February Patch Day Round-Up

SecurityImage

February did not have a lot of issues from patches released on Patch Tuesday, but there are a couple of things that occurred that you may want to know about.

First is the update that was pulled from circulation after reports of systems hanging.  An update for Visual Studio 2010 Tools for Office Runtime (KB3001652) reportedly started causing issue on Patch Tuesday.  It was pulled later the same day.

Second, and probably the wider impacting issue this month, was update MS15-009 breaking Cisco AnyConnect VPN clients.  Microsoft has stated they will release a fix in March that should resolve the issue, but until then you have three work around options:

1. Windows 8 compatibility mode for the app

2.Customers can uninstall the KB3023607 update from Microsoft. However, this will also remove any other security fixes provided by Microsoft as part of the update. This can be removed under:

Control Panel / Programs / Programs and Features, click “View installed updates” on the left and locate and uninstall the update labeled with KB3023607.  This update is not visible when you try to locate it through the Windows Update application’s history, but it is accessible via Control Panel.

3. Per Cisco: Microsoft has released a fix-it patch providing a workaround for this issue. See KB# 3023607
https://support.microsoft.com/kb/3023607

When you visit the KB page, it appears you have to scroll down to the “Microsoft Fix It” button and install the AppCompat shim which is Microsoft Fix it 51033. This is a bit confusing, so be sure to click that button.

You can the On Demand February Patch Tuesday webinar or download the presentation for this last months Patch Tuesday release.  Also, sign up for the March Patch Tuesday webinar to discuss the updates released on Patch Tuesday, recommendations, and things to watch out for.

The Communicator’s Corner: Secret Agent, Man

(Title inspired by a favorite song by Johnny Rivers that was a hit just a few years ago.)

Secret Agent

Did you know that Shavlik Protect provides all of this functionality using both agentless and agent-based technologies?

In my last few blog posts, I have talked about three prominent features in Shavlik Protect that go beyond the core patch management capabilities. The threat management, power management, and ITScripts features in Shavlik Protect make it much more than a utility used once a month at patch time. Rather, it is a multi-use, unified IT management platform that provides incredible value to your organization every single day.

Now that that secret is out of the bag, I thought I’d let you in on another. Did you know that Shavlik Protect provides all of this functionality using both agentless and agent-based technologies? It’s true! Most everyone is familiar with Shavlik Protect’s agentless capabilities – it is, after all, part of what helps you get up and running with the product in 30 minutes or less. But agents? That seems to be an untold story.

Here’s the scoop: Although performing actions on your target machines from a central console has many advantages, certain types of users or systems can pose problems for agentless solutions. For example, machines that must reside in a de-militarized zone (DMZ), roaming users, and disconnected or inactive machines can all prove problematic. In these cases an agent-based solution is often the best answer.

Implementing agents in Shavlik Protect is a relatively easy, two-step process. You first configure one or more agent policies on the console. Then, you install the agents on your target machines either by pushing them from the Shavlik Protect console or by manually installing them on individual machines. Once they are up and running, the agents will report all activity to the console so you can track their actions.

Depending on how they are configured when installed on a machine, an agent can:

  • Scan for and deploy missing patches
  • Scan for asset information
  • Provide real-time monitoring and protection against known and unknown threats
  • Scan for and remediate existing threats such as spyware, viruses, Trojans, and rootkits
  • Shut down or restart the agent machine on specific days and times
  • Listen to the console or the cloud for policy updates
  • Report the results to the local console

Not bad, huh? Here are a few options if you are interested in learning more.

 

The Future is Now: Time to End Your Insecurity

WindowsXP-background_sml-300x300It’s October 2003. You’re still using Windows XP. You may be listening to Muse’s new album Absolution, laughing at Finding Nemo in cinemas or being disappointed at The Matrix Reloaded. A new website called 4chan just launched. And Microsoft starts Patch Tuesday, rolling out updates to your PC on the same day each week.

Patching has always been a necessity, but in October 2003, it became ‘a thing’.

