Happy holiday’s everyone! This marks year three of our annual 12 Beers of Christmas blog post where the team gives you recommendations of their favorite beers from 2016. This is a tradition that actually started from a now nine-year practice of doing a beer exchange in our office instead of cookies or Secret Santa. So for all you beer fans out there, here is the 2016 edition of the Shavlik 12 Beers of Christmas. Enjoy!
Brent, Software Engineer
Beer recommendation: Black Sheep Best Bitter
Description: Brent spent a bit of time across the pond this year after LANDESK acquired AppSense. “It was my nightly beer one trip to England during an AppSense visit. Very solid English bitter that paired well with any of the pub food.”
A well hopped, light golden session bitter with a distinctive, dry, refreshing taste enjoyed through a rich creamy head. Brewed in traditional cast iron and copper vessels using the finest ingredients.
Mark, Software Engineer
Beer Recommendation: Able BLK WLF Stout
Description: It is a coffee forward stout with a satisfying finish. The best part is since it as a low ABV at 3.8%, I can have a few without having to rely on my friends to carry me home.
Clear dark brown, large creamy tan head, good retention. Aroma of chocolate, roasted malts, piney hops. The taste is citrus, roasted malts, chocolate. Medium bodied, lingering bitterness.
Neil, Manager, Territory Sales
Beer Recommendation: Weihenstephaner Original
Description: A cheeky little number from the oldest brewery in the world. Not sure if you can get this in the US but the brewery is a 15 minute drive from Munich airport. It is worth the trip!!
A good beer takes its time. The long storage makes our yellow bright lager, “Original”, a flavourful beer enjoyed with fine poured, white foam. With a mild hoppy note and its pleasant fresh spicy taste, it goes very well with salads, poultry, stews or with a hearty snack. Brewed according to our centuries-old brewing tradition on the Weihenstephan hill.
Robert, Senior Product Marketing Manager
Beer Recommendation: Samuel Adams Nitro White Ale
Description: From America’s largest Craft Brewer, and from the city (Boston) known for more than just the revolution of craft beer. This beer is smooth as silk, refreshingly cold, and a joy to consume year round. Crisp enough for the Summer, hearty enough to keep you warm in Winter. I enjoyed this guy while watching summer sunsets over Lake Winnipesaukee in NH this past summer.
Brad, Software Engineer
Beer Recommendation: Fitger’s Big Boat Oatmeal Stout
Style: Stout – Oatmeal
Description: Good stout, nice chocolate and coffee combination for sipping on MN winter days. Enough alcohol to keep you warm and toasty on the inside but not stumble out of the bar and die from hypothermia when you slip and fall on the ice.
Simon, Chief Technologist
Beer Recommendation: Peroni Original
Style: Lager – Pale
Description: Served at Ultra cold temperature and great for the British summer when we get them. Added benefit is that it doesn’t seem to cause those dreadful headaches I seem to get more of as I get older. The downside is that its currently one of the most expensive you can buy.
Ken, QA Director
Beer recommendation: Surly Gose (pronounced “Go-zuh”)
Style: Kettle Sour Ale
Description: Just had this at the brewery during our holiday party. A great sour beer with a crisp taste with little surprise extra tartness in the end. Pairs extremely well with co-workers.
The base beer for our series of kettle souref ales, surly Gose had has a light, crisp body with a refreshing tartness and a fleeting saltiness.
Randy, Manager, Software Engineering
Description: I’m going to put in my official favorite for the year as Fulton Batch 300. I’m not sure how widely available it is, but it is a fantastic West Coast style IPA brewed right here in Minneapolis. Like many great beers, it was originally a limited edition but was so popular they decided to brew it year-round. It is very hoppy, but has a nice balance and smooth finish.
Batch 300 is built on a base of Weyermann Pilsner malt, and heavily hopped from start to finish with Mosaic, one of our favorite American hop varieties. At 74 IBU and just under 7% ABV, Batch 300 will delight your palate without wearing it out.
Frank, Software Engineer
Style: Porter – Peanut Butter
Description: Smells like peanuts, tastes likes peanuts and beer. When you want a peanut butter sandwich and you also want a beer, but you can’t be bothered to get both: this is the beer for you. Dark color with a nice full head. Really good on nitro if you can get it.
Brian, QA Engineer
Beer Recommendation: Ballast Point Grapefruit Sculpin
Style: American IPA
Description: Bright, citrusy IPAs are becoming increasingly common and I am not complaining. The Sculpin IPA is hopped at five separate stages and has notes of apricot, peach, mango, and lemon. This award winning IPA is then complimented with grapefruit, creating a flavorful and surprisingly drinkable IPA. A perfect beer to compliment warm summer days or the bitter cold winters of Minnesota.
