{"id":13182,"date":"2018-08-23T14:30:05","date_gmt":"2018-08-23T22:30:05","guid":{"rendered":"http:\/\/www.palada.net\/index.php\/2018\/08\/23\/news-6949\/"},"modified":"2018-08-23T14:30:05","modified_gmt":"2018-08-23T22:30:05","slug":"news-6949","status":"publish","type":"post","link":"http:\/\/www.palada.net\/index.php\/2018\/08\/23\/news-6949\/","title":{"rendered":"Microsoft Patch Alert: Mainstream August patches look remarkably good, but watch out for the bad boys"},"content":{"rendered":"

<\/p>\n

Credit to Author: Woody Leonhard| Date: Thu, 23 Aug 2018 14:01:00 -0700<\/strong><\/p>\n

So far this month we\u2019ve only seen one cumulative update for each version of Windows 10, and one set of updates (Security only, Monthly Rollup) for Win7 and 8.1. With a few notable exceptions, those patches are going in rather nicely. What a difference a month makes.<\/p>\n

We\u2019ve also seen a massive influx of microcode updates for the latest versions of Windows 10, running on Intel processors. Those patches, released on Aug. 20 and 21, have tied many admins up in knots, with conflicting descriptions and iffy rollout sequences.<\/p>\n

At this point, I\u2019m seeing complaints about a handful of patches:<\/p>\n

The rest of the slate looks remarkably clean. Haven\u2019t seen that in a long while.<\/p>\n

If August follows the precedent set this year, we\u2019ll probably see another set of Win10 cumulative updates next Tuesday, \u201cdee\u201d Tuesday, Aug. 28. At the same time we\u2019ll likely see sets of Monthly Rollup Previews for Win7 and 8.1. Of course, you should ignore them.<\/p>\n

In the past couple of months, Microsoft has released massive firmware\/driver updates for almost all of the latest Surface devices.<\/p>\n

At this point, I\u2019m still seeing problems with the July 26 set of fixes for the Surface Pro 4, which have been blamed for<\/a> touchscreens that don\u2019t touch, pens that don\u2019t pen, batteries that go out to lunch, and all sorts of boorish behavior.<\/p>\n

Of course, there have been no solutions.<\/p>\n

Microsoft released oodles and gobs (that\u2019s a technical term) of microcode fixes for Win10 1803 and 1709, passing along Intel\u2019s fixes for the Meltdown and Spectre V1, 2, 3, and 4 security holes. People have been pulling their hair out by the roots. Helen Bradley has a great birds-eye view<\/a>:<\/p>\n

Unless you are a nation state, have a key asset in a cloud server, or are running for a government office, I think we are spending way way more time worrying about this than we should.\u00a0 I still think that attackers will nail me with malware, attack me with phishing, ransomware, etc etc, way more than someone will use these side channel attacks to gain information from me.\u00a0 Remember that the attacker has to get on your system first and I still think they will use the umpteen other ways to attack me easier than this attack.\u00a0 Also keep in mind that we won\u2019t really have a full fix for this issue for several years.\u00a0 Intel and AMD will need to redesign the chips to ultimately get fixed.<\/p>\n

If you\u2019re concerned about such things, do yourself a favor and go to Intel (probably via your PC\u2019s manufacturer) and install the specific patches that you need. And remember that they won\u2019t completely solve the problem.<\/p>\n

If you insist on using the Microsoft approach to microcode, abandon all hope, and follow Bradley\u2019s advice here<\/a>. No matter which approach you take, make sure that you don\u2019t publish any before-and-after performance data, which Intel has unilaterally declared verboten<\/em>. See Bruce Perens\u2019s article Intel Publishes Microcode Security Patches, No Benchmarking Or Comparison Allowed!<\/a><\/p>\n

After all the problems last month, it\u2019s a relief to have only a handful of glaring problems this month. I suggest you wait another day or two before installing the August patches.<\/p>\n

The only significant breach of a recently patched security hole that I\u2019ve found<\/a> involves North Korea, Internet Explorer 11, VBScript, and China. That\u2019s probably not a combination that\u2019ll keep you up at night \u2014 and there\u2019s little reason to rush into installing the August patches unless you\u2019re in a Chinese organization that\u2019s run afoul of the North Korean government.<\/p>\n

I continue to recommend that you keep 1803 off your Win10 machines. No reason to go there until you\u2019re forced. Susan Bradley\u2019s Master PatchList<\/a> has details for individual patches.<\/p>\n

Thx to @sb, @abbodi86 and @PKCano<\/em><\/p>\n

Patching problems? Join us on the AskWoody Lounge<\/a>.<\/em><\/p>\n

http:\/\/www.computerworld.com\/category\/security\/index.rss<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"

<\/p>\n

Credit to Author: Woody Leonhard| Date: Thu, 23 Aug 2018 14:01:00 -0700<\/strong><\/p>\n

\n
\n

So far this month we\u2019ve only seen one cumulative update for each version of Windows 10, and one set of updates (Security only, Monthly Rollup) for Win7 and 8.1. With a few notable exceptions, those patches are going in rather nicely. What a difference a month makes.<\/p>\n

We\u2019ve also seen a massive influx of microcode updates for the latest versions of Windows 10, running on Intel processors. Those patches, released on Aug. 20 and 21, have tied many admins up in knots, with conflicting descriptions and iffy rollout sequences.<\/p>\n

Big problems for small niches<\/h2>\n

At this point, I\u2019m seeing complaints about a handful of patches:<\/p>\n