So why are we still getting it wrong, eleven years down the line?

home_patch-slide_backgroundWe recently ran some research asking enterprises about the state of their patch management. Despite Patch Tuesday, over a third (34%) of respondents admitted that they’re still not managing Microsoft patching well enough. This climbs to almost half (49%) when we talk about non-Microsoft products.

It gets worse. 91% of IT managers across the globe can’t manage the patching and security of mobile devices once they leave the office. And let’s be frank here: our world is never going to get less mobile.

This worry is justified: all in all, over two thirds (64%) of IT managers don’t understand how vulnerable users are to existing risks, let alone new, emergent threats. No dashboards, no traffic lights, nothing.

It’s 2014. I’m still a little disappointed at the Matrix Reloaded and I still laugh at Finding Nemo. Muse still plays on my stereo and 4chan is still around. But this insecurity has got to stop. If you’re one of the managers we’ve mentioned, please talk to Shavlik about how we can help automate patching and focus on tomorrow’s problems, not those from 2003. To quote one of my favourite films -it’s time to get back to the future.

Patch Tuesday February 2015

SecurityImageIt is February and already we have seen some excitement so far this year. Between Microsoft dissolving the ANS (Advanced Notification Service), to Google’s Project Zero team rigidly adhering to their 90-day disclosure policy (disclosing a Windows vulnerability days before the January Bulletin released, not to mention the disclosure of three high severity Apple vulnerabilities in late January), and a series of Flash Zero Day’s that were discovered in the wild and quickly turned around by Adobe. My take on each of these:

  • Microsoft ANS – I’m not a fan of dissolving this program. Not all companies may have used this to their full advantage, but customers of ours relied on the ANS to give them a couple of day jumpstart on prepping for their monthly maintenance. If Microsoft introduces patches to a product that has never been updated prior to the patch cycle, admins will need time to prep test machines. Now they will be condensing that time along with change control processes into a tighter window.
  • Google Project Zero disclosures – Anyone who has read my blogs or commentary before knows that I am a proponent for vendors being responsible about disclosures, but after a resolution is in place. Yes the time to resolution is important, and for vendors who are negligent I fully agree with the Google stance. By Chris Betz’s comments in a blog post just after Google’s disclosure of the Windows OS vulnerability, they had communicated to Google, prior to the 90-day date, that the update was coming just a couple of days later. What purpose did this disclosure serve other than to stir up a lively debate?
  • Flash Zero Day’s – I do not envy the Adobe Security Team so far this year. Browsers, browser plug-ins and media players are prime targets for hackers. They are on practically every device we use, so naturally they will become a target. I do think that the turnaround from discovery to resolution on these three instances was very fast and applaud the Adobe team for ensuring the resolutions were delivered quickly.

For February Patch Tuesday the non-Microsoft updates are going to be light this month. With three Zero Day’s in a row, Flash Player has had a number of updates pushed recently. Companies that have not pushed the most recent Flash Player updates should do so immediately. Since January there have been three Flash Player updates to cover a series of Zero Day’s discovered in the wild. The most recent update on Feb. 5 also included 17 other vulnerability fixes. The expectation is that we will not be seeing a Flash Player update this Patch Tuesday, but you definitely have updates to push if you have not done so since January.

With the series of Flash Player updates, you will also need to push the latest IE Advisory 3021953 to update the Flash Plug-in, otherwise you have not fully plugged the three Zero Day’s and additional vulnerabilities from the Flash releases.

Google Chrome also released prior to patch Tuesday to accommodate the urgent Flash Player updates. The latest Chrome update resolves the Feb. 5 Flash Player plug-in update along with 11 security fixes. This should be another high priority update for you this month. Google has announced a Beta Channel Update for Chrome, which usually indicates a release is not far off. I would expect it to be a feature release since Google updated so many security fixes on Feb. 5.

Mozilla Firefox released an update last week including 10 security vulnerabilities. Four of these are Critical. This should be among your top priorities this month to get updated.

On the Microsoft front we will see a fairly average-sized Patch Tuesday. Three Critical and six Important updates have been released. The impact this month includes the operating system, Internet Explorer, Office, SharePoint and System Center Virtual Machine Manager.