Derek, Manager, Cloud Operations
Beer Recommendation: Surly Darkness (2016)
Style: Imperial Stout
ABV: 9-12% (Depending on the year)
Description: Knocks you on your a$$!
This massive Russian Imperial Stout brings waves of flavors; chocolate, cherries, raisins, coffee, and toffee. We add a touch of hops to make this delicious brew even tastier.
Chris, Manager, Product Management
Beer Recommendation: O’Town Triple
Style: Belgian Triple
Description: From the fine brewer at Lamada Brewing comes fine example of a Belgian abbey style ale. Not as dark as a St Bernardus ABT 12 or Chimay Grand Reserve. Has a fruity aroma and complex flavors with a mix of malty, slightly bitter, and a fruity sweetness. Actually this is my own home brew and a recipe I am continuing to perfect. I just brewed batch three this fall and it should be ready to drink sometime around June! Perfection takes time. If you really want to try some you will have to come visit me in June.
Joe, Technical Writer
Beer Recommendation: Grain Belt Nordeast
Style: Amber Lager/Vienna
Description: For anyone wishing to experience some local Minnesota flavor, I highly recommend Grain Belt Nordeast. It’s a great tasting beer that meets my main requirements: it is reasonably priced and almost always available wherever I go. Unlike most of the other beers you’ll see on this list, there’s no need to take out a loan or drive 100 miles to an obscure liquor store to purchase it. And that makes Nordeast satisfying in a number of different ways.
John, Channel Account Manager
Beer Recommendation: George Killian’s Irish Red
Style: American Amber\Red Lager
Description: A full and well-balanced American Amber / Red Lager style beer, and honestly, my go to if I’m hanging out with relatives or friends who don’t really enjoy craft beer and would rather depend on boring domestics. Like an IPA, has a body more similar to a Scotch ale than a lager or porter, offering a blend of dark fruit, caramel, bread and toast swells in a tight bouquet. While it’s aroma is complex, it’s easy on the tongue. A malt-forward profile flows across the palate with easy transitions: Light bready malts pick up hints of toast, and then caramel and dark fruit as it washes back. A quiet bitterness counters the sweetness and guides this straightforward beer to a refreshingly clean finish. Joyeaux Noël !
The Peanut Gallery (there is always a comedian in the bunch. This year we have two.) :
Brian, QA Engineer (his first attempt that was rejected)
Beer Recommendation: Camo Black Ice High Gravity Lager
Style: Malt Liquor
Description: The Camo Beer Company in Lacrosse WI describes this beer as “Ice brewed for extra smooth taste”. This true star of the north is best served in a paper bag. At a size of 24 ounces, an ABV 10.5%, and a price around $2 it is truly a symbol of efficiency. Who needs hydration from six and a half 3.2 beers when you can fit the same punch into one fine paper bag?
Rob, VP Engineering (remember 2014 when he recommended Coors? Yeah this one is worse)
Beer Recommendation: Hamms
Style: Pale Lager
Description: If it looks like a Coors, smells like a Coors, and tastes like a Coors then it must be a Coors….except it’s not. It’s Hamm’s American Lager and it doesn’t smell like Coors… in fact, it has no aroma at all. But for days when you feel like punishing yourself, grab a can… or 48 of these. This beer is very much a synthesizer of taste and takes on the taste of whatever you are pairing it with making it the perfect beer to pair with any meal that you like the taste of… be warned though, if you are using it to wash the taste of a burnt garlic meatloaf out of your mouth, all you have done is captured and amplified that tragic flavor. I hear if you mix a little Mio in there though, you can work your way right past that.
December Patch Tuesday has a flurry of exploits and public disclosures. Coming in to Patch Tuesday, we already had one zero day from Mozilla (CVE-2016-9079) which updated on November 30. Today, Adobe released nine bulletins, including a critical update for Adobe Flash that resolves a zero day (CVE-2016-7892). Microsoft is updating Flash for IE and also has five publicly disclosed vulnerabilities being resolved.
Starting with Firefox, Mozilla announced an update on November 30 that resolved a zero day in SVG Animation. This was identified in attacks targeting unmasking users of the Tor anonymity network. In an article from ZDNet, there was speculation from researchers that this exploit was very similar to an exploit known to have been used by the FBI back in 2013 that was used to unmask IP addresses of Tor users.
Today Mozilla is releasing version 50.1, which includes the Zero Day fix from 50.0.2, which released a couple weeks ago. If you have not already done so, ensure that Firefox is on your priority list this month.
Adobe has released nine bulletins today, but only one is rated as critical. I am sure most of you have guessed that it is for Flash Player and also includes a zero day. APSB16-39 resolves 17 total vulnerabilities and the exploited CVE-2016-7892, which has been used in limited targeted attacks against Windows systems running Internet Explorer (32-bit).
