Showing posts with label IT Security. Show all posts
Showing posts with label IT Security. Show all posts

Tuesday, July 02, 2019

Windows 10: Yet another problem (another reason to ditch it today)

https://ift.tt/eA8V8J
The original article was published at https://ift.tt/321uzdU

If you use Windows 10 (why?) you will be familiar with the almost constant succession of disastrous updates and flaws Microsoft pushes out to all users of the operating system.

One of the latest to be found is that Microsoft disabled Registry backups in Windows 10 some time around October last year.

Apparently Microsoft disabled this very important feature intentionally but didn’t think it worth telling any of the ~800 million users of the operating system about it. Even worse, the operating system continued to report that the backups had been completed satisfactoriy – even though only an empty backup file had been written!

The problem was first spotted by Ghacks (https://www.ghacks.net/2018/10/31/windows-10-bug-prevents-registry-backup-creation/) who gave the full technical background.

A non-technical explanation that still explains the import of the issue can be found at Forbes (https://www.forbes.com/sites/gordonkelly/2019/06/29/microsoft-windows-10-upgrade-registry-warning-upgrade-windows/) – which also contains links to some of the other malware vulnerabilities, dead computer, data loss and unannounced disconnection of previously working peripherals (like a mouse or keyboard, for example) that have resulted from “updates” and “improvements” pushed out by Microsoft.

Microsoft has issued an explanation (er … the change was made to reduce the amount of disk space taken by the operating system!! Since when was a backup a disk storage problem?) which you can read on the Ghacks site (https://www.ghacks.net/2019/06/29/microsoft-explains-the-lack-of-registry-backups-in-windows-10/) – along with instructions to restore the function “if you want to”.

Let me try to explain the significance. Windows stores ALL its settings (including those affecting security, the operating system itself and individual application programs) in something called its Registry. This is not a plain text file but a pseudo database which can only be edited with a program – regedit.exe – provided with the operating system. Microsoft issues dire warnings that the Registry should NOT be edited by users who do not fully understand the consequences of doing so or the thousands of arcane settings it contains. I would agree – one wrong click of the mouse or a slip of the keyboard when using regedit can make your computer completely inoperable.

Now – Microsoft issues instructions to those very same uncomprehending users to go ahead and edit the Registry to restore a function that should never have been removed!

Why are Registry backups so important?

If you are a Windows user living within a corporate environment in which your security and the mundane – though vitally essential – matter of backing up the state of your machine and its data is taken care of by “the IT Department” then you can (I certainly hope) ignore this problem (at least … the other ones that have happened are a little more bothersome – like finding your work reports or spreadsheets have suddenly disappeared). Peace be with you!

BUT … if you are one of the millions of people who simply purchased a PC or laptop pre-loaded with Windows or fell for the free upgrade offer that Microsoft ran to encourage users of earlier Windows versions to “upgrade” to Windows 10 I very much doubt that you have an effective backup routine in place, let alone know what a “roll-back” is or even have enough security to keep malware and “bad guys” from getting at your machine and its data.

My evidence for that statement is the number of friends who have come to me over the decades clutching their machine or hard drive, holding it out like some form of offering while uttering the time-worn phrase “Please get my data back for me” or “It just stopped working, I don’t know why and all my life and work history is on it!

Unless the cause of failure is an irrecoverable hard disk failure or ransomware style encryption of the entire storage the cause is probably malware (computer virus), hardware fault or just turning the machine off the wrong way. All of these causes (and more) can corrupt the Registry.

And Windows usual response to finding a corrupt Registry is to refuse to boot up at all – ie; your machine is as good as dead.

However, if the Registry has been backed up then even in the case where no System Restore points have been made a Registry Backup can usually be used to restore the machine to an earlier state, allowing Windows to boot and data to be recovered or copied even if program settings and operating system updates or configuration changes must be performed once again.

So … a Registry backup is just about the last line of defence when it comes to restoring a dead Windows machine to life.

But if the Registry backup file is empty … you are out of luck.

Let’s hope you have a friend like me who is able and willing to at least take the machine apart, take out the storage drive(s) and get your data somewhere safe.

I only do it once per close friend – recovering their data can take anything from a few hours to over a day of my time. I give them a sheet of instructions describing an effective backup procedure and send them away with instructions never to darken my door with a dead PC again – owning a computer is just ike owning a car – you don’t have to know how it works BUT YOU DO HAVE TO KNOW HOW TO USE IT SAFELY!

Friday, May 17, 2019

Latest Intel CPU security flaw – what to do about it

https://ift.tt/eA8V8J
The original article was published at http://bit.ly/30qyKiG

In the past few days news has come out that a major flaw inside every computing chip (CPUs or Central Processing Unit) produced by Intel since 2011 contains a major security flaw that would allow hackers to gain access to even the most security-essential data inside your machine (eg; passwords and security certificates you probably don’t even know about, even less think about) without leaving a trace.

The article at https://lifehacker.com/how-to-protect-your-pc-right-now-from-intels-latest-vul-1834779884 explains the flaw and how to avoid falling victim to it – actually just upgrade your devices as every OS supplier has already “fixed” the vulnerability in code. The article provides instructions how to upgrade all the “mainstream” operating systems (the author obviously finds Linux too baffling). As ever, the article includes links that will eventually lead you back to the PR release issued by Intel that in usual fashion confesses their sins.

To anyone running Linux – good news: Linux was updated long before this flaw became public knowledge but just to be safe and sure that you are up-to-date, open a terminal window or command line and enter the command depending on your distribution:

For Debian based versions (eg; Ubuntu, Mint …)

sudo apt update && sudo apt upgrade

then press [Enter] and enter your usual login password when prompted.

For older RHEL (Redhat) based versions (eg; RHEL, Centos less than v7)

sudo yum -y update

then enter the root password when asked – which will ensure everything is up-to-date without further prompting. Wait until the process is finished (command prompt reappears). All is now well.

For newer RHEL (Redhat) based versions (eg; RHEL 7, Centos 7, Fedora)

sudo dnf -y update

then enter the root password when asked – which will ensure everything is up-to-date without further prompting. Wait until the process is finished (command prompt reappears). All is now well.

On all the RHEL based releases is you are unsure of the operating system version in use no harm will come from trying the yum or dnf commands – either the correct command will be automatically substituted or you will get a command not found message – so just use the other version.

Important reminder

To everyone – as ever, don’t click links in emails (even from people you know) unless you know the links destination is somewhere safe – note that I never send a link like this but always like this (https://www.google.co.uk) because the first form obfuscates the link destination (hint: hovering a mouse over it should reveal the link URL in a proper email client but good luck trying to reveal where it leads if using a mobile phone or tablet) – while the second form displays a link in plain sight. If in doubt (you probably shouldn’t use the ink anyway but if you feel you must – eg; the link is in an email purportedly from your bank and you want to check all is well) either load the desired page by typing the normal, known home page URL into your browser and finding the supposed link page or copy the displayed text … not the link and paste that into your browser to see if the page exists on the real site.

BUT the basic remains true DO NOT CLICK any link unless you can trust the source 100% – because I can present a link like this https://www.google.co.uk which actually takes you somewhere entirely different (don’t worry – my example is safe – I have no ill intents on your computer or data – but ask yourself every time you see a link from someone who might not be so benevolent – especially if it looks oh so enticing).

Stay safe out there, people!