Internet Explorer is a critical update this month. Having not pushed an update in January, it is not surprise that there are 41 vulnerabilities being resolved in this Security Rollup. Definitely a Priority 1 this month. One of these has been publicly disclosed.

There are two Critical updates for the Windows Operating System updates this month. The first is a Critical Kernel Mode Driver update this month, so test diligently lest you blow up the brains of the machine. Then we have a Critical update group policy that could allow remote code execution. The VMM update applies to both server and client installs. If you have the admin console installed on the VMM server you should update the VMM server patch first, then the administrator console patch.

There are no Critical updates for Office this month, but there are multiple Important updates including a SharePoint update. The thing about SharePoint updates is the lack of rollback. Test adequately, especially if you have a lot of SharePoint plug-ins. If you have not already done so, you should look into virtualizing your SharePoint servers. The ability to snapshot the VM prior to updating will allow you to rollback even if the patch does not support it. If you are running VMware vSphere and Shavlik Protect, you can take advantage of our snapshot feature to do a pre-deploy snapshot automatically during the patch process.

Here is a bulletin-by-bulletin summary of the updates you should be planning for this February (first three released prior to Patch Tuesday):

APSB15-04: Security updates available for Adobe Flash Player
Vendor Severity: Priority 1
Shavlik Priority: Priority 1 – Should be pushed out as soon as possible
Vulnerability Count: 18 (+2 more if you have not pushed APSB15-03 yet)
Impact: 1 Zero Day currently being exploited in the wild (+2 more if you did not push -03), use-after-free, memory corruption, type confusion, heap buffer overflow, buffer overflow, and null pointer vulnerabilities.

Chrome 40.0.2214.111 : Stable Channel Update
Vendor Severity: High
Shavlik Priority: Priority 1 – Should be pushed out as soon as possible
Vulnerability Count: 11 (Also includes support for latest Flash plug-in)
Impact: 3 Highs resolving use-after-free, cross-origin-bypass, and privilege escalation

Firefox: 34 and 35 updates
Vendor Severity: Critical
Shavlik Priority: Priority 1 – Should be pushed out as soon as possible
Vulnerability Count: 10
Impact: 4 critical updates resolving sandbox escape, read-after-free, memory safety, and update to the OpenH254 plug-in.  Also includes uninitialized memory use, origin header, memory use, wrapper bypass and other vulnerability fixes.

MS15-009: Security Update for Internet Explorer (3034682)
Vendor Severity: Critical
Shavlik Priority: Priority 1 – Should be pushed out as soon as possible
Vulnerability Count: 41 (1 is publicly disclosed)
Impact: Remote Code Execution, Security Feature Bypass

MS15-010: Vulnerabilities in Windows Kernel-Mode Driver Could Allow Remote Code Execution (3036220)
Vendor Severity: Critical
Shavlik Priority: Priority 1 – Should be pushed out as soon as possible
Vulnerability Count: 6 (1 is publicly disclosed)
Impact: Elevation of privilege, Security feature bypass,

MS15-011: Vulnerability in Group Policy Could Allow Remote Code Execution (3000483)
Vendor Severity: Critical
Shavlik Priority: Priority 1 – Should be pushed out as soon as possible
Vulnerability Count: 1
Impact: Remote code execution

MS15-012: Vulnerabilities in Microsoft Office Could Allow Remote Code Execution (3032328)
Vendor Severity: Important
Shavlik Priority: Priority 2 – Should be pushed within 10 days
Vulnerability Count: 3
Impact: Remote Code Execution

MS15-013: Vulnerability in Microsoft Office Could Allow Security Feature Bypass (3033857)
Vendor Severity: Important
Shavlik Priority: Priority 2 – Should be pushed within 10 days
Vulnerability Count: 1 (publicly disclosed)
Impact: Security Feature Bypass

MS15-014: Vulnerability in Group Policy Could Allow Security Feature Bypass (3004361)
Vendor Severity: Important
Shavlik Priority: Priority 2 – Should be pushed within 10 days
Vulnerability Count: 1
Impact: Security Feature Bypass