According to an article from Threat Post, analysts from the Google Threat Analysis Group discovered the vulnerability and privately disclosed details to Adobe. Adobe did not have details around the specific attack and the Google researches have not disclosed any more detail publicly at this time.
As always, when there is a Flash Player update, you need to make sure to update all instances of Flash on systems. This means Flash plug-ins for IE, Chrome and Firefox. Some of these will auto update, others may take some prodding before they will update. This is why having a solution that can scan for all four variations is critical to make sure you have plugged all the vulnerabilities in your environment.
On to Microsoft. Microsoft has released a total of 12 bulletins, six of which are critical. Microsoft is resolving 42 unique vulnerabilities this month.
Aside from Flash for IE, Microsoft does not have any additional zero days to report, but they do have several public disclosures. A public disclosure means that enough detail has been released to the public to give a threat actor a jump start in developing an exploit. This puts their vulnerabilities at higher risk of exploit.
MS16-144 is a critical update for Internet Explorer that resolves eight vulnerabilities, three of which are publicly disclosed (CVE-2016-7282, CVE-2016-7281, CVE-2016-7202). Many of the vulnerabilities resolved in this update target a user through specially hosted websites and ActiveX controls and through taking advantage of user-provided content or advertisements or compromised websites.
MS16-145 is a critical update for the Edge browser that resolves 11 vulnerabilities, three of which are publicly disclosed (CVE-2016-7206, CVE-2016-7282, CVE-2016-7281). Similar to the IE vulnerabilities, many of the vulnerabilities resolved in this update target a user through specially hosted websites and ActiveX controls and through taking advantage of user-provided content or advertisements or compromised websites.
MS16-146 and MS16-147 are both rated as critical and affect components of the Windows Operating System. Both resolved vulnerabilities that would target a user and can be mitigated by running as less than a full administrator on the system.
MS16-148 is a critical update for Office, Sharepoint and Web Apps that resolves 16 vulnerabilities. Many of the vulnerabilities resolved in this update can target a user through specially crafted files. An attacker can also host specially crafted web content to exploit many of these vulnerabilities. CVE-2016-7298 is also able to use the Preview Pane as an attack vector.
MS16-155 is an important update for .Net Framework and resolves one vulnerability. Although only rated as important, this bulletin resolves a vulnerability that has been publicly disclosed (CVE-2016-7270), putting it at higher risk of being exploited.
There are additional bulletins from Adobe and Microsoft this month, but these are the bulletins that should be on your priority list for December.
As always, we will be running our monthly Patch Tuesday webinar, where we will go deeper into the bulletins released and recommendations to prioritize what updates need to be put in place sooner than others. Make sure to sign up for the December Patch Tuesday webinar to catch playbacks of previous months and get access to our infographics and presentations to give you the information you need going into your monthly maintenance. www.shavlik.com/Patch-Tuesday
December is here and it finally snowed in Minnesota! In fact, we may get four to eight inches this weekend. So, my Patch Tuesday Forecast — like winter up here in MN was a little delayed — but better late than never! So get out your snow shovels and let’s dig in. There is already a little accumulation with a zero day hitting in late November. If you haven’t already done so, update your Mozilla Firefox browser!
On the Horizon
In the last week of November, it became clear to many security researchers that there was a flaw in Mozilla’s browsers and in TOR, a browser based on Firefox. CVE-2016-9079 is a critical use-after-free vulnerability affecting the SVG Animation component in Firefox. Researchers, such as Malwarebytes, have evaluated the vulnerability and have explained that the goal of this vulnerability “is to leak user data with as minimal of a footprint as possible. There’s no malicious code downloaded to disk, only shell code is run directly from memory.”
Although the observed exploits were only targeting windows, the vulnerability exists on Linux and Mac platforms as well. The exploit code also seems very similar to another Tor exploit used by the FBI as an investigative technique to track down child pornography suspects. It is not currently known where this code originated, but it’s a good example of a user-targeted vulnerability.
The Mozilla update became available on November 30 for Firefox, Firefox ESR and Thunderbird. If you are already caught up, you will want to make sure you include Mozilla in your updates this month.
Security Tip of the Month
December is also getting well into the cold and flu season, so this month’s security tip will follow the theme of security hygiene. I just returned from Las Vegas from the Gartner Data Center Conference where I attended a session by Neil MacDonald on security for cloud workloads. One of the things Neil mentioned was staring with a solid foundation, which he referred to as operations hygiene. I’m going to expand that out to a broader security hygiene message.
To stay well in the cold and flu season, you need to ensure you are getting rest and washing your hands, especially after coming into contact with someone who is sick or areas frequented by many people. You need to keep up on your vitamin C and drinking liquids in general. Similarly, with security we need to do the same.
- Wash your hands – Make sure you have sanitized incoming email with junk mail and phishing filters.
