Microsoft's Emergency Patch Fails to Fully Fix PrintNightmare RCE Vulnerability

Technology

The Hacker News 08 July, 2021 - 12:13am 22 views

When does Windows 11 come out?

Windows 11 is being pushed out the door as fast as possible, with Microsoft broadly hinting Windows 11 will be released on Oct. 20 and you can expect to see new Windows 11 PCs in 2021's fourth quarter. ComputerworldThe real reason for Windows 11

What is print nightmare?

PrintNightmare is a critical remote code execution (RCE) vulnerability in the Microsoft Windows Print Spooler service (CVE-2021-34527). The vulnerability stems from the service's failure to properly restrict access to "RpcAddPrinterDriverEx()," a function for installing a printer driver on a Windows system. Dark ReadingSecurity 101: The 'PrintNightmare' Flaw

Microsoft warns users to update PC due to potential vulnerability

The Denver Channel 31 December, 1969 - 06:00pm

Microsoft is urging customers who run Windows on a PC to update it immediately due to the threat of "print nightmare."

According to Microsoft, a guide was published accidentally, and hackers could use it to install programs, delete data, and create new user accounts with full access to a PC.

According to The Verge, the attack was so severe that Microsoft has to issue a patch for the 12-year-old Windows 7 more than a year after ending support for it.

"Microsoft has completed the investigation and has released security updates to address this vulnerability," the company said.

If you cannot install the updates, Microsoft says that consumers see their FAQ and Workaround sections.

Don't switch between devices: Here's how to run Android apps on Windows and Mac computers

USA TODAY 08 July, 2021 - 03:12am

Bluestacks and the Your Phone app are two ways you can use Android apps on PC for free.

A link has been sent to your friend's email address.

A link has been posted to your Facebook feed.

The choices can be overwhelming: PC vs laptop? Chromebook or Apple? Columnist Marc Saltzman guides shoppers through the computer-buying process.

Typing away on a sales report for the boss, you decide to take a well-deserved break from work.

Will it be some laughs on TikTok? Sending friends a snap via Snapchat? Playing a game of "Clash with Clans" or "Crash Bandicoot: On the Run"?

The problem is, all of these are mobile apps, and your smartphone is lying on a charging mat. Oh, and the kids are watching videos on your iPad.

Why shouldn't you be able to access these on the laptop or desktop you're already on?

You can, in fact, run Android apps – designed for a smartphone – on your Windows PC or Mac.

There are a couple of different ways to pull this off, in fact, and they’re free, too.

Here are two of the best solutions, to running millions of Android apps on your computer:

The best solution is to install BlueStacks 5 for Windows PC (or Bluestacks 4 for Mac), which lets you run Android on your personal computer.

The San Jose, Calif.-based company claims more than 2 million Android games and apps are supported on its emulator, thanks to the software’s complex virtualization technology developed by 10 engineers over the years.

Because Android is an open operating system, BlueStacks is completely free and legal for users to download and install. It only takes up 2GB of storage once installed, not including any apps you may download.

Other system specs are equally as modest, such as requiring at least 4GB of RAM (system memory), though 8GB or more is recommended. BlueStacks 5 might also require the download of a newer graphics card driver on an aging computer. But that’s about it.

► To download apps and games from the Google Play Store within BlueStacks, simply log in with your Google ID (Gmail address and password) and have at it.

It may take a bit of experimentation to see how some games should be best played on a PC or Mac. For instance, if you’re used to controlling a racing game by tilting your Android phone, you might opt for a keyboard or gamepad instead.

Apps that leverage your smartphone’s camera, such as Instagram, will require a computer with a webcam, of course.

Along with support for the Google Play store, BlueStacks 5 includes a Controls Editor (to create and customize unique control options for your favorite games) and Game Center (which lets you browse through games, based on genres, popularity, and other variables).

A second way to access Android apps and games on a Windows PC is to launch the Your Phone app, which is already built into Windows 10 (and on many Samsung Galaxy smartphones, there’s a preinstalled Link to Windows app, which can also work).

It’s a bit more of a headache to set up and its performance isn’t as good as Bluestacks, but it does let PC users wirelessly access apps on your nearby smartphone – so long as both devices are connected to the same Wi-Fi network.

► If you start from your PC, in the search box on the taskbar, type the words “your phone,” and then click or tap to launch the app.

► If you start from your Android phone, select this from the list of phone models. You’ll be asked to sign in to your Microsoft account, and then prompted to install or open the companion app on your Android device. To do this, open a web browser on your Android device and then enter the link that’s displayed on your PC.