MS15-015: Vulnerability in Microsoft Windows Could Allow Elevation of Privilege (3031432)
Vendor Severity: Important
Shavlik Priority: Priority 2 – Should be pushed within 10 days
Vulnerability Count: 1
Impact: Elevation of Privilege

MS15-016: Vulnerability in Microsoft Graphics Component Could Allow Information Disclosure (3029944)
Vendor Severity: Important
Shavlik Priority: Priority 2 – Should be pushed within 10 days
Vulnerability Count: 1
Impact: Information Disclosure

MS15-017: Vulnerability in Virtual Machine Manager Could Allow Elevation of Privilege (3035898)
Vendor Severity: Important
Shavlik Priority: Priority 2 – Should be pushed within 10 days
Vulnerability Count: 1
Impact: Elevation of Privilege

Join us tomorrow on our monthly Patch Tuesday webinar as we discuss the priorities and pitfalls you will want to watch out for.

2015: The Year of the Healthcare Breach

HealthcareBreachOur own Rob Juncker, V.P. of research and development for Shavlik, has predicted that Healthcare breaches will rapidly increase in 2015. Now that hackers are getting smarter about attacking endpoints to glean credit card data from retailers, they are looking for more creative ways to make money. In the hacker’s community, credit card data is worth about $1 per card, whereas protected health information (PHI) is currently worth about $10 per record and rising.

Why the discrepancy in price? Because hackers can do more nefarious activities by submitting fraudulent healthcare claims or by buying and selling drugs and medical equipment for financial gain. Credit card companies are just plain better than insurance companies at detecting and shutting down fraudulent activity. Credit card companies also have the option to change your credit card number, whereas your patient data cannot change. Medical fraud could last for years before it is detected and corrected.

Now that Mr. Juncker has made the prediction, 2015 brings us our first major health record breach with Anthem, whose brands include Anthem Blue Cross/Blue Shield and others. The potential theft could be as big as 80 million records and include names, social security numbers, birth dates, policy numbers, diagnosis codes and billing information. The overall security problem is exacerbated by outdated equipment, demands from doctors to use mobile devices, and the loss or theft of devices used by multiple health workers.

So what can healthcare and IT organizations do? The first step is to simply keep up with the latest updates and patches. Once a software vendor such as Adobe releases a patch, hackers now know there is a security hole. Shavlik is seeing an increase of vulnerabilities coming from third-party applications outside of the OS. Patching both the OS and third-party applications is critical to keeping them secure and the data safe.

Vulnerabilities exist on the end-point because they are often unpatched and neglected. IT has enough on its plate to try and keep all the software on every system up-to-date. But in the wave of the latest breaches, it becomes imperative to do so.

As we see healthcare staff requesting more mobile devices such as tablets, we will see more loss and theft of devices that will contain PHI data. Having methods to encrypt the critical data such as email and attachments will greatly decrease the risk.

As a healthcare provider, what does it mean to you? As in retail, security is more and more of an issue that needs to be addressed. Healthcare organizations are now under scrutiny to comply with HIPAA regulations. Anchorage Community Mental Health Services (ACMHS) was fined $150,000 after 2,700 health records were stolen in an attack. They were attacked simply because they were not patching software!

Beware healthcare. 2014 was the year of retail breaches. 2015 is the year of healthcare breaches!

 

 

 

Shavlik Sales Team Charged Up After Annual Kickoff

Last week the global Shavlik sales team gathered in Salt Lake City for our annual sales kickoff. It’s always a pleasure to have the entire team together in one place.

The event consisted of numerous sessions where the sales team learned about product advancements and discussed strategies for the coming year.

Time was also spent reflecting on the team’s success in 2014. We are proud to announce the winners of Shavlik’s annual sales awards.

  • Rick Balazs, Shavlik Channel Manager of the Year
  • John Rush, Shavlik Systems Engineer of the Year
  • Bob Troup, Shavlik Sales Professional of the Year

Thanks to Rick, John, Bob, and the entire Shavlik sales team for their contributions this year.

The team also found time for some fun. One afternoon was spent snowmobiling in the mountains near Park City, UT.

Photo captions:

Troup

Bob Troup accepts the award for Shavlik Sales Professional of the Year from VP of Shavlik Sales Marshall Smith (left) and CEO Steve Daly (right).