- Use some sanitizer after coming into contact with highly public areas – Your users who travel in and out of the company will come into contact with public Wi-Fi. Users will browse the internet, open email with attachments and, in general, be exposed to potential attack vectors daily. Make sure their machines are getting sanitized with good signature, non-signature and behavioral threat assessments. Signature-based threat assessment alone is not enough anymore.
- Get your daily dose of vitamin C – Preventive security measures can defend against 80 percent of the threats in today’s market. Make sure you give your systems their shot of vitamin C in the form of patching the OS and software, use of least privilege rules and proper application control.
Your Patch Tuesday Forecast
Based on what trends we have seen this year I think it’s safe to say the following:
From Microsoft, we are expecting around two to four installable packages:
- OS and IE will definitely have multiple updates, but they will come in a single installable package under the new servicing model. Vista would be the only exception to this change as it still receives individual bulletin updates.
- Office has been very consistent this year with updates pretty much every month. The question is will this be a single update or a couple for Office, SharePoint and Web Apps. I would say one for office and a 50 percent chance of SharePoint/Web Apps.
- .Net is also likely this month. .Net updates hit five of six patch Tuesdays in the first half of the year, and have been about every other in the later half.
- You can also expect an IE update for Flash Player.
From Adobe, you can expect one to three updates:
- Adobe typically tries to release Flash Player on Patch Tuesday and has done so pretty consistently all year, so expect that update.
- Adobe Reader and Acrobat both released an update back in October and have been pretty consistently having an update every two to three months this year. Those two are a possibility this month.
From Mozilla, you can expect one update this month:
- Mozilla’s update calendar is reflecting an update for Tuesday.
Total Update Accumulation four to eight updates for Patch Tuesday next week.
As always, catch our Patch Tuesday blog and commentary next Tuesday and sign up for our Patch Tuesday Webinar next Wednesday, December 14th as we delve deeper into the bulletins and vulnerabilities resolved on Patch Tuesday.
It’s Election Day! I hope you all voted or will be hitting the polls soon, as this election round has been one for the history books. November 8 also happens to be Patch Tuesday. While this is notably of far less concern than hitting the polls today, Patch Tuesday will be delivering updates from Microsoft, Adobe and Google this month and will, unfortunately, still require your attention tomorrow and in the weeks to come.
Microsoft has released 14 bulletins, six of which are rated as critical, resolving 68 unique vulnerabilities. Two of the vulnerabilities have been exploited in the wild (Zero Days), and three of the bulletins contain public disclosures.
First off, we will get a little closure on the Adobe Flash/Microsoft Zero Day that was identified in October and to which Flash released an update on October 26 which resolved CVE-2016-7855. Microsoft has resolved CVE-2016-7255 as part of MS16-135.
Adobe has released another Flash Player update (which is rated as a priority one and resolves nine CVEs. If you haven’t already pushed the Flash update from October 26, ( ) this will be a high priority along with MS16-135.
Microsoft has a second Zero Day vulnerability this month (CVE-2016-7256). MS16-132 resolves an open type font vulnerability that can allow an attacker to remotely execute code. An attacker can target a user to exploit this vulnerability by crafting a document designed to exploit the vulnerability or by hosting a specially crafted website designed to exploit the vulnerability. The attacker would need to convince a user to click on or open the specially crafted content, but that’s really not a significant challenge. This bulletin should also be a high priority this month.
There are a number of public disclosures this month across several bulletins, which means enough information has been leaked to the public to give an attacker a head start on developing exploit code. This increases the risk of exploit occurring for these vulnerabilities so we raise the risk level and priority of bulletins that contain public disclosures. See our Patch Tuesday infographics for more detail.
- MS16-129 for the Edge browser resolves CVE-2016-7199 and CVE-2016-7209
- MS16-135 for Windows resolves CVE-2016-7255 (which has already been exploited)
- MS16-142 for Internet Explorer resolves CVE-2016-7199
Google Chrome went to beta last Wednesday. That along with another Flash Player update means we should expect a Chrome update in the foreseeable future. There is a chance it will come tonight, but it’s more likely to come in the next week. As always you will want to be sure that you have updated Chrome to support the latest Flash Player Plug-In.
If you have not already done so, you will want to make sure to include the Oracle updates from their Q4 CPU that released in October. This included a Critical Java JRE update as well as many other Oracle products.
November also marks the second month of the new servicing model. Here is what you should expect for actual packages to be deployed this month.
The Security Only Bundle (SB16-002) will include the following bulletins: MS16-130, MS16-131, MS16-132, MS16-134, MS16-135, MS16-137, MS16-138, MS16-139, MS16-140 and MS16-142.
The monthly rollup (CR16-002) will include the following bulletins in addition to quality fixes and previous months’ updates: MS16-130, MS16-131, MS16-132, MS16-134, MS16-135, MS16-137, MS16-138, MS16-139, MS16-140 and MS16-142.