Next, sign in to the companion app with the same Microsoft account that you’re signed in to on your PC. On your PC, select the “Pair with QR code” button. Now use your Android app to screen to scan the QR code that’s displayed on your PC, to link the devices.

Now you can wirelessly access your Android phone from your PC, and even pin Android apps to your Windows taskbar, and launch them individually.

While the Your Phone app does in fact work to access Android apps on a Windows PC, be aware that gamers may find performance a little sluggish.

© 2021 USA TODAY, a division of Gannett Satellite Information Network, LLC.

Windows 11 not only works on a smartphone, you can also play PC games

PCGamesN 08 July, 2021 - 03:12am

It doesn’t look like Microsoft currently has any intentions to bring its upcoming Windows 11 to mobile phones after it canned its previous smartphone venture back in 2017, but that hasn’t stopped the public from trying themselves. As well as its usual x86 desktop CPUs, Windows 11 also supports ARM processors with an eye for highly-efficient Snapdragon-powered laptops, making it that much easier to port the OS to ARM-based phones as a part of the Renegade project.

Youtuber edi194 showed the process of flashing Windows 11 to a OnePlus 6T, replacing its usual Android operating system with Microsoft’s latest. As the OS is designed to be used on the best gaming monitor rather than a 6-inch phone screen, it doesn’t scale well and it strips back some of the usual features you’d expect from a smartphone – you can’t make calls from it. However, the fact that a desktop operating system is successfully running on a tiny mobile device is pretty exciting and leaves room for the Windows Phone 11 somewhere down the line.

The developers behind the project have also compiled a list of the best PC games they’ve tried to run on the OnePlus phone – and yes, it can run Crysis, albeit at 20fps. Less demanding titles such as Left 4 Dead 2 run surprisingly well, hitting around 40fps on high settings at 1080p.

Although Microsoft doesn’t have plans to bring back Windows-based phones right now, this might change. With the best gaming keyboard and best gaming mouse plugged in, an ARM-based Windows 11 phone could easily offer a desktop experience when hooked up to an external display.

Theo Binns Hardware writer

When he's not browsing Amazon seething about graphics cards stock for his haggard rig - not a good look for a hardware writer - you might find him mountain biking, or playing his current favourites: Forza Horizon 4, CS:GO, and Microsoft Flight Simulator.

PrintNightmare official patch is out – update now!

Naked Security 08 July, 2021 - 03:12am

Here’s the good news: Microsoft has released an emergency patch for the infamous PrintNightmare bug that showed up just over a week ago.

The patch is what Redmond refers to as an OOB Security Update, where OOB is short for out-of-band.

OOB is a jargon term that refers to communications that are kept separate from the usual channel you use, notably for safety reasons in case the main channel should fail or need overriding in an emergency.

In Windows update parlance, OOB refers to patches that are deemed so important that they can’t wait until the next official Patch Tuesday, which is always the second Tuesday in each calendar month. (This month, that’s 2021-07-13, which is still almost a week away.)

ICYMI, PrintNightmare is an aptly named bug that became a public danger for the unfortunate reason that a team of security researchers jumped to an incorrect conclusion:

Originally, the bug was reported as an elevation of privilege (EoP) vulnerability, meaning that altough attackers already on your computer could exploit the bug to promote themselves from a regular user to a system account, they couldn’t use it to break into your computer in the first place.

In the meantime, Chinese researchers preparing a paper for the 2021 Black Hat conference were working on their own bug in the Windows Print Spooler.

Theirs sounded very similar, except that it was an RCE bug, short for remote code execution, meaning that it could be used for breaking in, not merely for elevating privilege.

Given that the Chinese researchers’ bug was apparently different, they hadn’t disclosed it yet.

Later in the month, however, Microsoft admitted that CVE-2021-1675 could also be used for RCE, and updated its public advisory to say so.

Even though that meant the bug was more serious in theory, no one worried too much in practice.

After all, a patch was already available, and anyone who had installed the patch to close the EoP hole was, ipso facto, protected against the newly announced RCE hole as well.

The researchers then apparently assumed that their bug was not original, as they had thought.

Because it had already been patched, they assumed that it would therefore not be untimely to publish their existing proof-of-concept exploit code to explain how the vulnerability worked.

What’s the chance,” we guess they asked themselves, “that two different RCE bugs, working in what sounds like exactly the same way, would be found at exactly the same time in exactly the same Windows component, namely the Print Spooler?

