.”
That means a bank, government, healthcare organization or any other entity verifying information about a self-sovereign identity user becomes responsible for ensuring the info can be trusted.
Self-sovereign academic credentials
For example, in 2017, MIT began piloting Blockcerts, a blockchain-based network and application for storing and sharing academic credentials. MIT worked with Digital ID company Learning Machine to develop the application.
Today, Blockcerts is up and running and used by 69% of graduates. In the last graduating class of 3,718 students, 2,561 opted to have their diplomas digitized and made available through the blockchain-based application, according to Mary Callahan, MIT’s registrar.
Blockcerts creates a single digital identity wallet a graduate can present through a link to would-be employers or other schools to verify academic achievements.
“As you might imagine, having… a piece of paper that indicates you graduated is a valuable commodity in the world. So fraud was an issue,” Callahan said. “There’s also the opportunity to really recognize a student’s lifelong learning. For our students, this is one stop along their learning trajectory. They may be obtaining certificates, badges, masters degrees, PhDs, and this can put them all together in one simple portfolio of their credentials.”
MIT has aggressively marketed Blockcerts to students through the school’s newspaper, display boards and the administrators of various academic departments – an effort that lead to a doubling of its uptake over the past year, according to Peter Hayes, assistant registrar at MIT.
“One thing we’re doing in terms of outreach now is working with the career services office to raise the profile for potential employers. They host career fairs with 400 to 500 employers on campus,” Hayes said.
Last year alone, the Blockcert application was used 4,124 times to verify graduate credentials, Hayes said. “So, while students haven’t given us direct feedback, we can see … numbers [that] indicate they are using it,” he said.
The movement is real
The self-sovereign identity movement spans industries, according to Gartner.
Examples of efforts to create DID infrastructures include:
A growing number of startups and traditional identity and security vendors are also entering the decentralized identity market directly or indirectly, according to Gartner’s Farahmand.
For decentralized identity and verifiable claim exchanges to become ubiquitous, however, there needs to be industry standardization, interoperability, and autonomous operation by pushing some legal agreements and policies into the decentralized protocols (e.g. smart contracts).
“That’s where we hope to see more collaboration between decentralized identity and blockchain communities to leverage smart contracts and initiatives such as [the] Accord project,” Farahmand said. (The Accord project an ongoing effort to make it easier for anyone to build smart contracts and documents on a neutral platform.)
Decentralized identity and verifiable claim exchanges are key to enabling functions such as user authentication, digital signature, consent and verifiable claims, according to Farahmand. “While we observe implementation of all these use cases for consumers, workforce and business-to-business scenarios, verifiable claim exchange is by far the most impactful because it can disrupt the way we exchange identity data,” he said.
A verifiable claim exchange could be relevant across many industries such as finance, healthcare, education, retail, professional services and even IoT.
R3’s Ali agreed, saying it will take a greater standards effort to advance a global decentralized identity network.
“You need to remove one of biggest hurdles, which is lack of interoperability,” Ali said. “You need interoperability, because we don’t believe one blockchain can rule them all.”
It was the kind of month admins dread: Mysterious problems on hundreds of machines, with no apparent cause or cure. Toss in the holidays, and we had a whole lot of Mr. and Ms. Grinches in the industry.
Fortunately, it looks like the problems have been sorted out at this point. Individual users had many fewer problems. Microsoft’s left and right hands still aren’t talking on the 1909 team, but what else is new…
Win7 hang on ‘Preparing to configure Windows’
Microsoft dropped a new Servicing Stack Update for Windows 7 on Dec. 10, and it gummed up the works for many. Here’s a good summary on Reddit from poster Djaesthetic:
“We had over 100 Windows 7 Professional endpoints all stuck on “Preparing to configure windows” screen. We couldn’t get beyond that error in any simplistic manner. We eventually got a remediation to get beyond that error (involving booting each one from an ISO and making several registry hive edits to TrustedInstaller). Unfortunately, even after we were able to log in, the entire OS is functionally broken….
“…We are having this same issue on 111 different Windows 7 machines, each one consistently having the same environment problems. We are unable to roll back the KB4530734 Windows Update, likely because the Windows Module Installer (TrustedInstaller.exe) service itself is broken… I’ve been working non-stop all weekend. Currently waiting for (yet another) callback from Microsoft….
As Djaesthetic later posts, the problem is triggered by the Dec. 10 Servicing Stack Update, KB 4531786:
“In our investigation we confirmed the problem having to do with KB4530734 (December Monthly Rollup for Windows 7 Service Pack 1). More specifically, we believe it had something to do with KB4531786 (Servicing stack update for Windows 7 SP1 and Server 2008 R2 SP1: December 10, 2019) applying out of order. Interestingly, if you look at the notes for the December rollup it specifies a recommendation to install the SSU afterward (not a requirement). Lastly, we found some (not all) machines in various states of “Uninstall_Pending” regarding the November Monthly Rollup….”
Those of you using plain old single-system Monthly Rollups won’t encounter the problem. But if you or your system’s admin is manually installing patches, getting them in the wrong order can cause all sorts of problems. Manually installing the Servicing Stack Update can be particularly vexing because SSUs won’t show up until you’ve installed (or hidden) all outstanding patches.
Server 2012 (not R2) reboots
There were lots of reports of Server 2012 (not R2) servers going into reboot loops after last month’s updates. I originally reported on AskWoody that the problem appeared to be with KB 4533096, the “Security and Quality Rollup for .NET Framework 3.5, 4.5.2, 4.6, 4.6.1, 4.6.2, 4.7, 4.7.1, 4.7.2, 4.8 for Windows Server 2012.” But I now think that a bad Malicious Software Removal Tool (MSRT) version may have been at fault.
Manually rebooting cleared up the issue. And the mid-December version of MSRT is long gone. There’s no official confirmation or explanation that I can find.
Win10 version 1909 bugs continue
The December patch didn’t fix the long-decried File Explorer Search bug in Win10 version 1909. You may recall that Microsoft’s known about the bug – which makes Search in File Explorer unusable – since 1909 shipped. They fixed the bug in a Win10 version 2004 beta test version
Microsoft still hasn’t confirmed the bug in the official Release Information Status page. I’ve seen Twitter threads where Microsoft employees claim no knowledge of the problem – in spite of the fact that the bug’s been reported over and over again in many different places (including the Feedback Hub) for months. @navh2009 nails it:
“If they are going to keep half baking these new changes, then they should stop making changes to things [that] were never broken. File Explorer search didn’t need windows search. Delete key still doesn’t work. How does basic functionality like this get forgotten every time?”
@railmeat goes on to say:
“These kinds of problems reoccur [due] to inadequate testing. These should be found in regression and functionality testing. Microsoft has the resources to do that testing, but apparently chooses not to.”
“In 1909, the upper bar of File Explorer (address + search box) no longer belongs to the Win32 platform. It’s a hybrid WinRT (UWP) feature. It’s half-baked, ugly, slow, and requires some prerequisite tasks to even semi-function (clipboard and other services including the MsCtfMonitor task schedule).”
I still recommend that folks avoid 1909 for precisely this reason.