As always, we will be running our monthly Patch Tuesday webinar where we will go deeper into the bulletins released and recommendations to prioritize what updates need to be put in place sooner than others. Make sure to sign up for the November Patch Tuesday webinar to catch playbacks of previous months and get access to our infographics and presentations to give you the information you need going into your monthly maintenance. www.shavlik.com/Patch-Tuesday
Since October Patch Tuesday there has been a lot of activity. Oracle released their quarterly CPU including an update for Java JRE, Adobe resolved a Zero Day in Flash Player, our tip of the month, and a quick look at what to expect next week as Patch Tuesday hits.
On the Horizon
Actually more of a continuation from last month. On October 17th Oracle released their quarterly CPU including an update for Java JRE resolving seven vulnerabilities. All seven are remotely executable without the need for authentication and three of these have a CVSS score of 9.6. Java was actually on the lower end of total vulnerabilities addressed in an individual Oracle product for this CPU. Ensure to include this update in your November testing if you have not already deployed it out.
Later in the month Adobe released a Critical Update for Flash Player resolving a Zero Day vulnerability (CVE-2016-7855). On October 26th Adobe released the update for Flash Player (APSB16-36) which started the clock for all the other vendors using the Adobe Flash Plug-In. When a Flash update occurs the plug-ins for Internet Explorer, Firefox, and Chrome also need to be updated.
Firefox uses the NPAPI version of Flash which was also released on the 26th. The update for Flash for IE (MS16-128) released on October 27th plugging the Flash vulnerability. Google Chrome has two install options for Flash, one which relies on Chrome updating. If you are using the Pepper Plug-In it was released on October 26th. If you are using the traditional plug-in, this requires Google Chrome to be updated which occurred on November 1st.
In October, Microsoft changed their servicing model for pre-Windows 10 systems. I covered this extensively in a previous blog post, but there is a little ambiguity with Server 2016’s servicing model options. In a blog post from Microsoft they talk about a Security Only and a Security Quality option each month. This statement specifically caused several people to ask me some questions about how exactly Microsoft is handling updates on Server 2016.
“You can then have the flexibility to choose the security only update, or the quality update to build your patch management strategy around.”
The reality right now is Server 2016 updates are exactly like Windows 10. Cumulative bundles that include all updates that came before. It will be interesting to see if a Security Only option does make itself available in November or sometime in the near future. I expect a number of Microsoft customers would appreciate Security Only as an option for Server 2016.
Patch Management Tip of the Month
Exceptions: You can never push all patches. There is always an update that will conflict with business critical apps which cause exceptions. Documenting these exceptions and the reason they occurred is very important, but documenting an exception is just the beginning.
With each exception you are increasing risk. Each exception is an exposure that will potentially allow malware or ransomware into your environment or allows a threat actor to gain a foothold or move closer to proprietary information or user data. With an exception you should also identify mitigating steps to reduce the risk. This may come in many forms, but here are some examples:
- Least Privilege Rules will often mitigate the impact if an attacker is able to exploit a vulnerability. If you take a look at our Patch Tuesday infographics on our Patch Tuesday page you will see a column labeled “Privilege Management Mitigates Impact”. These vulnerabilities will only gain the attacker equal rights as the user who is exploited. If they are a full Administrator the attacker gains pretty much full access to the system. If they are running reduced privileges then the attacker must use an escalation of privilege vulnerability to gain sufficient permissions to do more.
- Application Control will allow you to control what applications can be installed or run on a system and can effectively block most malware, ransomware, and other forms of attack. Application control can take many forms like Whitelisting or Blacklisting. These would be static application controls. More dynamic forms would include Trusted Ownership or Trusted Vendor rules. These are significantly easier to implement and maintain and also allow you to more easily rollout an effective Application Control Policy. The dynamic approaches are less commonly found, but we have a solution that can help there.
- Containerization can effectively contain the more highly vulnerable user experiences like browsing the web and accessing email. Anything that occurs during these user experiences happens in a virtual container. If you have an exception on the system that is exposed by a phishing attack or drive by download the malicious payload whether a malvertising attack, ransomware, or some other form of malware would execute in the container and be separated from the physical system. Close the container (Browser or email, etc) and the threat goes away.
There are many other strategies to reduce exceptions from exposing too much risk like moving the sensitive application into a virtual environment and locking down access to that system to only require users, but this gives you some ideas. With every exception we recommend documenting the reason why it was made and the additional steps taken to reduce risk to the system.
Your Patch Tuesday Forecast
We are less than a week away from Patch Tuesday and as you can see there is a significant buildup of issues to deal with already. I would forecast that the 3rd party front is going to be lighter than normal for Patch Tuesday and we can expect an average workload from Microsoft on the order of ten or so bulletins total being released.