With hindsight, which is a wonderful thing indeed, we can compute that chance precisely: 100 percent.

Their bug was not CVE-2021-1675 at all; it was CVE-2021-34527, although no one knew that at the time, because that additional bug number was only issued later on.

Even worse, this new RCE hole wasn’t blocked by Microsoft’s Patch Tuesday update, making the published code into a publicly available, fully functional, break-and-enter exploit.

In the jargon of the cybersecurity industry, the researchers had unwittingly dropped an 0-day.

(“Zero days” is the jargon for a previously unknown and unpatched security hole, because that’s how many days ahead the Good Guys were when the Bad Guys first got to hear about it.)

The researchers removed the zero-day code from the internet pretty quickly, but not quickly enough.

As Pandora found when she opened her proverbial Jar , there’s no point in trying to put secrets back in the box once they’ve escaped.

The PrintNightmare exploit code had already been copied and republished in many places, and almost every known version of Windows was at risk.

Most notably, even Domain Controllers generally have the Print Spooler running by default, so that the PrintNightmare code theoretically gave anyone who already had a foothold inside your network a way to take over the very computer that acts as your network’s “security HQ”.

Fortunately, there was a 2-minute workaround for any and all Windows systems: turn off the Print Spooler and set it into disabled mode so it can’t start up again, either by accident or by design.

No Print Spooler, no attack surface; no attack surface, no security hole; no security hole, no break-and-enter point.

Unfortunately, without the Print Spooler running, you can’t print, so anyone who needed a working printer somewhere on their network working was on the horns of a dilemma: leave the Spooler running only on carefully selected servers, and watch them really carefully; or continually re-enable/print/disable the Spooler every time output was required.

The good news is that there’s a more fundamental fix for the RCE hole available now in the form of Microsoft’s Out-of-Band (OOB) Security Update available for CVE-2021-34527.

Use Settings > Update & Security > Windows Update and install the latest update (KB5004945)

Microsoft has also published some additional precautions that Windows administrators can follow to lock down their printers more thoroughly than before.

For what it’s worth, reports currently circulating on Twitter suggest that this patch only covers the RCE (“breaking in across the network”) part of the bug, not the EoP (“increasing account privilege after you’re in”) part…

…but the patch should be nevertheless be considered critical.

As mentioned above, on an unpatched network, cybercriminals could exploit this hole to take over your entire network, starting from almost any account on almost any computer.

Oh, before we go: don’t make the same mistake as the security researchers who unleashed this zero-day code by mistake.

When it comes to cybersecurity… NEVER ASSUME!

If you have Sophos Central, you can use the Live Discover feature with a query we’ve published to check your whole network for PrintNightmare patches.

On your own computer, you can view your recent updates using Settings > Update & Security > Windows Update > View update history.

Below, we’re running the latest Enterprise Edition of Windows 10 (21H1), and we’ve highlighted the June 2021 Patch Tuesday update, which covers CVE-2021-1675, and the 06 July 2021 Emergency update described in this article, which covers CVE-2021-34527:

NB. The list has 52 entries and covers 10 different hotfix numbers, from KB5004945 to KB5004959. You can download the complete list in Excel or CSV format from the relevant Security Update page.

Follow @NakedSecurity on Twitter for the latest computer security news.

Follow @NakedSecurity on Instagram for exclusive pics, gifs, vids and LOLs!

Does this patch require a reboot?

(Let me be more precise: when I installed it as shown in the screenshot above, it required me to reboot after the download and pre-install phase, which I did. I didn’t use a stopwatch, but it didn’t take long. After rebooting I took the second screenshot you see above and ran the scripts listed. I assume that a reboot will be required on all Windows versions, but I ran it myself only on a Windows 10 Enterpise (21H1) English (US) VM that already had all previous “quality updates” installed.)

Your mileage may vary but I bet it doesn’t vary by much :-)

Microsoft Could Launch A Cloud PC Service Next Week | Digital Trends

Digital Trends 07 July, 2021 - 03:47pm

Specifically, that placeholder also mentions Microsoft’s Scott Manchester as a speaker. He’s currently in charge of a number of things that relate to Cloud PCs and cloud computing. That includes cloud-managed desktops, as well as remote desktop services, second screen remoting, multimedia, and networking technologies.

Such a Microsoft service has been rumored and code-named as “Deschutes” for some time now. For those unfamiliar, the Cloud PC service could work a bit like mainstream cloud PC streaming services such as Shadow Cloud Computing. Basically, it means enterprise and business users could get a virtualized Windows PC via the internet, allowing them to run office apps and the rest of the Microsoft 365 suite on slim devices with lighter specifications known as “thin clients.” System administrators would also be able to provision cloud PCs.