Balazs

VP of Shavlik Sales Marshall Smith (left) and CEO Steve Daly (right) recognize Rick Balazs as the Shavlik Channel Manager of the Year.

Rush

John Rush, Shavlik’s Systems Engineer of the Year, is congratulated by VP of Shavlik Sales Marshall Smith (left) and CEO Steve Daly (right).

snowmobiling_group

The Shavlik Sales and Marketing teams were treated to an afternoon of fun snowmobiling in the mountains near Park City, UT. The weather and scenery couldn’t have been better.

Some interesting stats regarding vulnerabilities in 2014

2014 was a big year.  We saw a large number of data breaches and a variety of vulnerabilities come to light from Heartbleed to Poodlebleed to BlackPOS.  Looking back on many of the major occurrences you can sometimes miss trends and interesting facts.  Here is a look at some of the highlights of 2014 for all your favorite vendors.

Microsoft released 85 security updates this year, 29 of which were Critical Updates.  Here is the breakdown by Severity:

MSSeverityBreakdown

Taking into account non-security updates and looking only at Critical updates, here is a breakdown by Windows Operating System.  Keep in mind XP was only under support for a short time this year (there are a lot of unpatched vulnerabilities and unreleased bug fixes for XP from this year alone).  Probably not surprising, but Windows 8.1 had a lot of Critical fixes this year.  This is likely due to the young age of the Operating System and the need to flush out many user experience issues and fix critical bugs found as usage increased.  Of the 290 critical updates, only 15 were Security Bulletins.

OSCriticalPatchCount

 

Let’s talk browsers.  This is always a fun topic.  Which is your favorite browser?  Everyone loves to hate on IE, and then you have the Chrome and FireFox fanboys.  Not sure how many Safari fanboys I have met.  Most of those would characterize as a Mac fanboy who didn’t care to find an alternate browser to use so continued to use the default that came with the OS (not unlike most IE users).  If you look at the trend it typically is Chrome, FireFox, IE, Safari as far as CVEs resolved in a year.  This year Microsoft had a trend starting back in June with a peak of 60+ CVEs resolved in a single update and remaining in the double digits for the remainder of the year.  Safari on the other hand, is a lot higher than their average, but in their case keep two things in mind.  Most of the hacker shows like Pwn2Own and many of the Zero Day teams target combinations of products like Java or Flash and the top three browsers in their exploits.  Apple also has a security by obscurity mentality where they do not disclose everything that is wrong.  Likely their counts are that much lower because they are not giving out bounties (to my knowledge), not targeted by the white hats or professional teams searching out vulnerabilities, and also possibly fix things ninja style and don’t open a CVE.

BrowserVulnCount

 

If you look at vulnerabilities by CVSS over all time Internet Explorer has the most vulnerabilities over 9+, followed by FireFox, Safari, then Chrome.  For those of you unfamiliar with CVSS, it is a scoring system for determining how severe a vulnerability is with a 10 being the highest rating a vulnerability can receive.

LifetimeVulnCVSS9

Fun fact time!

  • Adobe Flash released on Patch Tuesday every month, but February this year, but in February they released the week before and the week after Patch Tuesday.
  • Adobe Flash had 15 updates released in 2014 resolving 76 vulnerabilities.
  • 13 of those 15 were Priority 1 updates, meaning they resolved critical security vulnerabilities.
  • 11 of the vulnerabilities resolved by Flash updates in 2014 were publicly disclosed.  2 have been added to commercially available frameworks, and 2 were discovered in the wild in the form of Virus or Malware attacks.
  • When you update Flash, that only covers the application install.  You must also update Chrome to the latest version and deploy a Security Advisory from Microsoft for IE.  That’s a three’fer!  Three vulnerable points to update for the price of one!

Last, but not least, lets look at what products had the most vulnerabilities in 2014.  Based on CVEDetails.com the top 10 products by Distinct Vulnerabilities for 2014 are as follows.  A lot of browsers in this list along with Java and Flash Player.  A lot of Apple on the list as well.

Top10VulnProd2014