As always, join us for our Monthly Patch Tuesday Webinar next Wednesday November 9th as we delve deeper into the bulletins and vulnerabilities resolved on Patch Tuesday.
Security Tips for Road Warriors
A couple months ago one of our product evangelists reached out to me and asked how to better protect himself and his personal information in his travels. As he settled into a hotel and a day later saw it in a headline as one of the latest exposed to credit card theft he felt a bit exposed. I would have loved to tell him some magical tips that would 100% safeguard him from that day forward, but in short, you cannot prevent it. There is no way to know who the next breach target it or when the breach could have been occurring. The only guarantee you have is that another breach will occur and odds you will have used your card there at some point. You can, however, reduce the impact when any of your information does get nabbed. Now, you can go to extremes. Cancel all credit cards, just use cash, close all of your social media and online accounts of all kinds, but nobody wants to live that way either. The key is balancing the risks. I talked to many road warriors within our own company and we have some tips and tricks that can help you out. Our road warriors range from my light 16-20 weeks or so of travel per year to Simon, Doug and Rob who spend more than 50% of their year on the road and take us to all parts of the globe. Here are some of the tricks we use to safeguard ourselves and to mitigate the impact if our information becomes exposed.
Phil Richards, Chief Security Officer:
I recommend reporting your credit card as stolen/lost/missing to the credit card issuing company at least annually. This allows you to receive a new credit card number, and invalidates the old one. Many hotel chains and retailers that have had credit card info breaches. For the road warrior, it is highly likely that your card is among them. By changing the CC number, the stolen information is useless and cannot harm you.
Rob Juncker, VP of Engineering:
I never go anywhere without my HooToo. It’s a wall charger with 2 USB ports, an Ethernet port, a fully portable charger (so it’s like a power brick) and embedded router. The best part about this device is it has full router capabilities. I have it setup so my computer always connects to it, and then I bridge the hotel Wifi to my personally secure wifi, or use the Ethernet port to plug into the hotel jack. – I have it set by default to disable all inbound and just allow outbound.
Doug Knight, VP of Systems Management:
For the record, I told Rob about the HooToo, but since he beat me to it here is a tip for additional layers of security and anonymity if your travels take you to countries where you need some extra protection and ability to bypass some levels of content filtering. I subscribe to a VPN service called Private Internet Access. I setup a L2TP and then run their default client on top of that. The IPSEC client gives me encryption and some anonymizing and the L2 VPN even allows me to get thru (pretty reliably) the “Great Firewall of China” to reach content that may otherwise be blocked. For the server setting in the L2TP VPN, it’s best to enter the IP address for the server locale you wish to access instead of the DNS name. To obtain an IP address for this purpose, you can ping it or you can go to http://www.ping.eu/ping and enter the server name to be able to get IPs for the server you would like. Do this before you leave the country.
Simon Townsend, Chief Technologist:
I don’t just evangelize about the great security solutions we have at AppSense. I use them regularly. I run as a standard user on my Windows machine and have a local admin account that is used only for installation and initial setup. I run AppSense Application Manager on my system and by default cannot install or run anything that I download under the context of my own LANDESK account. If I need to install something locally I use RunAs or AppSense self-elevation to give myself temporary permission to perform those actions. If I need to do something that is only going to be temporary I will bring up a VM snapshot that is NAT’d. This provides a Deep Freeze style solution that I can revert easily and separates the task I am performing from local data as it would not be exposed to the VM.
Chris Goettl, Senior Product Manager:
You never know what is observing traffic on public wifi or if the connection you are on has been compromised. Early in my career I connected to a hotel wifi and their router had been compromised. My Gmail session was hijacked by a man in the middle attack and within a few hours suspicious email began flooding forth from my account. Needless to say I changed my password, enabled two factor authentication (also highly recommended) and became infinitely more paranoid during my travels. Now wherever I go, after connecting to the hotel wifi I immediately connect to the corporate VPN before connecting to email or opening my browser. The VPN tunnel provides an additional layer of encrypted protection from prying eyes. I have also just ordered a HooToo and will be adding that to my travel defenses.
October Patch Tuesday will see some changes to how Microsoft and Adobe will be distributing updates. There is a lot of buzz regarding Microsoft’s servicing changes to pre Windows 10 systems. October Patch Tuesday is the first release under this new servicing model, which we will talk about more in a moment. There are a few changes for Adobe Flash Player starting this month that you will need to be aware of. We are expecting a Google Chrome release today and Oracle’s Quarterly CPU next week, so plan on updates for Java JRE and many other Oracle solutions.