According to ZDNet, this might not be a service for everyone, though. Microsoft might sell Cloud PC as a service for Microsoft 365 users, with a “flat per-user price.” It’s a change from the existing Azure Virtual Desktop, which revolves around using Azure cloud services. There also could be different levels of subscription options offering different levels of RAM, faster CPUs, and increased storage. It doesn’t look as though this could be a service for everyday Windows users.

Imagery for what many had believed to be Microsoft’s Cloud PC service was previously spotted online. The image showcases Windows desktops running in an open browser window, alongside an app switcher, a home button, and a download icon (see above).

Microsoft’s Inspire is Microsoft’s annual IT-focused conference. It is all digital this year and is set to kick off on July 14 and last through July 15. Registration is free, and all that is required is a Microsoft account or Microsoft 365 account to sign up and join.

Copyright ©2021 Designtechnica Corporation. All rights reserved.

How to find and enable your TPM chip for Windows 11

Reviewed 07 July, 2021 - 11:29am

Recommendations are independently chosen by Reviewed’s editors. Purchases you make through our links may earn us a commission.

If you’re planning on upgrading to Windows 11, chances are you and every other Windows user is talking about TPM, or Trusted Platform Module. It's something you’ll need in your computer to successfully install and run Windows 11—and it’s a critical part of the hardware-based encryption process that powers features like BitLocker, Windows Hello, and other security features Windows machines come with nowadays. If you use a PIN, fingerprint, or facial recognition to log into your machine, thank a TPM.

Hardware-level encryption is a lot better for your security than, say, storing the keys to your computing kingdom in the cloud somewhere. A TPM can even check to see if your system’s firmware has been tampered with, and if so it’ll prevent your system from booting up. We don’t envision Microsoft backtracking on its Windows 11 TPM requirement, since it is a critical part of the operating system today. But if you’re poking around in your system trying to figure out if you already have one or not, we go over all that below so there’s no reason to stress—or rush out and buy a TPM.

Don’t stress about TPMs. Microsoft just pulled back the curtain on Windows 11, and it has been updating its guidance on TPMs ever since. Your computer might not even need a separate TPM 2.0 module, so don’t purchase one yet. A lot can change or get clarified between now and Windows 11’s rumored October release, so just kick back and enjoy Windows 10. You'll have until October of 2025 until Microsoft retires the operating system, so there's no need to rush to Windows 11.

If you see a bunch of 'false' statements, that means TPM is either disabled or you don't have the chip.

Normally, running Microsoft’s PC Health Check app would be the first order of business, but it's temporarily unavailable so Microsoft can make updates to the app that better describe why a user's PC is compatible or not with Windows 11. (Microsoft has not said when those updates will completed.) Until it gets that back up and running, you can try the third-party WhyNotWin11 tool, which will give you an even more detailed analysis of whether your system's components meet Windows 11's requirements.

You can also launch PowerShell by searching for that phrase in your Start menu, right-clicking on the app, selecting "Run as administrator," and then typing "get-tpm" and hitting Enter. If you see a bunch of "False" statements in the various TPM fields (especially "TpmPresent"), then you either don't have one or it's not enabled. Finally, you can also pull up your Start menu, type in "tpm.msc," and launch the shortcut that appears. Check the Status box to see if Windows can detect an active TPM on your PC.

If you're lucky, these reports are incorrect. You might actually have a TPM 2.0 chip on your system if you purchased it at any point within the last five years. If you built your desktop yourself, and you’re running at least a sixth-generation Intel "Skylake" or AMD Ryzen 3000-series CPU, these chips come with an embedded TPM. You shouldn't need to buy and install a standalone TPM chip onto your motherboard. You're good to go.

Here's the confusing part: It’s also possible that even one of these TPM 2.0-supporting CPUs still might not work with Windows 11. Microsoft’s list of supported CPUs for Intel and AMD will probably have more changes between now and Windows 11's release date. Wait for Microsoft to finalize its guidance before buying any extra hardware, upgrading your system's parts for Windows 11, or doing anything else more expensive and drastic.

This is where you'll find the TPM option on a Asus ROG X570 Crosshair VIII Hero motherboard.

Roll up your shirtsleeves and refill your water. This might be a bit of a process, especially if you’ve never played around in your PC’s BIOS before. The most important thing to note is that PC and motherboard manufacturers all treat their settings a wee bit differently. There’s not a single, universal location for the setting that will allow you to enable your processor's built-in TPM. The concept is the same, but the exact path to get to the setting you need to change is not.