Regarding Microsoft’s servicing model changes, Microsoft has basically consolidated all IE and OS bulletins into a single update. This will be served up in one of two ways: as a security only quality update or a security monthly quality rollup. The biggest difference between these is the security only is bundling each month’s security updates only. The rollup includes non-security fixes as well as being cumulative. I recently spoke with LANDESK CSO Phil Richards about this change and he provided some good feedback as far as the challenges companies may face. In last week’s Patch Tuesday Forecast, I also talked about some recommendations on how best to choose between the security only and the rollup options.
Adobe has changed their distribution for Flash Player, so you would need to get an agreement in place with Adobe to be able to get access to the Flash Player distribution page. Today also marks the final release of Flash Player ESR. So instead of a current branch and stable branch, Adobe will just have current branch. Since they are doing fewer feature changes to Flash Player, having a single branch simplifies their release model. The new distribution page included this notification:
Oracle’s Quarterly CPU is coming next week on the 18. Oracle releases on the first month of each quarter on the Tuesday nearest to the 17, which typically falls the week after Patch Tuesday. Watch for an update next week for Java and many other Oracle products.
Google Chrome should be releasing today. The Dev channel for Chrome Desktop updated late last week which usually indicates a Chrome release on Patch Tuesday or soon after. With a Flash Player update, they will be releasing to support the latest plug-in, but likely will have some additional security fixes as well.
Let’s break down the more severe of these bulletins.
Looking at the infographic you would see that Microsoft has released 10 bulletins today — five of which are rated as critical — and there are four unique Zero Day exploits across five of the bulletins. Now there are 10 bulletins, but the actual number of deployable packages is less. There will be the security only or security rollup, which will bundle MS16-118, MS16-120, MS16-122, MS16-123, MS16-124, MS16-125 and MS16-126 together in a single installer. For systems where you have installed a newer version of .Net you will have the .Net Rollup. Skype, Lync, Office and Flash are separate updates yet. So you could have as many as seven packages to deliver to some endpoints, but most will be getting around five actual packages to test.
MS16-118 is a critical update for Internet Explorer. This bulletin resolves 11 vulnerabilities including one Exploit in the Wild (CVE-2016-3298). There are multiple vulnerabilities in this bulletin that are user targeted, meaning the attacker can convince a user to open specially crafted web content to exploit the vulnerabilities. Several of the vulnerabilities can also be mitigated if the user is running as less than a full administrator, the attacker would only gain equal rights to the user reducing the impact if exploited.
MS16-119 is a critical update for Edge browser. This bulletin resolves 13 vulnerabilities including one Exploit in the Wild (CVE-2016-7189). Many of the vulnerabilities resolved in this bulletin are user targeted. An attacker who successfully exploited the vulnerabilities could gain the same user rights as the current user. Customers whose accounts are configured to have fewer user rights on the system could be less impacted than users with administrative user rights.
MS16-120 is a critical update for .Net Framework, Office, Skype for Business, Lync and Silverlight. The bulletin resolves seven vulnerabilities including one Exploit in the Wild (CVE-2016-3393). This bulletin includes vulnerabilities that are user targeted. An attacker can host specially crafted web content or specially crafted document file designed to exploit the vulnerabilities. One of the vulnerabilities (CVE-2016-3396) can also be exploited through the Outlook Preview Pane. Users running with reduced privileges could reduce the impact if exploited.
MS16-121 is an important update for Office. The bulletin resolves one vulnerability, which has been Exploited in the Wild (CVE-2016-7193). An attacker could craft a file to send through email or by specially crafting web content designed to exploit the vulnerability. Users running with reduced privileges could reduce the impact if exploited.
MS16-122 is a critical update for Windows. The bulletin resolves one vulnerability. An attacker could exploit this vulnerability by convincing a user to open a specially crafted file from a webpage or an email message. The Outlook Preview Pane is an attack vector for this vulnerability. Users running with reduced privileges could reduce the impact if exploited.
MS16-126 is a moderate update for Windows. The bulletin resolves one vulnerability, which has been Exploited in the Wild (CVE-2016-3298). This is the same CVE ID as the Exploit in MS16-118 for Internet Explorer. To fully resolve the vulnerability, both MS16-118 and MS16-126 must be installed. For Windows Vista and Server 2008, this means installing two separate packages. For newer Oss, both will be included in the security only or security rollup package.
MS16-127 is a critical update for Flash Player for Internet Explorer. This update resolves 12 vulnerabilities in Adobe Flash Player Plug-In for Internet Explorer. To fully resolve Flash Player vulnerabilities you must install updates for Flash Player, Flash for IE, Flash for Chrome and Flash for Firefox, so this could be multiple installable updates on a single system.
APSB16-32 is a priority one update for Adobe Flash Player. This update resolves 12 vulnerabilities. Many of the vulnerabilities are user targeted and, if exploited, could allow an attacker to take control of the affected system.
For more in depth analysis and conversation regarding this Patch Tuesday, join us for the Shavlik Patch Tuesday Webinar tomorrow morning.
October is here already and should be an interesting lineup of updates coming in the next few weeks. There are also some things you need to know about servicing model changes from Microsoft and on distribution changes for Adobe Flash. Oracle is also going to be dropping their quarterly CPU this month. Read on for more details:
On the Horizon
This is the month Microsoft will have its first delivery under the new servicing model and there is a lot of uncertainty amongst companies as to what really is going to change. I interviewed LANDESK CSO Phil Richards on the subject and he had a lot to say. You can check out the full interview here, but it boils down to this:
- Microsoft’s change, while well intentioned, will impact many companies and could lead to some hard decisions.
- Application compatibility is going to be the most significant of these changes. Most companies know what products are sensitive to updates already, so it may not be a bad idea to reach out to those vendors in advance and start asking if they understand the changes coming and potential ramifications.
- While there may be some hard decisions in the future, with planning and other security measures the problems can be overcome.
Oracle will be releasing their quarterly critical patch update this month. I always try to emphasize this as they will not release on Patch Tuesday, but on the following Tuesday. Oracle’s release schedule is the first month of each quarter on the Tuesday closest to the 17, which falls to Tuesday October 18 this month. The Oracle CPU always brings a lot of fixes for some pretty nasty vulnerabilities. Take July’s release for JRE. This update included 13 security fixes, nine of which were remotely exploitable without authentication. Four of these updates were rated as CVSSv2 9.6, are exploitable remotely without authentication, are rated as low complexity, meaning they are easier to exploit, and rate as high for confidentiality, availability and integrity. According to analysis by Verizon’s 2015 Data Breach Investigations Report, these would fit the pattern of vulnerabilities likely to be exploited within two weeks of release from the vendor.
Adobe has changed availability of Flash Player for distribution. This change has been looming for some time now. We first caught wind of this late last year and since they have pushed the date multiple times, but September 29 they finally took the plunge. From the distribution page you now get two directions to go: for consumers and for companies wanting to distribute. Follow the link to request approval for distribution. I personally went through the process and it was quick and painless and, once approved, you will receive details on how to access the enterprise-ready version of Flash Player for distribution in corporate environments.
Patch Management Tip of the Month
In a conversation I had yesterday with one of our customers, we shared details of the change Microsoft described in its blog and through other sources like the customers Microsoft TAM and talked through some scenarios to figure out a plan to proceed this month and going forward. Here is where we left the conversation understanding full well that “No plan survives contact with enemy.”
- For systems currently in operation plan to test and rollout the October security bundle, which will include updates for IE and the OS in a single package. This package should be security-only updates and also should not be cumulative. In other words, if you need to exclude this bundle for any reason, you should be able to take November’s security bundle without it forcing application of the October security bundle. Expect to take the security bundle each month until you hit a situation where non-security updates (bug fixes) would force the need to apply the cumulative rollup.
- For new systems implemented after the servicing model change, they are planning to start with the cumulative rollup until a point where they hit an exception, in which case they would switch to the security bundle for those systems until the event which caused the exception can be resolved, allowing application of the cumulative rollup once again.
And I will re-emphasize last month’s tip which is to expand your pilot group for application compatibility testing. Getting power users from the parts of your organization that rely on business critical apps will help you to ensure that these larger bundles of updates do not cause impacts earlier in the test process. Many companies have test systems, but only validate some high level functionality like login to the system and basic data rendering. Many issues could occur deeper in legacy apps from rendering of PDFs to printing documents, etc. This year alone we have seen both PDF and GDI updates nearly every month from Microsoft. These are common components to be updated as they are high profile targets for user targeted attacks like phishing scams. A vulnerability exploiting a user is often the first point of entry into a company’s network.
Your Patch Tuesday Forecast
From this point on you can expect an average of three to four Microsoft updates. Under the new servicing model, we will typically see the Security Bundle (IE and OS updates), Flash for IE, .Net, Office and occasionally Sharepoint, SQL, Exchange and other applications.
Oracle will release on October 18, so expect a critical update for Java and many other Oracle solutions.
Adobe is due for an Adobe Acrobat and Reader update, so I am forecasting at least two bulletins from Adobe this month. Adobe Reader and Flash Player with likely use Acrobat as well. If Flash drops we will see the Flash for IE bulletin from Microsoft and plug-in updates for Google Chrome and Mozilla Firefox.
It has been nearly a month since the last Google Chrome release on September 15. They did a re-release late in the month, but with only a minor change. The beta channel for Desktop was updated yesterday so we are not far off. There is a good chance we will see a Chrome update on or before Patch Tuesday.
And as always, watch for our Patch Tuesday update and infographic next Tuesday and catch deeper Patch Tuesday analysis on our monthly Patch Tuesday webinar next Wednesday. Sign-ups and info can be found on our Patch Tuesday page.