Start by making sure you’re running the most up-to-date motherboard firmware, or BIOS, that your computer or motherboard manufacturer offers. Hit up the support site for your system or motherboard, look for the downloads section, find the BIOS category or BIOS-updating tool (or both), and use whatever instructions are provided to flash your BIOS with the latest and greatest version.

You'll then need to double-check that your system is running in the UEFI boot mode, and not the legacy BIOS mode. This is easy to find within Windows 10: Pull up the Start menu, type in "MSInfo32," hit Enter, and look for the "BIOS Mode" setting. If it says UEFI, you're good. If it says Legacy, you'll need to convert your primary hard drive from MBR to GPT and switch from "Legacy Mode" to UEFI in your BIOS. Look in your motherboard's manual for the exact setting you'll need to adjust for this. And if you're confused, don't worry. Microsoft has published a great video that walks you through every step of this otherwise-confusing process.

If you don't have a discrete TPM, switch the setting in your BIOS to say "firmware."

Back to TPM—to enable it on your CPU, you'll need to boot into your system’s BIOS (typically by restarting your computer and mashing some keyboard buttons like DEL, F2, or F12). You'll then need to turn on PTT (Intel’s Platform Trust Technology) or fTPM (AMD’s Firmware TPM). Where you’ll find that exact setting depends on your system or motherboard.

In our testing, we had to switch the fTPM setting from its default of “discrete” (implying it's accessing a separate hardware chip we plugged into the motherboard) to “firmware” (accessing what's built into our AMD CPU) in the BIOS of our Asus ROG X570 Crosshair VIII Hero motherboard. Once we did, all the aforementioned “Will Windows 11 work / do you have a TPM” checks passed without a problem. This entire process took less than five minutes to do, and it's something you can speed up if your BIOS has a built-in "search" feature (like ours). All we had to do was search for "fTPM" to jump right to the setting we needed to adjust, a convenience that a more run-of-the-mill motherboard (like what you'd find on the simple laptop you purchased from Dell) probably won't have.

Using the PowerShell is one of the easiest ways to check to see if TPM is enabled on your system.

TPM modules aren't normally very expensive—anywhere from $10-25 in normal times. However, since Microsoft's debut of Windows 11 prices are going up as people panic-buy chips. (If you go on eBay to buy one right now, you’re going to get robbed.)

We can't stress this enough: Be patient. It makes no sense to run out and buy a standalone TPM 2.0 chip right now. There might be hacks or workarounds you can use to bypass this problem once the Windows 11 arrives. Microsoft might ease some aspects of its requirements. More TPM 2.0 chips might flood into the market. You might realize you're fine sticking with Windows 10 until you can upgrade your entire system to something that's faster, better, and Windows 11-compatible. There are a lot of variables to consider, and there's nothing you can or should do right now in the months preceding Windows 11's launch.

It's possible that TPM 2.0 chips might have a huge run-up like every other electronic thing you've been eyeing lately (cough graphics cards). It's also possible that the high prices you see now might remain high. They might even go down if more TPM 2.0 chips hit the market. It's just too early to tell, and we don't think it makes much sense to rush out and buy a standalone chip for an operating system that hasn’t been fully released yet. If you wait, you can make a more informed decision when it actually matters.

If you have a Asus ROG X570 Crosshair VIII Hero, press F9 or click on the magnifying glass icon to bring up the search function.

In theory, most people with newer computers won’t need to skulk around in their systems’ BIOS and fuss with TPM settings in order to get Windows 11 working. However, we've seen plenty of tweets from esteemed tech journalists over the past week who have done just that—some, only after being reminded that they don’t need to buy a discrete TPM chip for their newer computers. This whole TPM debacle is confusing for everyone, expert and newbie alike.

If this all feels like overwhelming nerd-talk, all you have to do is look up the manual for your computer or motherboard and that should, in theory, point you to the exact settings you’ll use to get your TPM 2.0 working. Barring that, ask around for help—system-builder forums, message boards, Twitter, etc. This whole process can feel exceedingly confusing at first, but odds are good that it’ll be easy to get some help over the next several months. Don’t stress about it now, because you still have plenty of time to get your system ready to go before Windows 11 arrives. If your computer has a TPM 2.0 module, you’ll find it by the time you need it.

We'll help you find the best stuff and love the stuff you own.

We'll help you find the best stuff and love the stuff you own.

Technology Stories